1. Open the original message

Use the receiving mailbox’s “show original” or equivalent view. A screenshot of the message body will not contain enough evidence. Save the receipt time and the receiving provider alongside the header extract so a later test can be compared with the same context.

Find the Authentication-Results field added by the receiving system you trust. An arbitrary header inserted earlier in the path is not authoritative just because its name looks right. If you cannot identify the trusted boundary, ask the mailbox administrator rather than treating every result as equally reliable.

2. Put the identities side by side

Start with the domain in the visible From address. Then note the identity evaluated for SPF and the signing domain reported for each DKIM signature. The following is deliberately simplified illustrative evidence, not a live Deliverlens result:

From: Team <hello@example.com>
Authentication-Results: receiver.example;
  spf=pass smtp.mailfrom=bounce.example.net;
  dkim=pass header.d=example.com;
  dmarc=pass header.from=example.com

Here, SPF passes for a different domain. DKIM passes for example.com, matching the visible From domain. That difference explains why a message-level authentication story needs more than three isolated pass/fail labels.

3. Pick a fix supported by the evidence

If DKIM fails, capture its signing domain and selector before opening DNS. If DMARC fails while another mechanism passes, investigate alignment. If authentication passes and the message is in spam, move on to sender behavior, reputation, and recipient expectations instead of repeatedly editing a working DNS policy.

Change one thing, send a fresh authorized test through the same sending service, and inspect the new receiver-added evidence. An old message does not acquire a new signature when DNS changes.

What this header cannot tell you

A header describes this received message and this path. It does not prove that all senders are configured correctly, every receiving provider will make the same decision, or the next campaign will reach the inbox. Keep the raw facts separate from those broader conclusions.

Before you move on

  • Identify the trusted receiving system.
  • Record all three domain identities.
  • Tie a failure to a specific message and timestamp.
  • Retest after a single documented change.