Mail errors · Microsoft 365 and Outlook

What does “compauth=fail reason=000” mean?

Microsoft marked the message as failing authentication because it failed DMARC and the domain's policy is p=quarantine or p=reject.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Microsoft bounce
Authentication-Results

compauth=fail reason=000

As Microsoft prints it.
01

What does it mean?

compauth is Microsoft's combined verdict from SPF, DKIM, DMARC and other signals, judged on the From domain. Reason 000 is an explicit DMARC failure.

02

What exactly does the source say?

000 The message failed explicit authentication (compauth=fail). The message received a DMARC fail and the DMARC policy action is p=quarantine or p=reject.

03

Why would a small firm see it?

A service sending in your name without SPF or DKIM for your domain, or a forged message.

04

How do I fix it?

  1. Read the Authentication-Results header for the spf= and dkim= results.
  2. Turn on DKIM signing for your domain at that service.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

05

What else do the sources say?

Composite authentication result. Microsoft 365 combines multiple types of authentication (SPF, DKIM, and DMARC) and other parts of the message to determine whether the message is authenticated. Uses the From: domain as the basis of evaluation. Note: Despite a compauth failure, the message might still be allowed if other assessments don't indicate a suspicious nature.

dmarc=fail action=oreject header.from=o365e.onmicrosoft.com;compauth=fail reason=000

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy