Technology

DMARC Header Review

Last modified 2/22/2023

The following article will assist you in reviewing DMARC authentication in your email, so you can decide if this is something you feel needs to be escalated to the Technology Support Center. This will walk you through viewing, copying, reviewing, and understanding DMARC results in your email headers in the event that it needs to be escalated.

How to View and Copy Email Headers

  • Outlook Application

  1. Double-click the email message in the message list to open it outside of the reading pane
  2. Select File 
  3. Select Properties
  4. Highlight and copy all the information in the Internet Headers box.
  5. Paste the information in Notepad or Word

  • Outlook Online

  1. Select the … three more dots in the upper right corner of the message window
  2. Select View
  3. Select View Message Details
  4. Highlight all the information in the pop-up details box
  5. Copy the information
  6. Paste the information in Notepad or Word

Analyzing Email Headers

  • Review your Email Header

Microsoft has provided a tool, called the Message Header Analyzer, to help you view and analyze your email headers. This tool will display the information in a user-friendly manner.

  1. Go to the Message Header Analyzer
  2. Paste the header into the Message Header Analyzer
  3. Select Analyze headers
  4. Scroll down to the section labeled Other headers
  5. Look for the label under the Header column called Authentication-Results
  6. Within the Authentication-Results header you will find the DMARC information you need to review (Image 1)

Image 1

  • DMARC Results

DMARC VerdictMeaning
pass

The email has passed DMARC authentication and will continue to be delivered to the recipient.


 No further action is required. 
fail

The email has failed DMARC authentication and will be rejected with an NDR being sent to the sending address.


Submit a ticket following the escalation instructions. 
bestguesspass

Indicates that no DMARC record was found related to the from address domain, but the email service provider will attempt to apply a verdict based on the rest of the headers. This is not a recommended practice.


Submit a ticket following the escalation instructions. 
none

Indicates that no DMARC record exists from the address domain or that the email was sent internally between users.

Internally sent email: No further action is required


Email sent from a third-party vendor using one of the University’s domains: submit a ticket following the escalation instructions 

  • Escalation Instructions

  1. Go to Help.IllinoisState.edu/Get-IT-Help
  2. Fill out the form
  3. In the description box, explain a bit about why you think this issue needs escalated, then paste your header in this box.
    1. You may also save your email in the Outlook Message Format, or download your email from Outlook online and attach that to the form using the Optional Supplemental File section.
    2. You can also save the notepad or word file and attach that to the form using the Optional Supplemental File section.

Need Further Assistance?

If at any point in this process you feel the need for more assistance, please contact the Technology Support Center at 309-438-4357 or by submitting a help ticket at Help.IllinoisState.edu/Get-IT-Help  so that we may further assist you.

Similar Articles

Explore Tech Topics