reason=001: Failed implicit authentication
compauth=fail reason=001 means the sending domain published no authentication, or weak authentication (SPF ~all, DMARC p=none). Why it is a posture signal rather than proof of spoofing.
Published · Last verified · Maintained by TamingDNS
Fail
compauth=fail reason=001
0xx
Microsoft 365 only
📖 What Microsoft Says
The message failed implicit authentication (compauth=fail). The sending domain didn't have email authentication records published, or if they did, they had a weaker failure policy (SPF ~all or ?all, or a DMARC policy of p=none).
Verbatim from Anti-spam message headers in Microsoft 365, "Composite authentication Reason codes". Everything below is our reading of it.
💬 What It Actually Means
Microsoft had nothing solid to authenticate against. The From domain either published no authentication records at all, or published ones that decline to assert anything: SPF ending ~all or ?all, or DMARC at p=none. So Microsoft fell back to its own implicit checks and those did not clear the message either.
What happens to the message
The message is very often delivered. reason=001 is a comment on the sending domain's posture rather than a finding that this particular message was forged. Read it as "nobody could vouch for this".
What to do
Start with whose domain it is. On a domain you own, reason=001 is your own posture failing: your records are absent or too weak to assert anything, and every message you send is arriving with this stamp. Fix that. On someone else's domain it is a data point about them, and on its own it is not grounds to call a message malicious.
⚠️ Easily confused with
reason=000 is the enforced-policy version and is a stronger signal. reason=601 is this code where the From domain is one of your own accepted domains, which is a much sharper warning.
📋 What It Looks Like in a Header
Paste your own headers into the email header analyser to see this line decoded against the rest of the message.
Authentication-Results: spf=softfail (sender IP is 198.51.100.9)
smtp.mailfrom=northwind-traders.example; dkim=none;
dmarc=fail action=none header.from=northwind-traders.example;
compauth=fail reason=001
SPF soft-failed because the record ends ~all, and DMARC sits at p=none, so action=none. Nothing here asked Microsoft to treat the failure as a failure.
🔗 Related Reason Codes
🔧 Check It Yourself
A reason code is one line of one header. These read the rest of the picture: what the domain publishes, and whether the message that carried this code holds up.