This email header analyzer online starts from the lines your own mail service added when the message arrived, because those are the only ones that prove anything. Paste the full headers above to see who sent the message, through which service, and whether SPF, DKIM, and DMARC passed.
Everything is parsed in your browser. The headers are never sent, stored, or logged, which matters because they carry the address of everyone on the message.
How to read the result
Read the authentication results first. They come from the Authentication-Results line written by the server that delivered the message, so they are the receiver's own verdict, not the sender's claim.
DMARC passes only when SPF or DKIM passes for a domain aligned with the From address, as RFC 9989, the DMARC standard, sets out. A message signed with the sending service's own domain can pass DKIM and still fail DMARC.
A sending service is named only when its own docs describe a signal its mail carries. When it names none, the message went out through an ordinary mailbox or a service that documents no fingerprint.
What to fix
If DMARC failed, turn on DKIM signing with your own domain in the service that sent the message, or set up a custom return path. If the message has no signature at all, publish the DKIM record your mail host gives you. If bulk mail has no List-Unsubscribe header, add one-click unsubscribe before the next campaign.
Copy the headers from the message as it arrived, never from a forward. A forward is a new message with new headers, and the ones you want are gone.
If neither SPF nor DKIM passed and the mail bounced, the 550 5.7.26 unauthenticated email page finds the sender that failed and the record to fix.