Copy the original technical headers
Open the message’s original source or internet headers in your mail client. Copy the complete header block rather than the normal sender, subject and message body. A forwarded copy can describe a different delivery route.
Keep identities and results together
A result without its associated identity is hard to diagnose. Keep the complete fields and folded continuation lines so the parser can read their context.
| Header | What to look for |
|---|---|
| From | The domain visible to the recipient. |
| Authentication-Results | The receiver identifier, results and evaluated identities. |
| DKIM-Signature | Signing domain d= and selector s=; presence alone does not prove a pass. |
| Return-Path / smtp.mailfrom | Evidence of the envelope sender; compare with the reported SPF identity. |
| Received | The transport path, useful when a provider investigates forwarding or relays. |
Know which receiver produced the result
Authentication-Results records another system’s evaluation. Treat it as evidence only when you know it came from a trusted receiving system. A pasted header can be edited, and the existence of a pass string does not prove a message is authentic.
CheckDMARC can interpret Authentication-Results or ARC-Authentication-Results when pasted. It does not verify an ARC chain or recreate the original receiver’s trust boundary. If results conflict, keep the full original for your mail administrator.
Sources
- RFC 8601 — Authentication-Results and trust boundaries
- Gmail Help — trace an email with its full header
Sources checked on 6 November 2026. Provider guidance can change.