Every message carries its own evidence.

The address the sending server used in the SMTP conversation, where bounces go. SPF is checked against THIS domain, not the From people see. Here it is the ESP's own bounce domain, which is why SPF alone often passes without helping DMARC: this identity does not match the visible From.

Each server that handles the message prepends a Received line, newest on top, so the chain reads bottom-up like a passport. The top line is the only one your receiver wrote itself and the only one it can fully trust: the connecting IP, and whether the final hop was encrypted (ESMTPS). Everything below was written by someone else's servers.

The only sender identity a human reads, and the one DMARC defends. Neither SPF nor DKIM checks it by itself; DMARC's whole job is demanding that one of them ALIGN with this domain. Spoofing means putting a domain here you do not control, which is why alignment, not just passing, is the test.

A cryptographic seal over the listed headers and the body. The d= names who sealed it, and the s= (selector) names which published key verifies it, at s._domainkey.d in DNS. Because d= here matches the From domain, a verified signature both passes AND aligns, which is what carries DMARC. Look up any domain's published keys with the selector lookup.

The receiver's own scorecard, stamped after all the checks ran. Read it right to left of everything above: SPF passed for the ESP's bounce domain (unaligned), DKIM passed for the From domain (aligned), so DMARC passes, under a published p=reject. This is the header our analyzer parses, and the live test generates for a real message of yours.