compauth
Microsoft 365's composite authentication result, combining SPF, DKIM, DMARC and other signals for the From domain into pass, fail, softpass or none.
What it means
Exchange Online Protection writes compauth into the Authentication-Results header with a reason code. It evaluates the From domain and can pass a message that lacks DMARC, or fail one whose domain publishes no records.
Reason codes explain the verdict. 000 is an explicit failure: DMARC failed under p=quarantine or p=reject. 001 is an implicit failure: no authentication records, or only weak ones (SPF ~all or ?all, or DMARC p=none). 1xx codes are passes, 2xx soft passes, 3xx and 4xx mean the check was skipped or bypassed.
Microsoft notes a message can still be delivered despite compauth=fail if nothing else looks suspicious.
Example
Authentication-Results: spf=pass (sender IP is 192.0.2.10) smtp.mailfrom=example.com; dkim=pass (signature was verified) header.d=example.com; dmarc=pass action=none header.from=example.com; compauth=pass reason=100Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- Microsoft Learn: Anti-spam message headers in Microsoft 365learn.microsoft.com
- Microsoft Learn: Anti-spoofing protection in EOPlearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes