How to verify genuine server CPUs before buying in bulk

A container of "Xeon Gold" processors arrives at 30% below market price. The trays look right, the packaging is convincing — and three weeks later your build line discovers half the units are remarked engineering samples. This scenario costs the secondary server market millions every year, and it is almost entirely preventable with a 15-minute verification routine.

Here is the checklist our lab runs on every inbound CPU batch, and the same checks you should demand from any wholesale supplier.

1. Decode the sSpec or OPN first

Every genuine Intel tray CPU carries an sSpec number (five characters, e.g. SRM7K) laser-etched on the integrated heat spreader. AMD tray units carry an OPN (e.g. 100-000000452). Before anything else:

• Intel: enter the sSpec at ark.intel.com — it must resolve to the exact model, stepping and SL-code you ordered.
• AMD: the OPN's first segments identify model and stepping; the full code must match AMD's product brief for that SKU.
• Mismatch = stop. A valid-looking model number with a wrong sSpec is the single most common remarking trick.

2. Inspect the IHS markings

The metal heat spreader is hard to fake well. Under bright light, check:

Check	Genuine	Red flag
Etching	Crisp laser etching, uniform depth, matte finish	Soft or shiny characters; edges that smudge under isopropyl alcohol (inkjet re-print)
Alignment	Text perfectly aligned to the IHS edges; consistent font weight	Crooked lines, mixed fonts, uneven spacing between characters
Country of origin	"Made in Costa Rica / Vietnam / Malaysia" etc., consistent with the tray label	Conflicting origin statements between IHS, tray and box
Residue	Clean surface, factory thermal material pattern only	Polish marks, solvent smell, or leftover thermal paste in etching grooves

3. Power it on a real board

Paper checks catch remarking; electrical tests catch everything else. For any batch above a few units, validate a sample on a genuine OEM platform (Dell, HPE, Lenovo, Supermicro):

1. POST and inventory: the BIOS must report the exact model string and core count — no "Unknown CPU" or downgraded core counts.
2. CPUID / stepping: on Linux, lscpu or dmidecode -t processor exposes family, model and stepping; compare against the sSpec record.
3. Load test: 30+ minutes of sustained all-core load (stress-ng, Prime95) — watch for thermal throttling, WHEA errors or core shutdowns that indicate binning fraud.
4. Memory training: full-population DIMM training should complete at rated speed on the first or second attempt.

4. Know your ES, QS and retail markings

Engineering samples are not fraudulent — but they are not retail parts, and they must never be priced as such:

• Intel ES: sSpec starting with Q (Q-spec), or confidential markings — no warranty, no long-term supply guarantee.
• Intel QS: closer to production, still Q-spec — acceptable for lab validation only.
• AMD ES: OPN marked with ES codes or "ENG SAMPLE" laser marks.
• Retail / tray: SR-prefix (Intel) or production OPNs — the only units that belong in production servers.

"Qualification samples are for your lab, not your customers. Any supplier mixing ES units into a retail tray order — at any ratio — has told you everything about their quality system."

— Huazhe incoming-inspection procedure

5. Structure the deal to cap your risk

• Sample first: order 1–2 units for validation before any volume commitment.
• Test report in the PO: make a signed per-batch test report a contractual deliverable, not a courtesy.
• Matched stepping clause: for cluster builds, specify same-stepping / same-CPUID allocation in writing.
• Warranty terms: 3–5 years with advance replacement — remarkers rarely survive a warranty conversation.

FAQ

Is a pulled (used) server CPU safe to buy? Yes — if it comes from a supplier who tests on OEM boards, discloses per-unit health data and warrants the unit. Pulled enterprise CPUs often have years of service life left; the risk is in the seller's process, not the silicon.

Can software alone detect a remarked CPU? CPU-Z, lscpu and HWiNFO read the CPUID the processor reports, which a sophisticated re-mark may fake. Physical IHS inspection plus board-level validation is the only complete check.

What should a batch test report include? At minimum: serial / sSpec list per unit, platform tested on, BIOS version, load-test duration and result, memory training result, and thermal readings. Ours ship with every batch.