compauth in Microsoft 365: Composite Authentication and All Reason Codes

In the Authentication-Results header of an email received in Microsoft 365, alongside the standard results for SPF, DKIM, and DMARC, there is a Microsoft-specific field:

Authentication-Results: spf=pass (sender IP is 192.0.2.10)
  smtp.mailfrom=example.com; dkim=pass (signature was verified)
  header.d=example.com; dmarc=pass action=none header.from=example.com;
  compauth=pass reason=100

compauth stands for Composite Authentication: Microsoft 365 combines the results of SPF, DKIM, and DMARC with other message signals into an overall assessment of whether the visible From address is credible. The assessment is based on the From domain—that is, the address recipients see in their email client. This closes the gap that arises when a sender domain has published no or incomplete authentication records: even without a DMARC policy, Microsoft implicitly checks whether the email matches the claimed domain.

The Four Results

• compauth=pass: The message passed explicit (DMARC) or implicit authentication.
• compauth=softpass: The implicit check passed with lower confidence.
• compauth=fail: The message failed the explicit or implicit check.
• compauth=none: No Composite Authentication check took place, or it was skipped.

A compauth=fail does not automatically result in quarantine or the Junk Email folder. It is an input signal for the filtering decision; CAT and other fields in X-Forefront-Antispam-Report determine the actual handling. Conversely, anyone wanting to know why compauth made its decision needs the reason code directly after the result.

Reason Codes at a Glance

The three-digit code identifies the rule that led to the result. The first digit indicates the group: 0xx and 6xx are failures, 1xx and 7xx are passed checks, 2xx is softpass, and 3xx, 4xx, and 9xx mean no check or a skipped check.

The Most Common Cases in Practice

compauth=fail reason=001 is the standard case for domains without authentication or with weak authentication. The fix lies with the sender: publish SPF with -all, DKIM signing, and a DMARC policy. As long as the records are missing, deliverability depends on reputation signals.

compauth=fail reason=601 appears when email using the organization’s own domain as the sender arrives from outside, classically with Direct Send: multifunction devices, applications, or service providers deliver directly to the MX without an authenticated connector. The fix is a properly configured inbound connector or adding the source to the organization’s own SPF.

compauth=fail reason=000 or 010 means that DMARC was applied as intended. If action=oreject appears alongside it, Microsoft 365 translated the sender’s reject policy into quarantine delivery. There is nothing to fix here unless the sender is legitimate and its authentication is broken.

reason=108 and reason=130 concern forwarding and gateway scenarios: an intermediate hop modified the email, or a trusted ARC sealer preserved the original validation results. Anyone operating a gateway in front of Microsoft 365 should mark its ARC sealing as trusted in the anti-spam configuration; otherwise, legitimate email may continue to fail DMARC.

Reading compauth in the Header

In practice, compauth rarely stands alone: only its interaction with the individual SPF, DKIM, and DMARC results, the alignment of the domains involved, and the Received chain provides the complete picture. The Mail Header Analyzer on this website decodes compauth including its reason code directly in the browser and displays the associated domains (From, Envelope From, d=) side by side for alignment assessment; the pasted header never leaves the browser.