dmarc=pass

dmarc=pass is the result that actually speaks to the address you see. It means the From domain publishes a DMARC record, and at least one of SPF or DKIM passed for a domain that matches it. That domain can be the same name or, under the default relaxed rules, another name under the same organizational domain. Of all the values in Authentication-Results, it is the strongest sign that the sender in the From line is real.

What the RFC says

DMARC is now defined by RFC 9989 (May 2026), which replaced the original RFC 7489. §9.2 defines pass as a DMARC record existing for the Author Domain (the From domain) together with an authenticated identifier that aligns with it. §5.3.5 states the rule: one aligned identifier is enough. §4.4 explains alignment: relaxed means the same organizational domain, strict means identical names. RFC 7489 §11.2 defined pass along the same lines, so older software that follows it reports the same thing.

From: "Example Bank" <alerts@example.com>
Authentication-Results: mx.example.org;
       dkim=pass header.d=example.com header.s=s2026;
       spf=pass smtp.mailfrom=bounce.example.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

The part in brackets is Gmail-style shorthand. p= is the domain's published policy, and dis= is what the receiver did, which for a pass is nothing. A pass with p=NONE is just as much a pass: the policy only matters when a message fails.

What a pass does not tell you

• Whether the domain is the one you think. A look-alike such as examp1e-bank.test can publish DMARC and pass for itself. Read header.from carefully, and see lookalike domains.
• Anything about the display name. "Example Bank" in quotes is free text. RFC 9989 §11.4 puts display-name attacks out of DMARC's scope. See display-name spoofing.
• Whether the content is safe. §5.4 says a pass only shows that the domain authorized this use of its name, and receivers may still filter it. A hacked account at a real company produces a genuine pass.

If you received this message

If the domain in header.from is exactly the organization you expect, you can trust that it came from their mail systems. That is as far as headers can take you. Judge the content on its own merits.

If you own the domain

This is what you want on every legitimate stream. Use your aggregate reports to confirm that all your sources pass, not just your main one. Then move from p=none to quarantine and eventually reject, so that mail that fails is actually stopped. The alignment guide explains why each service needs its own aligned DKIM or bounce domain. Paste a test message into the analyser to see which identifier carried the pass.