Authentication-Results
Returned by every major receiver. The wording varies between operators and versions; the code is what identifies it.
spf=fail (sender IP is 203.0.113.5) smtp.mailfrom=yourdomain.com; dkim=fail reason="signature verification failed"; dmarc=fail action=quarantine
What the receiving server did
Every major receiver writes an Authentication-Results header into messages it accepts, recording what each check concluded. It is added by the receiver, so it is only trustworthy on the copy that arrived — a header in your Sent folder proves nothing.
To read it: open a delivered message, show the original or the source, and find the topmost Authentication-Results line. The topmost one was written by the final receiver; earlier ones came from hops along the way and can be forged.
Three verdicts matter, and they are independent. SPF describes the connecting server. DKIM describes the signature. DMARC describes whether either of those passed for a domain that matches what the reader sees.
Why yours failed — in the order it is usually true
- 1
spf=softfail — the record says "probably not this server"
The record ends in ~all and the connecting IP is not listed. Delivery usually continues with a mark against it. If the sender is legitimate, add it; if not, this is the record doing its job.
SPF record has no all mechanism — why unmatched senders get a free pass - 2
spf=permerror — the record could not be evaluated
Almost always the ten-lookup limit or two records published at once. Receivers treat permerror as no usable result, so a domain in this state has effectively no SPF at all.
SPF PermError: too many DNS lookups (the 10-lookup limit) — how to fix it - 3
dkim=none — nothing was signed
Distinct from dkim=fail. none means the message carried no signature; fail means it carried one that did not verify, often because a mailing list modified the body in transit.
DKIM selector not found — how to locate your actual selector - 4
dmarc=fail despite spf=pass or dkim=pass
This is alignment failing rather than authentication. Compare header.d= on the DKIM result and smtp.mailfrom= on the SPF result against the domain in the From address. If they differ, the check passed for somebody else.
DMARC p=none is monitoring, not protection — how to reach enforcement - 5
dmarc=none — no policy was found
No DMARC record exists on the domain or its organisational parent. Nothing is being enforced, and no reports are being generated to tell you what would have happened.
No DMARC record — what to publish first
Check what your domain publishes right now
Free, no signup. It counts your SPF lookups, tries 24 DKIM selectors and reads your DMARC policy, then tells you which of the causes above applies to you.