reason=109: Would have passed DMARC, if the domain published it
compauth reason=109 means the sending domain has no DMARC record but the message would have passed if it did. The pass counterpart of dmarc=bestguesspass.
Published · Last verified · Maintained by TamingDNS
Pass
compauth=pass reason=109
1xx
Microsoft 365 only
📖 What Microsoft Says
Although the sender's domain has no DMARC record, the message would pass, anyway.
Verbatim from Anti-spam message headers in Microsoft 365, "Composite authentication Reason codes". Everything below is our reading of it.
💬 What It Actually Means
The sending domain never published a DMARC record, so there was no policy to evaluate. Microsoft evaluated it anyway and the message would have passed. You will usually see dmarc=bestguesspass on the same line, which is Microsoft's way of saying the same thing about the DMARC check itself.
What happens to the message
The message passes composite authentication. The sender is getting the benefit of a check they never asked for and cannot rely on.
What to do
If it is your domain, publish a DMARC record. Passing on a guess is not the same as passing on a policy: other receivers make their own decisions, and a domain with no record has nothing to say to any of them. Start at p=none with a rua address so you can see who is sending as you before you enforce anything.
⚠️ Easily confused with
reason=100 is a pass against a real published policy. dmarc=bestguesspass on the same header line is the DMARC-level twin of this code, not a separate finding.
📋 What It Looks Like in a Header
Paste your own headers into the email header analyser to see this line decoded against the rest of the message.
Authentication-Results: spf=pass (sender IP is 192.0.2.65)
smtp.mailfrom=northwind-traders.example;
dkim=pass (signature was verified) header.d=northwind-traders.example;
dmarc=bestguesspass action=none header.from=northwind-traders.example;
compauth=pass reason=109
bestguesspass is a value the DMARC RFC does not define. It is Microsoft's own, and it means exactly what reason=109 means.
🔗 Related Reason Codes
🔧 Check It Yourself
A reason code is one line of one header. These read the rest of the picture: what the domain publishes, and whether the message that carried this code holds up.