To diagnose why an email failed authentication or went to spam, open the full raw headers and look first at Authentication-Results, Received-SPF, DKIM-Signature, and Return-Path. These four fields tell you whether SPF and DKIM passed, whether DMARC alignment succeeded, and which domain the envelope sender (MAIL FROM) used. Most clients hide them behind a “show original” or “view source” control.
Why email headers are the fastest diagnostic tool
When a message lands in spam or a receiving server rejects it, the visible From address is often misleading. The real story lives in the raw headers. SPF checks the envelope sender, DKIM verifies a cryptographic signature, and DMARC requires at least one of them to align with the visible From domain. Reading the headers lets you see the exact result instead of guessing.
This guide focuses on the fields that matter for deliverability. It does not re-explain the protocols; for background see our SPF, DKIM, and DMARC explained and DMARC alignment is the whole game.
Where to find full headers in common clients
Gmail
Open the message → three-dot menu → Show original. The full header block appears at the top of the new tab.
Outlook (desktop and web)
File → Properties → Internet headers, or in the web app open the message and choose View → View message source.
Apple Mail
Message → All Headers, or View → Message → All Headers. For the raw source use Message → Raw Source.
Once you have the raw text, search for the four fields below.
Key header fields and how to read them
Authentication-Results
Added by the receiving server. Look for lines like:
Authentication-Results: mx.example.com;
spf=pass (example.com: domain of [email protected] designates 192.0.2.1 as permitted sender) [email protected];
dkim=pass header.d=example.com;
dmarc=pass (p=QUARANTINE sp=NONE) header.from=example.comA “pass” here is the receiving server’s summary. Failures appear as softfail, fail, or temperror. Note the domain that was checked.
Received-SPF
Sometimes present as a dedicated header:
Received-SPF: pass (example.com: domain of [email protected] designates 192.0.2.1 as permitted sender) client-ip=192.0.2.1; [email protected]; helo=mail.example.com;This confirms the SPF check against the envelope sender. Compare the envelope-from domain with the visible From domain.
DKIM-Signature
The signature itself looks like:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=default;
h=from:to:subject:date; bh=...; b=...The d= value is the signing domain. For DMARC to pass via DKIM, d= must align with the From domain (relaxed or strict as configured). See also DKIM key rotation.
Return-Path
This is the envelope sender (MAIL FROM):
Return-Path: It is the address used for bounces and the domain SPF is checked against. It can differ from the visible From. For a deeper explanation of From, Reply-To, and Return-Path see our dedicated article From, Reply-To, and Return-Path.
How we analyzed this
We reviewed the header conventions in RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC) and RFC 8601 (Authentication-Results) together with ArawaMail’s Enable Sending guide, which describes how activating sending publishes DKIM, SPF and custom MAIL FROM records. The example excerpts above are redacted and labeled as illustrations; they are not live test results.
Common misconfigurations visible in headers
- SPF pass but DMARC fail — the envelope domain does not align with From. Check your MAIL FROM domain and alignment mode.
- DKIM fail — selector missing, key rotated without DNS update, or body modified in transit. See how to read DMARC reports for aggregate evidence.
- Return-Path on a different domain — expected for some transactional setups; confirm alignment policy allows it.
- Multiple Authentication-Results — the last one (closest to the top of the header block) is usually the final receiving server’s verdict.
Next steps after reading the headers
If SPF or DKIM fails, return to your DNS records. ArawaMail customers can check the domain’s Sending status on the domain details page (see ArawaMail DNS Records). For ongoing monitoring, aggregate DMARC reports remain the best long-term signal.
FAQ
Where do I find the full email headers?
In Gmail use Show original; in Outlook use Internet headers or View message source; in Apple Mail use All Headers or Raw Source.
What does a Return-Path of bounce@ tell me?
It is the envelope sender used for bounces and the domain SPF evaluates. It does not have to match the visible From address.
Can Authentication-Results be forged?
A receiving server’s own Authentication-Results header is added after the message arrives and is not part of the signed content, so it is trusted for that hop. Earlier hops may show different results.
Do I need to understand every Received header?
No. Focus on Authentication-Results, Received-SPF, DKIM-Signature, and Return-Path for authentication diagnosis. The Received chain is useful only when tracing delays or unexpected relays.