# Email authentication headers: what to copy and read

> Locate original message headers, find Authentication-Results and keep the evidence needed to understand an SPF, DKIM or DMARC report.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Reviewed: 2026-11-06.

## Copy the original technical headers

Open the message’s original source or internet headers in your mail client. Copy the complete header block rather than the normal sender, subject and message body. A forwarded copy can describe a different delivery route.

- [Find headers in Gmail, Outlook or iCloud](https://checkdmarc.mx/how-it-works#find-headers)

## Keep identities and results together

A result without its associated identity is hard to diagnose. Keep the complete fields and folded continuation lines so the parser can read their context.

Useful original header fields
| Header | What to look for |
| --- | --- |
| From | The domain visible to the recipient. |
| Authentication-Results | The receiver identifier, results and evaluated identities. |
| DKIM-Signature | Signing domain d= and selector s=; presence alone does not prove a pass. |
| Return-Path / smtp.mailfrom | Evidence of the envelope sender; compare with the reported SPF identity. |
| Received | The transport path, useful when a provider investigates forwarding or relays. |

## Know which receiver produced the result

Authentication-Results records another system’s evaluation. Treat it as evidence only when you know it came from a trusted receiving system. A pasted header can be edited, and the existence of a pass string does not prove a message is authentic.

CheckDMARC can interpret Authentication-Results or ARC-Authentication-Results when pasted. It does not verify an ARC chain or recreate the original receiver’s trust boundary. If results conflict, keep the full original for your mail administrator.

- [How pasted analysis works](https://checkdmarc.mx/how-it-works#paste-headers)

## Review what you share

Original headers may include addresses, identifiers and IP addresses. Use a non-sensitive test message where possible. Before sharing a report, review the preview: names, address local parts and the subject are hidden, but domains, sending IPs and DNS evidence remain useful diagnostic information.

- [Read the sharing walkthrough](https://checkdmarc.mx/how-it-works#share-results)
- [Analyze headers](https://checkdmarc.mx/#email-check)

## Sources

- [RFC 8601 — Authentication-Results and trust boundaries](https://www.rfc-editor.org/rfc/rfc8601.html)

- [Gmail Help — trace an email with its full header](https://support.google.com/mail/answer/29436?hl=en)

## Related reading

- [SPF: check which servers can send for your domain](https://checkdmarc.mx/learn/spf/index.md)

- [DKIM: understand the signature on your email](https://checkdmarc.mx/learn/dkim/index.md)

- [DMARC: connect authentication to your From domain](https://checkdmarc.mx/learn/dmarc/index.md)

[Check your email](https://checkdmarc.mx/#email-check)

Web page: https://checkdmarc.mx/learn/email-authentication-headers