reason=002: Blocked by an admin-configured spoof rule
compauth reason=002 means an admin in your own organisation explicitly prohibited this sender/domain pair from sending spoofed mail. Where the rule lives and how to change it.
Published · Last verified · Maintained by TamingDNS
Fail
compauth=fail reason=002
0xx
Microsoft 365 only
📖 What Microsoft Says
The organization has a policy for the sender/domain pair that's explicitly prohibited from sending spoofed email. An admin manually configures this setting.
Verbatim from Anti-spam message headers in Microsoft 365, "Composite authentication Reason codes". Everything below is our reading of it.
💬 What It Actually Means
This one is not a verdict about the sender's DNS at all. Somebody in your organisation configured a rule saying this specific sender/domain pair may not send spoofed mail, and this message hit that rule. The decision was made by an administrator, in your tenant, at some point in the past.
What happens to the message
The rule an admin set is what governs the outcome. Unlike the other failure codes, there is no DNS change anywhere that would alter this result: the answer is in your tenant configuration.
What to do
Go to the Tenant Allow/Block List in the Defender portal and look at the spoofed-sender entries for this pair. If the sender is legitimate and this is a false positive, that entry is what is stopping it, and it is yours to change. Find out who added it and why before you remove it.
⚠️ Easily confused with
It reads like an allow-list code and it is not. We had this backwards ourselves until 2026-08-22: reason=002 is a prohibition, not a permission.
📋 What It Looks Like in a Header
Paste your own headers into the email header analyser to see this line decoded against the rest of the message.
Authentication-Results: spf=pass (sender IP is 192.0.2.30)
smtp.mailfrom=mail.fabrikam.example; dkim=none;
dmarc=fail action=none header.from=contoso.com;
compauth=fail reason=002
SPF passed for the envelope domain, but the From domain is different and an admin has explicitly prohibited that pairing.
🔗 Related Reason Codes
🔧 Check It Yourself
A reason code is one line of one header. These read the rest of the picture: what the domain publishes, and whether the message that carried this code holds up.