Deliverability
How to Read Email Headers for SPF, DKIM, and DMARC Results
A non-developer guide to reading received-message headers, finding Authentication-Results, checking alignment, and knowing when a "pass" is not enough.
To diagnose SPF, DKIM, and DMARC, open the original message source and find the Authentication-Results added by the receiving mailbox. Read the result, the domain each method authenticated, and whether that domain aligns with the visible From address. A single "pass" is not enough if it belongs to an unrelated domain or a different sending path.
Use the Email Authentication Analyzer to structure the DNS review, then confirm the actual records through a live lookup. Header inspection shows what happened to a real message after it traveled through the actual sender.
Start with four identities
Email exposes several identities that people often treat as one:
| Identity | What it represents | Why it matters |
|---|---|---|
| Visible From | Address the recipient sees | DMARC alignment is measured against its domain |
| Return-Path or envelope sender | Address used for delivery errors | SPF usually authenticates this domain |
| DKIM signing domain | Domain in the DKIM signature | Can satisfy DMARC when it aligns with From |
| Received path | Servers that handled the message | Helps identify the real sending route |
The visible From domain is the anchor for DMARC. SPF and DKIM do not both need to align for DMARC to pass; one aligned passing method can be enough. Using both correctly gives resilience.
Find Authentication-Results
In Gmail, use "Show original." Other clients use labels such as "View source," "View message details," or "Internet headers."
Look for the receiver's Authentication-Results section. It may summarize:
- SPF result and authenticated domain
- DKIM result and signing domain
- DMARC result and policy
- sometimes ARC or other receiver-specific checks
Use the result added by the final receiving system you trust. Messages can contain multiple Received and authentication sections because several systems handled the mail.
Read SPF correctly
SPF checks whether the sending IP is authorized for the envelope sender domain. A pass is good, but ask two more questions:
- Is this the sending service you expected?
- Does the authenticated SPF domain align with the visible From domain?
Forwarding can break SPF because the forwarding server's IP may not be authorized by the original sender's SPF record. That is one reason DKIM matters.
Common SPF failures include:
- the provider is missing from the SPF record
- more than one conflicting SPF record exists
- the record exceeds SPF processing limits
- the message used a different envelope domain than expected
- a forwarding path changed the sending IP
Read DKIM correctly
DKIM verifies a cryptographic signature added by the sender. The header shows a signing domain and selector. A pass indicates the signed parts remained valid and the public key matched.
Ask:
- Is the signing domain controlled by or aligned with the visible From domain?
- Is the selector the one configured for this sending platform?
- Did the same message version used in production carry the signature?
A vendor-owned DKIM domain can pass without aligning to your From domain. Configure custom DKIM where the provider supports it.
Read DMARC correctly
DMARC evaluates alignment. It compares the visible From domain with the authenticated SPF and DKIM domains.
Interpretation:
- DMARC pass: at least one supported method passed and aligned
- DMARC fail: neither SPF nor DKIM both passed and aligned
- policy p=none: monitor failures
- policy quarantine: ask receivers to treat failures as suspicious
- policy reject: ask receivers to reject failures
Read DMARC p=none vs quarantine vs reject before changing policy based on one message.
Diagnose with a three-message test
Send the exact production format to:
- a personal Gmail test account
- an Outlook consumer test account
- a Yahoo test account
For each received message, record:
- visible From domain
- SPF result and domain
- DKIM result and domain
- DMARC result
- whether the message reached inbox, tabs, junk, or rejection
This is not a statistically valid inbox-placement study. It is a configuration check across three major paths. Use provider dashboards and controlled testing for broader evidence.
Then review the content with the 2026 deliverability checklist and compare the domain setup with SPF, DKIM, and DMARC for sales teams.
Why does DMARC fail when SPF passes?
SPF can pass for the Return-Path domain while that domain does not align with the visible From domain. In that case, SPF does not satisfy DMARC. DMARC can still pass if DKIM passes with an aligned signing domain.
Does an authentication pass guarantee inbox placement?
No. Authentication proves identity and alignment controls; it does not prove recipient expectation, list quality, relevance, low complaints, or positive reputation. Treat authentication as a required gate inside a broader deliverability review.
Sources and next step
Primary sources: Google email sender guidelines, DMARC.org's overview, and Microsoft's email authentication guidance.
Inspect one real message today, use the Email Authentication Analyzer as the record checklist, verify live DNS separately, and run the content through the Folderly deliverability checker.
Folderly Research
Deliverability and cold email strategy team
Folderly Research studies cold email quality, sender reputation, and deliverability patterns across outbound workflows so teams can ship sharper messages without guessing.
Next step
Check the draft before the campaign goes live.
Run copy, AI-template, compliance, complaint-budget, and sender setup guidance in the public Folderly checker.