🛡️ COMPAUTH Reason Codes

What Is Composite Authentication?

SPF, DKIM and DMARC each answer one narrow question, and plenty of legitimate mail fails at least one of them. Microsoft combines all three with signals of its own and publishes a single verdict about the From: domain. That verdict is compauth, and it is Microsoft's alone: no RFC defines it, and no other provider stamps it.

The verdict on its own is nearly useless, because the failure codes do not mean the same thing as each other. One of them says the domain published an enforced policy and this message broke it. Another says the domain published nothing worth checking. Treating those as one finding is how a posture problem gets escalated as an attack, and how a real intra-organisation spoof gets filed as noise.

Does compauth=fail Mean the Message Was Blocked?

No. This is the most common misreading of the header, and Microsoft's own documentation is explicit about it:

Despite a compauth failure, the message might still be allowed if other assessments don't indicate a suspicious nature.

Our take: a reason code is a verdict on the authentication, not a record of what happened to the mail. A header cannot tell you whether a message was delivered, junked or quarantined, because it was written before that decision was made. Message trace in the Defender portal is where the delivery outcome lives.

What to do: read the code to learn what is wrong with the sender's authentication, then go to message trace to learn what became of the message. They are two separate questions and the header only answers the first.

Failure Codes

Four of these say something different about the same word. The gap between an explicit and an implicit failure is the gap between a domain that told receivers what to do and a domain that never said anything.

Pass Codes Worth Recognising

A pass is not always a clean bill of health. Two of these pass a message whose DKIM signature is broken, and one passes on a guess about a domain that publishes no policy at all.

Every Reason Code Microsoft Documents

Microsoft's complete table, in its own words. The bold rows are code families: a three-digit code Microsoft does not list individually still tells you something, because its first digit says which family it belongs to. The linked codes have a page of their own.

One trap in this table: the 3xx, 4xx and 9xx families are not passes. They mean composite authentication did not run, or ran and was bypassed. A message that was never checked is not a message that was cleared.

Descriptions verbatim from Anti-spam message headers in Microsoft 365 (page revised 12 August 2026).

🔧 Read a Real Header

Paste a full message header and the analyser decodes the compauth line alongside SPF, DKIM, DMARC, the ARC chain and the received path, then says what the combination amounts to.