Start with the receiver that added the header
Authentication-Results records what a mail server observed when it checked a message. A forwarded or copied message can contain several such headers, and untrusted senders can insert fake ones. Start with the header added by the receiving system you trust, near the top of the final message source.
The first token normally identifies the authentication service. Results then list methods such as spf=pass, dkim=pass, and dmarc=pass with properties that explain which identities were evaluated.
Map each result to an identity
For SPF, look for smtp.mailfrom or smtp.helo. For DKIM, look for header.d and sometimes header.s. For DMARC, compare header.from with the authenticated SPF and DKIM domains. A pass for a vendor domain may not align with the brand domain.
Temperror usually indicates a temporary lookup or service problem. Permerror indicates a policy that could not be evaluated, such as multiple SPF records or malformed syntax. Neither should be treated as a clean pass.
Use headers to verify DNS changes
After updating DNS or provider settings, send a new message through the exact affected stream. Analyze its header and keep the full result for troubleshooting. The header connects public DNS configuration to what the receiver actually evaluated.