Read email headers yourself: Authentication-Results, Received and DKIM-Signature

What it means

Every email carries hidden lines called headers. They record where the message came from, which servers handled it and what checks the receiver ran. You see only From, To, Subject and Date; the rest is hidden but easy to display.

Why it matters

• When an email lands in spam, the headers often show why: a failed SPF, a broken DKIM signature, DMARC failing.
• Support teams at providers ask for "the full headers" before they can help you.
• You can check any email you receive, including fake ones sent with your domain.

How to check

Delivmail reads these headers for you: on the home page (/), copy your test address, send it an email, and the report explains SPF, DKIM and DMARC in plain words. To read them yourself in your own mailbox:

• Gmail: open the email, click the three dots, choose "Show original".
• Outlook: open the email, use the three dots menu and look for "View message source" or "View message details".
• Apple Mail and Thunderbird: look for "Raw source" or "View source".

How to fix it

Reading headers does not fix anything by itself, but it tells you exactly what to fix. Look for these three headers.

1. Authentication-Results

Added by the receiving server. It is the verdict:

Authentication-Results: mx.google.com;
  dkim=pass header.d=yourdomain.com header.s=s1;
  spf=pass smtp.mailfrom=bounces.yourdomain.com;
  dmarc=pass header.from=yourdomain.com

• spf= shows the result and which domain was checked (smtp.mailfrom).
• dkim= shows the result and which domain signed (header.d).
• dmarc= passes only if one of those domains matches your From domain.

If header.d or smtp.mailfrom show your provider's domain instead of yours, authenticate your domain in that provider.

2. Received

Each server adds a Received line on top of the others. Read them from the bottom up: the lowest one is the first server, usually your provider or your own server. Here you find the sending IP address, useful to check blacklists at /blacklists, and delays between two hops.

3. DKIM-Signature

Added by the sender. Two parts matter:

• d=: the signing domain. It should be your domain.
• s=: the selector. The key is published at s._domainkey.d, for example s1._domainkey.yourdomain.com.

No DKIM-Signature at all means the email was not signed: turn on DKIM in your sending service.

Careful with old or fake lines

Only trust the Authentication-Results line added by your own mailbox provider (the top one). Lines lower down may come from earlier servers, or be forged by spammers.

Check that it is fixed

After changing your settings, send a new email to yourself and to a fresh Delivmail test address. In the headers, spf, dkim and dmarc should all show pass with your domain, and the Delivmail report should agree.