A header added by receiving mail systems that records the results of SPF, DKIM and DMARC checks. It shows which authentication tests passed or failed, along with the domains and identifiers evaluated, so administrators and filters can trace why a message was trusted, quarantined or rejected.
What the Authentication-Results header records
The Authentication-Results header is a machine-generated trace inserted by the receiving mail system after it evaluates authentication checks such as SPF, DKIM and DMARC. It is not an original sender claim, but an audit trail of what the receiver observed and decided.
Because the header is written by the inbound mail infrastructure, it helps explain why a message was accepted, filtered, quarantined or rejected. That makes it especially useful when comparing what the sender intended with what the recipient system actually verified.
How to read the result values and identifiers
The header usually separates each authentication mechanism into its own result token, such as pass, fail, softfail, temperror or none, and it often includes the domain or identifier that was checked. Those details matter because a single message can pass one control and fail another, which is often the first clue that a message was relayed, spoofed or modified in transit.
Reading the header carefully means distinguishing the evaluation outcome from the mechanism being evaluated. A DMARC pass, for example, does not erase a DKIM failure, and an SPF pass only speaks to the envelope sender and source IP alignment that the receiver tested.
Why it matters for email trust and investigation
Authentication-Results gives administrators and analysts a consistent way to trace trust decisions across mail gateways, security filters and mailbox logs. In phishing investigations, it often becomes the fastest path to understanding whether the message failed authentication, was rewritten by a gateway, or reached the mailbox with legitimate-looking but unauthenticated content.
It also helps explain false positives and false negatives in filtering. If a message was quarantined despite passing one check, the receiver may have weighted other signals, such as reputation, alignment, policy or content analysis.
Common pitfalls when using the header
This header is useful, but it is not a stand-alone proof of legitimacy. It can be copied, altered in transit by intermediaries, or misunderstood when multiple receiving systems add their own results, so analysts should treat it as one piece of evidence rather than a final verdict.
Another common mistake is assuming that any one passing result means the message is safe. Attackers can abuse legitimate infrastructure, forwarders and compromised domains, so the broader message context, sending path and mailbox telemetry still matter.
Risk and Threat Considerations
email authentication results reduce uncertainty, but they do not eliminate spoofing, replay, forwarding artefacts or compromise of a legitimate sender. In incident response, attackers often benefit when defenders over-trust a single passing signal and stop looking for broader evidence of impersonation or account abuse.
Failure mechanism: A message can appear credible because one authentication check passes, even while the actual sender, route or content is malicious, or because downstream systems interpret multiple headers inconsistently.
Impact: Misread results can lead to missed phishing, poor scoping, incorrect filtering decisions and slower containment when a sender domain, mailbox or relay has been abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Authentication-Results is analyzed as mail evidence for trust decisions and investigations. |
| IA-2 — Identification and Authentication (Organizational Users) | The header documents authentication checks that influence whether mail is trusted or rejected. | |
| Recommendation — Review mail authentication results with related logs to support alert triage and incident analysis. Use authenticated-mail evidence to enforce sender verification before trust is granted. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | The header functions as security-relevant logging that explains message handling decisions. |
| Recommendation — Preserve and inspect authentication results as part of security logging and investigation. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Mail authentication results are log evidence used to trace filtering and trust outcomes. |
| Recommendation — Centralize and protect authentication-result logs so analysts can reconstruct message handling. | ||
| MITRE ATT&CK | T1586 — Compromise Accounts | Spoofed or abused mail authentication often supports account and impersonation abuse in phishing chains. |
| Recommendation — Correlate authentication anomalies with account-compromise techniques during phishing hunts. | ||
Practitioner Guidance
Why practitioners should care: Treat Authentication-Results as an investigation aid, not a trust stamp. Use it alongside message trace, received headers, mailbox audit logs and the surrounding authentication context so that one header does not carry the whole conclusion.
What to watch for: Pay close attention when the header shows mixed results, unexpected intermediary hops, or results that do not match the visible From domain. That mismatch is often where forwarding, impersonation or gateway rewriting becomes visible.
For deeper header interpretation and phishing triage, Email Forensics and Header Analysis Guide is the most direct companion resource, and Phishing Incident Response Playbook helps connect header evidence to containment and scoping.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org