reason=000: Failed explicit authentication
Microsoft 365 stamps compauth=fail reason=000 when a message fails DMARC and the From domain publishes p=quarantine or p=reject. What it means, what happens to the message, and how to fix it.
Published · Last verified · Maintained by TamingDNS
Fail
compauth=fail reason=000
0xx
Microsoft 365 only
📖 What Microsoft Says
The message failed explicit authentication (compauth=fail). The message received a DMARC fail and the DMARC policy action is p=quarantine or p=reject.
Verbatim from Anti-spam message headers in Microsoft 365, "Composite authentication Reason codes". Everything below is our reading of it.
💬 What It Actually Means
The From domain publishes an enforced DMARC policy, and this message failed it. "Explicit" is the important word: the domain owner asked receivers to treat failures as failures, and Microsoft recorded that this was one. Of the failure codes, this is the one with a real policy behind it.
What happens to the message
Not necessarily rejection. Microsoft's own documentation says a message may still be allowed despite a compauth failure if nothing else about it looks suspicious. reason=000 is a verdict on the authentication, not a record of what happened to the mail. Message trace is where you find the delivery outcome.
What to do
Work out whose domain it is first. If the From domain is not yours, a legitimate sender is failing their own published policy. Almost always that is a third-party service sending on their behalf that was never added to their SPF record or given a DKIM key. Tell them; you cannot fix it from your side. If the domain is yours, this is your own mail failing your own policy, and the fix is on your side.
⚠️ Easily confused with
reason=001 is the same verdict without an enforced policy behind it, and reason=010 is this code where the From domain is one of your own.
📋 What It Looks Like in a Header
Paste your own headers into the email header analyser to see this line decoded against the rest of the message.
Authentication-Results: spf=fail (sender IP is 203.0.113.42)
smtp.mailfrom=mail-out.example.net; dkim=none;
dmarc=fail action=oreject header.from=contoso.com;
compauth=fail reason=000
SPF hard-failed, nothing was signed, and contoso.com publishes an enforced policy. Every limb of DMARC failed and the domain asked for failures to count.
🔗 Related Reason Codes
🔧 Check It Yourself
A reason code is one line of one header. These read the rest of the picture: what the domain publishes, and whether the message that carried this code holds up.