Authentication-Results
The header a receiving server adds to record the results of its SPF, DKIM, DMARC and other checks, for filters and for anyone reading the headers.
What it means
Defined by RFC 8601, the header starts with the authentication service identifier (typically the receiver's host name) followed by one entry per method: spf=pass smtp.mailfrom=..., dkim=pass header.d=..., dmarc=pass header.from=..., and others such as arc and iprev. Values follow an IANA registry.
It is the quickest way to see why a message was filed where it was. Look at the topmost one, added by the final receiver; lower ones came from earlier hops and are only as trustworthy as those hops. RFC 8601 requires receivers to delete any incoming Authentication-Results header that claims their own identifier, so senders cannot forge a pass.
Microsoft adds compauth, its composite verdict, to the same header.
Example
Authentication-Results: mx.google.com; dkim=pass header.i=@example.com header.s=s2026; spf=pass smtp.mailfrom=bounce.example.com; dmarc=pass (p=REJECT) header.from=example.comRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes