Read the receiving hop, not just the sending configuration
Start with the last Authentication-Results header added by the receiving provider. It records the SPF, DKIM, and DMARC verdicts at the hop that made the placement decision, which can differ from a local DNS check or the sending platform's dashboard.
Then compare the visible From domain with the DKIM d= domain and Return-Path. Follow the Received chain for unexpected relays, and inspect Reply-To for a different root domain or another phishing-shaped mismatch. The free analyzer turns those raw fields into a readable verdict and a 0–100 spam-likelihood score.