# How to Read Email Headers to Check SPF, DKIM and DMARC

URL: https://warmerly.com/blog/how-to-read-email-headers-spf-dkim-dmarc
Published: 2026-10-14
Reading time: 6 minutes
Tags: Authentication, Troubleshooting, Deliverability

> Find the Authentication-Results line in a message's headers and read spf, dkim and dmarc results in Gmail and Outlook. What pass, fail and alignment mean.

Open the full headers of a message you received and find the Authentication-Results line. It states spf=, dkim= and dmarc= verdicts as the receiving server saw them. In Gmail use the three dots menu and Show original, which also prints PASS or FAIL for each check at the top. Three passes with the right domains is a healthy message.

> **How this was checked**: The result vocabulary and alignment rules come from RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Menu names for Gmail and Outlook are described in general terms and can change.

## Where to find the headers

- Gmail: open the message, three dots menu, Show original. A summary box lists SPF, DKIM and DMARC with PASS or FAIL.
- Outlook on the web: open the message, more actions menu, View message source.
- Desktop Outlook: open the message in its own window, File, Properties, Internet headers.
- Apple Mail: View menu, Message, All Headers.

## A header, line by line

A typical line looks like this: Authentication-Results: mx.google.com; dkim=pass header.i=@example.com header.s=google; spf=pass smtp.mailfrom=example.com; dmarc=pass header.from=example.com. Each part answers one question.

**Reading the three verdicts**
| Field | What it says | What to check |
| --- | --- | --- |
| dkim=pass header.d / header.i | The signature verified. header.d is the signing domain. | Is the signing domain your own domain, or your sending tool's? |
| header.s | The DKIM selector used | It should match a record in your DNS |
| spf=pass smtp.mailfrom | The sending server is allowed by the SPF record of the envelope domain | Is smtp.mailfrom your domain, or the tool's bounce domain? |
| dmarc=pass header.from | At least one of SPF or DKIM passed AND matched the From domain | This is the verdict that decides policy |

## Why pass and dmarc=fail can appear together

SPF and DKIM can pass while DMARC fails. That is the alignment rule. DMARC needs the domain that passed SPF (the envelope sender) or the domain that signed DKIM (d=) to match the domain in the visible From address. If your sending tool signs with its own domain and uses its own bounce address, both checks pass for the tool, neither matches you, and DMARC fails. The fix is the tool's custom domain or authentication set-up, not a change to your From line.

## Common results and what they mean

- spf=softfail or spf=fail: the sending server is not in your SPF record, or the record ends in a way that marks it as not allowed.
- spf=permerror: the record itself is broken, often because of more than 10 lookups or two records. See the SPF permerror guide.
- spf=none or dkim=none: no record found, or no signature on the message.
- dkim=fail (body hash did not verify): something changed the message after it was signed, such as a footer added by a gateway.
- dmarc=fail with spf=pass and dkim=pass: an alignment problem, as above.

One caution: these verdicts are what one receiving server saw for one message. A forwarded message can break SPF, and that is normal. Judge a domain by several messages to several providers, not one.

**Check your DNS instead of waiting for a test mail**
- [Free SPF checker](https://warmerly.com/spf-checker)
- [Free DKIM checker](https://warmerly.com/dkim-checker)
- [Free DMARC checker](https://warmerly.com/dmarc-checker)
- [SPF permerror: too many DNS lookups](https://warmerly.com/blog/spf-permerror-too-many-dns-lookups)

---
Source: https://warmerly.com/blog/how-to-read-email-headers-spf-dkim-dmarc
Full content index: https://warmerly.com/llms-full.txt
Site index: https://warmerly.com/llms.txt