Mail errors · Microsoft 365 and Outlook

What does “compauth=fail reason=001” mean?

Microsoft judged the message as not authenticated because the sending domain publishes no email records, or only weak ones: SPF ending ~all or ?all, or DMARC at p=none.

Last read from the sources at the foot of this page.

Check my firm Read the steps
The fix · DNS record
Type
TXT
Name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:[email protected]
The first stage. Use your own domain and a mailbox someone reads.
01

What does it mean?

Reason 001 is an implicit failure: the domain gave Microsoft nothing firm to check, so Microsoft's own judgement decided instead of a rule you published. Microsoft notes that a message can still be allowed when nothing else about it looks suspicious.

02

What exactly does the source say?

001 The message failed implicit authentication (compauth=fail). The sending domain didn't have email authentication records published, or if they did, they had a weaker failure policy (SPF ~all or ?all, or a DMARC policy of p=none).

03

Why would a small firm see it?

A domain with no DMARC record, or DMARC left at p=none.

04

How do I fix it?

  1. Start herep=nonereports only
  2. p=quarantinesuspicious mail to spam
  3. Where to aimp=rejectforged mail refused
Start: reports only
v=DMARC1; p=none; rua=mailto:[email protected]
Then: suspicious mail to spam
v=DMARC1; p=quarantine; rua=mailto:[email protected]
Then: forged mail refused
v=DMARC1; p=reject; rua=mailto:[email protected]
  1. Publish one TXT record named _dmarc with the p=none value shown here.Use a mailbox someone reads for the reports.
  2. Read the reports for a few weeks.Each row names an address that sent mail as your domain and whether it passed.
  3. When every service you use passes, move to p=quarantine, then to p=reject.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

Use your own domain and a mailbox someone reads where the record shows yourfirm.example.

05

What else do the sources say?

Composite authentication result. Microsoft 365 combines multiple types of authentication (SPF, DKIM, and DMARC) and other parts of the message to determine whether the message is authenticated. Uses the From: domain as the basis of evaluation. Note: Despite a compauth failure, the message might still be allowed if other assessments don't indicate a suspicious nature.

dmarc=fail action=oreject header.from=o365e.onmicrosoft.com;compauth=fail reason=000

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy