reason=601: Your own domain, with nothing published to defend it
compauth reason=601 means a message claiming to be from one of your own accepted domains failed implicit authentication. Why the absence of an enforced DMARC policy makes this harder to judge.
Published · Last verified · Maintained by TamingDNS
Fail
compauth=fail reason=601
6xx
Microsoft 365 only
📖 What Microsoft Says
The sending domain is an accepted domain in your organization (self-to-self or intra-org spoofing).
Verbatim from Anti-spam message headers in Microsoft 365, "Composite authentication Reason codes". Everything below is our reading of it.
💬 What It Actually Means
A message claimed to come from inside your organisation and could not authenticate. The 6xx family is Microsoft's second failure family, the implicit one, so unlike reason=010 there is no enforced DMARC policy standing behind the judgement.
What happens to the message
The missing policy cuts both ways. It means this is not proof of forgery, and it means you have nothing published that would have made it proof. An attacker impersonating your staff to your staff produces exactly this code, and so does your own unconfigured invoicing system.
What to do
Confirm the sender through a channel other than email. A phone call, not a reply. Then fix the gap: a domain of your own landing on 601 is a domain with no enforced DMARC policy. Publish one and the same message becomes reason=010, which is a judgement you can act on.
⚠️ Easily confused with
reason=010 is the enforced-policy version of the same situation. reason=001 is the same implicit failure on a domain that is not yours.
📋 What It Looks Like in a Header
Paste your own headers into the email header analyser to see this line decoded against the rest of the message.
Authentication-Results: spf=none (sender IP is 198.51.100.204)
smtp.mailfrom=bulk.example.net; dkim=none;
dmarc=none action=none header.from=contoso.com;
compauth=fail reason=601
dmarc=none, not dmarc=fail: contoso.com publishes no DMARC record at all, so there was no policy to fail.
🔗 Related Reason Codes
🔧 Check It Yourself
A reason code is one line of one header. These read the rest of the picture: what the domain publishes, and whether the message that carried this code holds up.