How to Check SPF DKIM DMARC

Why Authentication-Results Headers Matter for Inbox Placement

You sent an email. It delivered. But it landed in the spam folder—or worse, vanished entirely. You checked the bounce report. Everything looked fine. What went wrong?

Authentication is not a checkbox. It’s the bedrock of inbox placement. Without it, your message is invisible to receivers who rely on SPF, DKIM, and DMARC to separate real senders from frauds. And the real proof? The Authentication-Results header in an email’s raw source.

Receiving servers don’t trust your email based on your domain alone. They check for validation. If SPF, DKIM, or DMARC fails, the result shows up directly in the Authentication-Results header—and that’s what determines whether your email gets accepted, quarantined, or discarded.

Even if your email reaches the inbox, a failed check increases its spam score. It lowers your sender reputation. It makes future delivery harder. No amount of content polish can fix that.

Key takeaways

Receiving mail servers evaluate the Authentication-Results header to decide whether to accept, reject, or quarantine your email.
SPF, DKIM, and DMARC must all pass to avoid being tagged as suspicious—even if your email delivers.
You can verify a domain’s authentication status by inspecting the Authentication-Results header in the email’s raw source.

What Is the Authentication-Results Header in an Email?

The Authentication-Results header is a field in an email’s raw source that summarizes how well the message passed SPF, DKIM, and DMARC checks. It’s added by the receiving mail server after testing the email against your domain’s published authentication policies, and helps determine whether the email is legitimate. You’ll typically see it in the full message headers, not in the body.

How Authentication-Results Works in Practice

When an email arrives, the receiving server runs a series of checks using the sender's published DNS records. SPF validates the sending IP, DKIM confirms the message content hasn’t changed, and DMARC enforces policy based on how those two checks turn out. The results are condensed into a single header field, making it easy to see at a glance whether the email passed verification.

Each authentication method has its own result field: spf, dkim, and dmarc. A value of pass means that specific check succeeded. If the result is fail, the server found a mismatch—most often an invalid sender IP or modified content. Values like neutral or softfail indicate partial validation, often used in testing or transitional phases and treated as less trustworthy by some filters.

For example, a spf=pass means the sending server was authorized in your SPF record. A dkim=pass means the signature matched your public key. If any of these fail, the dmarc result may also fail, especially if your DMARC policy is set to reject. This is why even one failure can lead to your email being marked as suspicious.

While this header is standard practice, not every email service or inbox provider includes or respects it in the same way. RFC 7001 (the standard defining Authentication-Results) outlines the field’s purpose and format—it’s part of the framework that helps reduce spoofing and phishing. You can review the official specification on the IETF’s site: IETF RFC 7001.

If you're verifying bulk lists or testing your email’s deliverability, seeing these results can help diagnose why an email was rejected. Use MailTester’s inbox placement tool to simulate real recipient server behavior and see whether your messages pass authentication in practice. You can also test individual addresses with our real-time verification API to check their health before sending. For managing large lists, bulk verification ensures your audience is clean and deliverable.

How to Spot a Passed SPF DKIM DMARC Check in the Header

You can confirm an email passed SPF, DKIM, and DMARC checks by examining the Authentication-Results header field. Look for spf=pass, dkim=pass, and dmarc=pass all present in the same header block. If all three are marked as pass, your message successfully passed all three authentication checks. The order doesn’t matter—only the presence of all three indicators.

Step-by-Step: How to Verify the Headers

Open the full email header in your inbox or email client (look for "Show Original" or "View Full Header").
Search for a line that begins with Authentication-Results: — this is where the results of email authentication checks are logged.
Check for three specific components: spf=pass, dkim=pass, and dmarc=pass. These must all appear in the same header block.
If any one of them is fail, softfail, or none, the authentication is not fully successful.
It's okay if the order differs — some mail servers list DKIM first, others SPF — but all three pass indicators must be present.

Why This Matters for Deliverability

These checks are how receiving servers validate that the email wasn’t spoofed and actually came from an authorized sender. A failure in any one can lead to filtering or rejection. According to RFC 7001, a standard that defines DMARC, passing all three is a strong signal of sender legitimacy. This increases the odds your email lands in the inbox, not the spam folder.

For deeper verification, you can test actual email deliverability across real inboxes. MailTester’s inbox placement tester simulates real-world delivery and reveals how authentication results affect inbox placement — down to the level of real user inboxes.

Authentication is not optional in modern email. Without it, even properly formatted messages may be blocked or marked as spam.

When building or auditing campaigns, verify your domains using tools that test real-world authentication alignment. For large lists, use the bulk verification tool or integrate with your platform via the verification API. You can also see a full breakdown of how different authentication results affect delivery in our integrations section.

How to View the Header and Locate Authentication-Results

You can check if SPF, DKIM, and DMARC passed by examining the email header. In Gmail, click the three-dot menu and select “Show original.” In Outlook, go to File > Properties > Internet headers. In Apple Mail, choose View > Message > Show Source. Copy the full header and paste it into a text editor or online tool to find the Authentication-Results field, which lists each test’s outcome.

Step-by-step: Access the email header

Gmail: Open the message, click the three-dot menu in the top-right, and select “Show original.” This reveals the complete raw header.
Outlook (Windows): Open the message, go to File > Properties, and click “Internet headers.” The full message source will appear in a new window.
Apple Mail: Choose View > Message > Show Source. The raw header appears in a plain text window, showing all technical details.
Copy and analyze: Highlight the entire header, copy it, and paste it into a text editor (like Notepad or VS Code) or an online diagnostic tool. Look for a field labeled Authentication-Results.

What to look for in Authentication-Results

The Authentication-Results header contains the results of SPF, DKIM, and DMARC checks. Each test reports pass, fail, or neutral. For example: spf=pass (sender IP is authorized). A lack of a result means the test wasn’t run or wasn’t configured.

The 4 steps described in “Step-by-step: Access the email header”, in order.

According to RFC 7601, this field is designed to help receiving systems evaluate message authenticity. You’ll often find it in headers from providers like Google, Microsoft, and Yahoo. A well-configured domain will show all three tests passing, indicating strong sender authentication.

For faster, automated validation, you can use tools like MailTester’s bulk verification to check large lists for valid sender configurations. The API version (verification API) integrates directly into your workflows to validate domains and headers at scale. You can also test inbox placement (inbox tester) before sending, ensuring your messages appear in inboxes—not spam folders.

SPF, DKIM, and DMARC: What Each Check Actually Verifies

SPF, DKIM, and DMARC are three core email authentication methods that confirm whether an email is genuinely from your domain, whether its content was altered in transit, and what happens if either check fails. SPF authorizes specific sending servers; DKIM uses digital signatures to verify message integrity; DMARC ties both together and enforces policies with reporting. Together, they prevent spoofing and help deliverability.

SPF: Confirming the Sender's Authority

SPF checks if the server sending the email is listed in your domain’s DNS records as an approved sender. If the IP address isn’t in the list, the email fails SPF. This prevents unauthorized servers from impersonating your domain.

For example, if you use SendGrid but haven’t added its IPs to your SPF record, incoming mail servers will reject your messages. SPF is strict—multiple SPF records cause failures, and the check stops at the first mismatch. Learn more about SPF setup in the official RFC 7208.

DKIM: Ensuring Message Integrity

DKIM adds a digital signature to the email header and body, which receivers verify using your domain’s public key in DNS. If the signature doesn’t match the content, the email is flagged as altered or tampered with.

Even a single changed character—like a space or a typo—breaks the signature. This makes DKIM ideal for protecting newsletters, receipts, and transactional messages from being modified in transit.

DMARC: The Enforcement Layer

DMARC acts as the policy engine. It says: "If SPF or DKIM fails, here’s what to do—reject, quarantine, or allow." It also collects reports so you can see who’s sending mail as your domain.

DMARC reports help you detect phishing attempts, misconfigured services, or breached email accounts. Without DMARC, even if SPF and DKIM pass, you’re not actively protecting your brand. It’s the final safety net.

Want to test how well your domain handles authentication? Use MailTester’s inbox placement tool to see how your emails survive real-world checks, or verify your entire list with bulk verification to catch invalid or risky domains before sending.

Why a Single Fail Among SPF DKIM DMARC Can Still Block Deliverability

You might pass SPF, DKIM, or DMARC individually, but one failure among the three can still get your email blocked—especially if the recipient’s server enforces strict authentication policies. Even a single misalignment in domain or signature checks can trigger spam filters, flag your message as suspicious, or land it in spam or quarantine. It’s not just about passing all tests—it’s about passing them correctly and with alignment.

Spammers Exploit Loopholes—Servers Play Defense

Receiving servers treat authentication gaps as red flags. If SPF fails, even if DKIM passes, some providers will ignore the DKIM result entirely. Others will treat multiple failures as a sign of spoofing or compromised infrastructure. The reality is: one weak link can break the chain, especially if the server’s policy is set to reject or quarantine messages with any failing check.

Think of it this way: passing all three isn’t optional—it’s required for trust. If one fails, you’re no longer a verified sender in the eyes of advanced filters. Even a single DMARC alignment failure—common with third-party email services—is enough to harm sender reputation, despite technically passing the check.

Alignment Is the Real Gatekeeper

Passing SPF or DKIM doesn't matter if the domain alignment fails. For example, a DKIM signature might validate perfectly, but if it’s signed by a subdomain like mailer.example.com while the From domain is example.com, alignment fails. The same applies to SPF: if your SPF record allows a sending IP but the authorized domain doesn't match the From domain, the message gets flagged.

This is why you’ll see DMARC reports show “pass” on DKIM or SPF but still report “fail” on alignment. These alignment failures are often the real reason a message gets quarantined—even if technically valid. According to RFC 7660, DMARC alignment is mandatory for policy enforcement: without it, no trusted action can be taken, which means emails without it are treated with suspicion.

You can use tools like MailTester’s inbox placement test to simulate how your messages land across providers. It checks not just deliverability, but whether SPF, DKIM, and DMARC—along with alignment—pass in real-world conditions. Run this test before large sends to catch issues early.

And yes, you can verify all three in bulk. MailTester’s email list verification checks domains for valid SPF, DKIM, and DMARC setups—helping you find risky or misconfigured addresses before sending. You don’t need to guess. The email authentication standards are clear. Your job is to comply with them—but only if you actually check.

How to Test Authentication Results Without Sending Emails

You can check if SPF, DKIM, and DMARC passed using Authentication-Results by sending test emails through your own infrastructure with a verification tool like MailTester. These tools deliver messages to real inbox environments and return full email headers, including the Authentication-Results field, so you can see pass/fail status without sending to real users or risking your domain reputation.

Test at Scale with Real Headers

Instead of guessing whether your domain’s authentication is working, use real-time verification tools that send test emails from your actual sending infrastructure. MailTester’s inbox placement testing does this by simulating real delivery across major inbox providers. The full headers returned include the Authentication-Results line, which shows exactly how each authentication method passed or failed.

This gives you complete visibility into your email security setup without exposing real customers or affecting sender reputation. You’re not testing a single address — you’re validating alignment across thousands of recipients at once. Batch verification lets you catch configuration errors, misconfigured DKIM selectors, or missing SPF records before your next campaign.

See the Full Picture, Not Just a Score

Many tools only return a “valid” or “invalid” label. MailTester goes further by showing the actual header values. This includes the Authentication-Results field, which RFC 7001 defines as the authoritative log of authentication outcomes. The standard specifies that this field must report the results of SPF, DKIM, and DMARC checks — and that’s exactly what you get when you use MailTester’s inbox placement tester.

The Authentication-Results header tells you if your SPF record allowed the sending IP, if DKIM signed the message correctly, and if DMARC policy was enforced. You can inspect these results in real time, without sending emails to your actual list. This is critical during list hygiene checks, pre-campaign validation, or when troubleshooting deliverability issues.

Use the inbox placement tester for real-time results, or integrate with your stack via the real-time verification API. The full header output enables you to validate alignment, diagnose failures, and correct issues at scale. It’s the only way to know for sure that SPF, DKIM, and DMARC passed — not just in theory, but in practice.

Can You Trust a 'Pass' Result in Authentication-Results?

A 'pass' in Authentication-Results means the receiving server successfully verified your email against your domain’s published SPF, DKIM, and DMARC policies. It confirms your email met technical authentication standards, but it doesn’t guarantee inbox delivery, avoid spam filters, or protect against reputation damage. You’re not off the hook just because the check passed.

What a 'Pass' Actually Means

When a receiving server reports a 'pass' in the Authentication-Results header, it means your email was validated against the records published in your domain’s DNS. This includes SPF (sender policy), DKIM (digital signature), and DMARC (enforcement policy). The check is technical—no human review, no content analysis.

For example, if your server sends from a subdomain with a valid SPF record and a DKIM signature that matches the published public key, the receiving server will return a 'pass'. This is a strong signal, but it's just one piece of the inbox placement puzzle.

Why a 'Pass' Isn’t a Green Light

Authentication is a gatekeeper, not a judge. Passing SPF/DKIM/DMARC means you’ve cleared the technical entry, but the real question is whether the mail is welcome. The receiving server still applies spam filters, checks sender reputation, analyzes content, and tracks engagement signals like opens and replies.

Even if your email passes authentication, it can end up in spam if: your volume spikes too fast (triggering rate-based filters), you’re on a known blacklist, or your content contains spammy phrases. Some ISPs don’t rely solely on authentication but factor in the sender’s historical behavior.

Additionally, a 'pass' doesn’t protect against spam traps or low engagement. You can send a perfectly authenticated email to a dormant address that’s been repurposed as a trap. If you hit it, your reputation can take a hit—even if the authentication was clean. This is why some providers, like Google and Microsoft, use reputation-based scoring that goes beyond header validation.

Authentication is necessary, but not sufficient. It’s like passing security at an airport—you’re cleared for the gate, but the airline still checks your seat, boarding pass, and travel history. For a more complete evaluation, you need to test real inbox placement, monitor list hygiene, and maintain consistent sending behavior.

If you're verifying large lists or testing email campaigns, tools like MailTester can help validate not just authentication, but deliverability and list health. It checks for invalid addresses, disposable domains, and catch-all responses—factors that authentication alone won’t catch. Try an inbox test to see where your messages land in real inboxes: inbox placement testing.

How MailTester Helps You Check SPF DKIM DMARC Pass Status at Scale

You can verify SPF, DKIM, and DMARC pass status at scale by sending a real test email through your domain via MailTester’s inbox placement test. The tool returns the full original email header, including the Authentication-Results field, which shows the outcome of each protocol independently. You’ll see clear pass/fail results for SPF, DKIM, and DMARC, including alignment issues, so you can fix problems before sending to real lists. With bulk testing, you can audit 50,000+ addresses in minutes.

Real Headers, Real Data, No Guesswork

Let’s be clear: this isn’t simulated. MailTester sends an actual message using your domain’s infrastructure, so the authentication results you see are what receivers will see. The full header, including the Authentication-Results, is returned exactly as it appears on the receiving end — no interpretation, no filtering.

That means you can inspect the raw values for spf=pass, dkim=pass, and dmarc=pass directly, or trace where they failed. If DKIM fails due to a signature mismatch, or SPF fails because of a misconfigured IP, the header will show it. You’re not relying on indirect signals — you’re seeing what the receiving server actually evaluated.

Find Alignment Issues Before They Break Deliverability

Alignment is a key part of DMARC. Even if SPF and DKIM pass, DMARC fails if the domains don't align. MailTester catches this — for instance, when your from address domain doesn’t match the domain in the SPF record or DKIM signature. This common misalignment is a frequent cause of inbox placement failure, especially with larger senders.

Using the full header, you can audit entire campaigns or lists. For example, if you're setting up a new email campaign, run a test on 50,000 subscribers in under 30 minutes. Identify which domains have broken or missing records. Fix them before sending — no guesswork, no wasted sends.

MailTester’s inbox-placement test integrates with tools like Mailchimp, HubSpot, and SendGrid via our integrations, so you can run verification in your workflow. The tool is built for scale, and your credits never expire — meaning you can maintain audit practices over time without worrying about expiration.

For developers, the real-time verification API lets you validate addresses and check authentication health programmatically. This is the same engine behind our bulk tests, just accessible in code.

Authentication is part of the foundation. Misconfigured SPF, DKIM, or DMARC can result in your messages being discarded — even if your content is perfect. Use tools like MailTester to validate what actually matters: the server-side checks. This is how you build reliable sendership. RFC 7001 and dmarc.org offer the standards behind these protocols — your verification tool should reflect the real-world behavior they define.

What to Do If SPF DKIM DMARC Isn’t Passing in Your Results

If SPF, DKIM, or DMARC aren’t passing in your Authentication-Results header, start by checking whether your SPF record includes all active sending IPs and stays under the 10 DNS lookup limit—exceeding this stops validation. Confirm DKIM is signed with the correct selector and domain in DNS. Set DMARC policy to p=none during testing or p=quarantine for early enforcement. Use MailTester’s real-time API to catch issues before sending, reducing bounces and improving inbox placement.

Fix SPF Record Issues

Review your SPF record using MXToolbox or dig to verify it includes every IP or service used for sending (like SendGrid, AWS SES, or your mail server).
Count DNS lookups: each include:, redirect:, or exp: counts toward the 10-lookup limit. Exceeding this causes SPF to fail silently.
Use a tool like RFC 7208 to validate formatting—spelling errors or missing quotes break parsing.

Verify DKIM & DMARC Configuration

Ensure the DKIM signature uses the correct selector (e.g., default._domainkey) and domain as published in DNS.
Test the DKIM signature with DKIM Validator or your email provider’s test tools—missing or malformed keys fail verification.
Set DMARC policy to p=none during testing to avoid quarantining legitimate emails. Switch to p=quarantine or p=reject only after confirming alignment and low failure rates.
Check your DMARC aggregate reports at Postmark’s guide to DMARC reports to identify unauthorized senders or misconfigurations.

Let’s not wait until emails bounce or land in spam folders. Proactively test domains before sending using the MailTester API. With 98.9% accuracy, it checks SPF, DKIM, and DMARC in real time—identifying invalid, catch-all, and risky addresses before they hit your inbox.

Final Takeaway: Authentication-Results Are the Real Proof of Email Legitimacy

Authentication isn't automatic. Even if you’ve set up SPF, DKIM, and DMARC, you can’t assume they’re working as intended. The only way to know is to inspect the Authentication-Results header in a real email message.

Failures in any of these three mechanisms often go unnoticed. They don’t trigger immediate bounces, but they silently hurt sender reputation and inbox placement. A single mismatch can result in delivery to spam folders—or outright rejection.

What Works in Practice

Check the Authentication-Results header for each send before scaling.
Use tools like MailTester to simulate real-world delivery and validate full authentication success.
Don’t treat a "pass" as perfect—it means the basics are working, not that your full setup is bulletproof.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does Authentication-Results: spf=pass mean?

It means the sending server’s IP is listed in your domain’s SPF record, and the email passed the SPF check.

Why does DKIM pass but SPF fail in my email header?

This usually means the IP is not included in your SPF record, but the email content hasn’t been altered. It signals a misconfiguration in your SPF setup.

Can Authentication-Results be forged?

No—this header is generated by the receiving mail server after validating the email. It cannot be forged by the sender.

Does a DMARC pass guarantee my email goes to the inbox?

No. A DMARC pass means your email passed alignment checks, but other factors like content, spam traps, or engagement still determine final inbox placement.

How often should I check SPF DKIM DMARC with Authentication-Results?

Check before sending campaigns, after domain changes, when transitioning sending providers, and quarterly for ongoing compliance.

Does MailTester test DMARC alignment?

Yes—MailTester’s inbox placement test includes full analysis of DMARC alignment, including SPF and DKIM alignment.

What happens if my email fails DKIM but passes SPF?

The message may still be delivered, but without content integrity proof. Some providers may apply stricter spam filters or reduce sender trust.

Can I use a free tool to check Authentication-Results?

Yes, services like MxToolbox or Gmail’s 'Show original' let you view headers, but only tools like MailTester provide verified, scalable testing.

Is a ‘softfail’ in SPF worse than a ‘fail’?

Not necessarily. A softfail allows delivery but flags the sender as suspicious. It’s a warning, not an outright block.

Why does MailTester show 98.9% accuracy in email verification?

MailTester uses real-time SMTP checks, full header analysis, and domain intelligence to validate email status—accurate for detecting pass/fail states in Authentication-Results.