reason=010: Your own domain, failing your own enforced policy
compauth reason=010 means a message claiming to be from one of your accepted domains failed DMARC while your policy is p=reject or p=quarantine. The highest-signal compauth code.
Published · Last verified · Maintained by TamingDNS
Fail
compauth=fail reason=010
0xx
Microsoft 365 only
📖 What Microsoft Says
The message failed DMARC, the DMARC policy action is p=reject or p=quarantine, and the sending domain is one of your organization's accepted domains (self-to-self or intra-org spoofing).
Verbatim from Anti-spam message headers in Microsoft 365, "Composite authentication Reason codes". Everything below is our reading of it.
💬 What It Actually Means
A message arrived claiming to come from a domain your own organisation owns, it failed DMARC, and your policy says failures should be treated as failures. Staff being impersonated to staff, with your own published policy contradicting the claim.
What happens to the message
This is the strongest of the failure codes, because two independent things line up: the From domain is one you control, and you have already told the world what to do when a message from it fails. Business email compromise looks exactly like this.
What to do
Treat it as an incident until you can show otherwise. Then rule out the boring explanation, which is common: a legitimate internal system that was never added to your SPF record or given a DKIM key. A scanner, a line-of-business app, a marketing platform sending as staff. Check that before you assume an attacker. Either way, the sender needs confirming through a channel other than email.
⚠️ Easily confused with
reason=601 is the same intra-org shape without an enforced policy. If you see 601 rather than 010 on your own domain, your DMARC policy is the difference.
📋 What It Looks Like in a Header
Paste your own headers into the email header analyser to see this line decoded against the rest of the message.
Authentication-Results: spf=fail (sender IP is 203.0.113.77)
smtp.mailfrom=vps.example.net; dkim=none;
dmarc=fail action=oreject header.from=contoso.com;
compauth=fail reason=010
contoso.com here is one of the receiving tenant's own accepted domains, sent from a host that has nothing to do with it.
🔗 Related Reason Codes
🔧 Check It Yourself
A reason code is one line of one header. These read the rest of the picture: what the domain publishes, and whether the message that carried this code holds up.