Open any message in Gmail and choose Show original. What appears is dozens of lines most people never look at, and the answer to almost any delivery question is somewhere in them.
Received lines are the path, written in reverse. The bottom one is your sending server; the top one is the final delivery. Each carries a timestamp, so subtracting them shows exactly where a delay happened rather than guessing at it.
Authentication-Results is the receiver's own verdict on your authentication. It records spf, dkim and dmarc with a pass or fail each. This is the receiving server's opinion rather than what your DNS says, which is why it settles arguments.
Return-Path is the envelope sender, and it is frequently a platform domain rather than your own. When it differs from the From header, SPF authenticates that platform domain instead of yours, which is the single most common reason DMARC fails while SPF passes.
What each line settles
A delay complaint: subtract the timestamps on consecutive Received lines and the slow hop identifies itself.
A DMARC failure: Authentication-Results says which mechanism failed, and comparing Return-Path with From usually explains why.
A junk folder question: X-Spam-Status or the provider's equivalent sometimes carries a score and the rules that fired.
A forwarding mystery: extra Received lines between your server and the final delivery mean the message was relayed, which is also why SPF broke.
A one-click unsubscribe problem: List-Unsubscribe and List-Unsubscribe-Post are either present with an HTTPS URL or they are not, and the header tells you immediately.
Where this argument costs us something
The short version
- Read Authentication-Results first, because it is the receiver's own verdict.
- Compare Return-Path with From to explain most DMARC alignment failures.
- Use the Received timestamps to locate a delay rather than guessing at it.
Questions people ask
Where do I find the full header?
Show original in Gmail, View message source in Outlook, and an equivalent in every other client. It is always available and rarely looked at.
Which header line matters most for deliverability?
Authentication-Results. It is the receiving server saying what it concluded about your SPF, DKIM and DMARC, which beats any checker's opinion about your DNS.