MailDingo

Authentication results, explained

Your mail provider writes its verdicts into an Authentication-Results header as method=result. Here is what each value means for you as a reader, and what a sender should fix.

SPF

SPF checks whether the server that delivered the message was allowed to send for the envelope (bounce) domain. SPF explained

spf=passThe server that delivered this message is on the approved-senders list of the bounce-address domain, which may not be the domain in the From line. spf=failThe domain in the bounce address says the server that delivered this message was not allowed to send its mail. spf=softfailThe bounce-address domain says this server is probably not one of its senders, but only as a soft hint, not a firm no. spf=neutralThe bounce-address domain publishes SPF but chose not to say whether this server may send for it, so the check tells you nothing. spf=noneThe bounce-address domain publishes no SPF record, so there was nothing to check this server against. spf=temperrorThe receiving server couldn't finish the SPF check because of a temporary DNS problem, so SPF gave no answer for this message. spf=permerrorThe bounce-address domain's SPF record is broken, so the check could not run; the domain owner needs to fix their DNS.

DKIM

DKIM checks a cryptographic signature that a domain (d=) put on the message, proving that domain handled it and the signed parts were not changed. DKIM explained

dkim=passA domain digitally signed this message and the signed parts arrived unchanged, but check which domain signed it: it may not be the sender you see. dkim=failThe message was signed, but it no longer matches its signature, usually because something changed it on the way or the published key is wrong. dkim=neutralThe message had a signature, but the receiver couldn't use it, so it treats the message as if it had not been signed. dkim=noneThe message was not digitally signed, so there is no DKIM evidence either way about who sent it. dkim=temperrorThe receiver couldn't fetch the signer's public key because of a temporary DNS problem, so the signature couldn't be checked this time. dkim=permerrorThe signature can never be verified as it stands, typically because the signing key is missing from DNS or the signature is malformed. dkim=policyThe message was signed, but the receiver's own rules don't accept this kind of signature, for example because it covers too little of the message.

DMARC

DMARC asks: did SPF or DKIM pass for a domain that matches the From address you see? That match is called alignment. DMARC explained

dmarc=passThe domain in the From line checks out: it publishes DMARC, and SPF or DKIM confirmed this message really came from that domain's systems. dmarc=failThe From domain publishes DMARC, but nothing proved this message came from that domain, so it may be forged or may have been altered on the way. dmarc=noneThe domain in the From line has no DMARC record, so the receiver had no way to check whether that domain really sent this message. dmarc=temperrorA temporary DNS problem stopped the receiver from finishing the DMARC check, so the domain's policy wasn't applied to this message. dmarc=permerrorThe From domain's DMARC record is broken in a way the receiver couldn't work around, so no DMARC verdict was reached.

ARC

ARC records what earlier servers (forwarders, mailing lists) saw, sealed with their signatures, so the final receiver can trust results that forwarding broke. ARC explained

arc=passThe servers that relayed this message, such as a mailing list or forwarder, recorded what they saw, and their records arrived intact. arc=failThe message carries ARC records from servers that relayed it, but they don't check out, so they can't be used as evidence. arc=noneNo relaying server added ARC records before this message arrived, which is normal for mail sent directly.

Every registered result code

The official list of result names lives in IANA's Email Authentication Result Names registry (last updated 2026-05-22; MailDingo re-reads it every week). Rarer methods are listed here for completeness; the analyser explains the common ones.

MethodResultsDefined in
arcfail, none, passRFC 8617 §2.2
authfail, none, pass, permerror, temperrorRFC 8601 §2.7.4
dkimfail, neutral, none, pass, permerror, policy, temperrorRFC 8601 §2.7.1
dkim-atpsfail, none, pass, permerror, temperrorRFC 6541 §8.3
dmarcfail, none, pass, permerror, temperrorRFC 9989
dnswlnone, pass, permerror, temperrorRFC 8904
iprevfail, pass, permerror, temperrorRFC 8601 §2.7.3
rrvsfail, none, pass, permerror, temperror, unknownRFC 7293 §11
smimefail, neutral, none, pass, permerror, policy, temperrorRFC 7281 §3.1
spffail, neutral, none, pass, permerror, policy, softfail, temperrorRFC 8601 §2.7.2
vbrfail, none, pass, permerror, temperrorRFC 6212 §4