Overview
When mail arrives, your provider, Gmail or Outlook, runs the three standard checks, SPF, DKIM, and DMARC, and writes the results onto the message. Sieve reads that record. An authentication failure means at least one of those checks did not pass.
How the checks fit together
Each check verifies a different thing. SPF verifies the route a message traveled. DKIM verifies its content arrived unchanged. DMARC verifies that whichever identity passed actually matches the “From” line you read.
That layering matters when something fails. Failing one mechanism is not the same as failing outright: a forwarded message can fail SPF while its visible sender is still fully verified through DKIM under DMARC. The serious case is the outright one, where no check can vouch for the sender you see.
One failed check has innocent explanations. A message whose visible sender no check can vouch for is a different story, and a real reason mail gets flagged.
What a failure means
The innocent causes are real and common: forwarding, mailing lists that rewrite messages, and senders whose IT setup is misconfigured all break checks on legitimate mail every day.
The malicious cause is just as real: someone sending mail in a name they have no right to use will, by construction, fail the checks for that name. Mail that fails outright is mail whose claimed sender could not be verified, and that is a reason Sieve may flag it.
What Sieve shows you
When authentication is part of why a message was flagged, your dashboard says so and names the check. The message itself is filed under a label in your Gmail, never deleted, so you can open it and decide for yourself.
If you know the sender is real, a common case for forwarded mail, drag the message back to your inbox or restore it from the dashboard. One correction restores the message and teaches your own filter about that sender.