Header Reader

Servers add Authentication-Results: as the message is received. We look for spf=, dkim=, dmarc=, and optionally arc= verdicts.

DKIM adds a cryptographic signature over selected headers and the body. We show the signing domain (d=), selector (s=), algorithm (a=), signed headers (h=), and a truncated signature (b=). Alignment for DMARC is based on whether the From: domain matches (relaxed = suffix match).

ARC lets intermediaries (forwarders, lists) attest the original auth results even if SPF breaks in transit. Not all receivers trust ARC equally.

Each Received: hop shows who handed the message to whom, with protocol (with) and timestamp. The bottommost entry is the first hop observed; the topmost is the last hop (closest to your inbox).