Submit a ticket My Tickets
Welcome
Login  Sign up

Understanding the New Authentication Fields in DMARC Forensic Reports

The Forensics tab now shows additional authentication details on failure reports, based on the latest email authentication reporting standards. These details give you more context on why a report was generated, without changing anything about how your existing DMARC results are calculated or displayed.

This article explains:

  1. Where to find the new fields

  2. What the new Feedback Header fields mean

  3. What Identity-Alignment means, and how it relates to the SPF and DKIM Alignment you already see

  4. What to expect if a field doesn't appear

  5. Frequently asked questions

Where to Find These Fields

Inside the Forensics tab, each report can be viewed in two tabs:

  • Feedback Headers: details about the report itself

  • Mail Headers: details about the message the report is about

Each tab has a RAW mode and a HUMAN mode. The RAW mode is unchanged and continues to show the report exactly as it was received. All of the new fields described below appear only in the HUMAN mode of each tab, laid out for easy reading.

New Fields in Feedback Headers (Human View)

The Feedback Headers tab already shows the headers of the email that delivered the report (Return Path, From, To, Subject, Message ID, Date). Below that, you may now also see the following fields, sourced directly from the report itself:

Field

What it tells you

Feedback Type, Version, User Agent

The type of report and the software that generated it

Auth Failure

The type of failure being reported (for example DMARC, DKIM, or SPF)

Identity Alignment

Explained in the next section

Reported Domain

The domain the report is about

Source IP

The sending IP address named in the report. If a hostname is included, it's shown alongside the IP

Original Mail From

The envelope sender address. If this value is empty, you'll see a clear "no reverse path" label instead of a blank field

Original Envelope ID, Arrival Date, Incidents

Standard reference details from the report

Delivery Result

Shown when the report includes it

Authentication Results

The result recorded by the receiving mail server. This is the authoritative source for the DMARC outcome on that message

DKIM Domain, DKIM Identity, DKIM Selector

Shown when a DKIM signature failed to align and the receiving server included these details

SPF DNS

Shown when SPF failed to align and the receiving server included this detail

Not every report will show every field. These fields are part of a newer reporting standard, and most mail servers haven't started sending them yet. When a field isn't included in a report, it simply won't appear, that's expected and not an error.

Identity Alignment in Mail Headers

The Mail Headers tab already shows SPF Alignment and DKIM Alignment as Yes or No, along with the DMARC Result. Those values are calculated exactly as before, nothing about them has changed.

A new field, Identity Alignment, is now shown alongside them. It's a plain-language label for the same alignment information, following the newer reporting standard's terminology:

SPF Alignment

DKIM Alignment

Identity Alignment

Yes

Yes

none

No

Yes

spf

Yes

No

dkim

No

No

dkim, spf

The Yes/No values stay exactly where they are, since they're the clearest way to read a report at a glance. Identity Alignment is there for reference and for anyone exporting or filtering on this data going forward.

If a report generator sends its own Identity Alignment value directly (rather than PowerDMARC deriving it from the alignment results), you'll see that value in the Feedback Headers section instead, clearly marked as coming from the reporting server.

Reading Identity Alignment

Value

Meaning

Usual explanation

none

Both SPF and DKIM aligned

The message likely passed DMARC. The report was still generated because of your reporting preferences, it's informational, not a red flag

spf

SPF didn't align, DKIM did

Often caused by forwarding or a missing SPF record entry. DMARC still passed on DKIM

dkim

DKIM didn't align, SPF did

Often caused by a mailing list or gateway modifying the message in transit. DMARC still passed on SPF

dkim, spf

Neither aligned

The only case worth a closer look. Usually a legitimate sender that hasn't been configured yet, but genuine spoofing is also possible

A quick note on what triggers these reports: Your domain is set up to request forensic reports even when a message passes DMARC overall but fails one of the two checks. This means a report showing up in your Forensics tab isn't automatically a sign of a problem, most of them are routine and expected.

What to Expect

  • Missing fields are normal. Since almost no mail servers support the newer fields yet, most reports you see today will look the same as before, just with the Identity Alignment label added.

  • RAW mode is untouched. If you need to see a report exactly as it arrived, switch to RAW mode in either tab.

  • Reports with more than one incident will show the incident count, since a single report can represent multiple similar messages grouped together.

  • Domains using PGP encryption are not affected by this update. Encrypted reports can't be read for display, so they continue to work exactly as they did before.

Frequently Asked Questions

Does this change how my SPF Alignment, DKIM Alignment, or DMARC Result are calculated? No. Those values are produced exactly as they always have been. This update only adds extra context alongside them.

Why don't I see all of these fields on my reports? Most reports today don't include the newer fields yet, since this depends on the sending mail server. As more providers adopt the standard, you'll see more detail appear automatically, no action is needed on your end.

What should I do if I see "dkim, spf" as the Identity Alignment? Treat it the same way you would treat a DMARC failure today, review the source and decide whether it's a sender you recognize but haven't configured, or something that needs further investigation.

Will this affect my aggregate (RUA) reports? No. This update is limited to the Forensics tab only.


Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.