ACSC Logo
© GEMXIT
GEMXIT Logo
Email Security • Composite Authentication • Microsoft Defender XDR

The Email Passed SPF, DKIM and DMARC — Why Did Composite Authentication Still Fail?

The email looked legitimate.

SPF passed. DKIM passed. DMARC passed.

Yet Microsoft Defender still considered the message suspicious. Agent Foskett wanted to know why.

Discuss your email security Back to briefings
Agent Foskett Microsoft Defender XDR Composite Authentication email investigation
Briefing summary

An email successfully passed SPF, DKIM and DMARC validation checks. Despite that, Microsoft Defender XDR reported a Composite Authentication failure. Understanding why required looking beyond individual authentication mechanisms and examining the complete trust decision.

SPF = Pass
DKIM = Pass
DMARC = Pass
Composite Authentication = Fail

What is Composite Authentication?

Composite Authentication is not just another single email authentication result. It is Microsoft evaluating the overall trust picture.
SPF checks the sending path SPF helps determine whether the sending server was authorised to send email for the domain. It is useful, but it does not prove the message intent is safe.
DKIM checks message integrity DKIM helps confirm that a signed message was not modified after it was sent. A valid signature does not automatically make the sender trustworthy.
DMARC checks alignment DMARC helps determine whether SPF or DKIM aligns with the visible sender domain. Alignment matters, but attackers can still abuse legitimate services.

Why can Composite Authentication fail?

Passing individual authentication checks does not mean Microsoft Defender must trust the entire message.
Domain reputation A domain may technically pass authentication checks while still carrying poor reputation, recent abuse, or patterns that reduce trust.
Suspicious message characteristics Display name impersonation, unusual sending patterns, suspicious wording, risky URLs or attachment behaviour can reduce overall confidence.
Microsoft threat intelligence Defender combines authentication results with reputation, telemetry and threat intelligence before deciding whether the message deserves trust.

The investigation

Agent Foskett started with the authentication result, then worked backwards into the wider email evidence.
composite-authentication-investigation.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailAuthenticationResults has "compauth=fail"
| project
    Timestamp,
    SenderFromAddress,
    RecipientEmailAddress,
    Subject,
    EmailAuthenticationResults

What the logs revealed

The individual checks looked clean. The combined trust decision told a different story.
SPF, DKIM and DMARC passed At first glance, the message appeared legitimate because the traditional authentication checks did not obviously fail.
CompAuth failed Composite Authentication indicated that Microsoft Defender did not fully trust the message when all signals were considered together.
The trust decision changed Microsoft Defender identified additional risk signals that reduced confidence even though the visible authentication checks looked acceptable.

Why this matters

Email investigations fail when defenders stop at the first green result.
Phishing investigations Attackers increasingly abuse legitimate infrastructure to pass traditional email security controls while still delivering malicious intent.
Business email compromise Authentication success does not guarantee that the sender, message, link or request should be trusted by the recipient.
Threat hunting Composite Authentication gives defenders another pivot point when investigating suspicious email, spoofing and impersonation activity.

Agent Foskett moment

The investigation reminded Agent Foskett of an important lesson: attackers know defenders check authentication.
Attackers know SPF Modern phishing does not always arrive from obviously broken infrastructure. Sometimes the sender path looks acceptable.
Attackers know DKIM and DMARC If defenders only look for failed authentication, they may miss threats that arrive through legitimate or compromised sending services.
The real question changed The question is no longer only, "Did authentication pass?" The real question is, "Did the message deserve to be trusted?"

How defenders can investigate

Composite Authentication should be treated as a signal that deserves context, not as a single isolated answer.
Review the full authentication string Look at EmailAuthenticationResults, AuthenticationDetails, SPF, DKIM, DMARC and CompAuth together before deciding whether the message is safe.
Compare sender identity fields Check SenderFromAddress, SenderMailFromAddress, display names and domain alignment to identify impersonation or sender confusion.
Pivot into URL and delivery evidence Join the message to URL clicks, delivery actions, post-delivery events and user activity to understand the real impact.

Questions every analyst should ask

A passed authentication result should start the next question, not end the investigation.
Which domain actually passed? Confirm whether the authenticated domain is the same domain the user believes they are trusting.
Was the message delivered? Authentication is only one part of the story. DeliveryAction and DeliveryLocation show what happened to the message.
Did the user interact? The most important evidence may be downstream: whether the recipient clicked, opened, forwarded or acted on the message.

Related investigations

Investigating EmailAuthenticationResults in Microsoft Defender XDR Understand the authentication evidence stored in Defender email telemetry. Read more →
Email Spoofing KQL Use Defender XDR telemetry to investigate spoofing indicators and suspicious sender behaviour. Read more →
Detect DMARC Fail Emails in Microsoft Defender Find and investigate messages where DMARC failures may indicate spoofing or alignment problems. Read more →
DMARC Failures KQL Explore DMARC failure patterns and how they appear in email investigation telemetry. Read more →
SenderFrom vs SenderMailFrom Compare visible sender identity with envelope sender evidence during email investigations. Read more →
AuthenticationDetails Explained Learn how authentication details help explain why a message passed, failed or deserved further review. Read more →
The email passed every traditional authentication check.
Yet Microsoft Defender still did not fully trust it. That is why defenders investigate beyond SPF, DKIM and DMARC.
Contact GEMXIT

Final thought

Authentication results matter, but they are not the whole investigation.
At GEMXIT We help organisations investigate Microsoft Defender XDR, email security, phishing, spoofing, Microsoft 365 security and practical threat hunting. If you want to understand how this applies to your environment, see our Microsoft Security services.
Agent Foskett mindset Do not stop when SPF, DKIM and DMARC pass. Ask what the full telemetry says about trust, intent and user impact.

The email passed SPF. It passed DKIM. It passed DMARC. But Composite Authentication still failed. Explore related investigations including Investigating EmailAuthenticationResults, Email Spoofing KQL, and SenderFrom vs SenderMailFrom.

Develop IT. Protect IT. GEMXIT PTY LTD | GEMXIT UK LTD
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

Composite Authentication In Microsoft Defender XDR

Composite Authentication combines SPF, DKIM, DMARC, reputation data, threat intelligence and behavioural indicators to determine the overall trustworthiness of an email message in Microsoft Defender XDR.

Why Composite Authentication Can Fail

An email can pass SPF, DKIM and DMARC individually while still failing Composite Authentication due to domain reputation, phishing indicators, impersonation techniques or other risk signals identified by Microsoft Defender.

Email Security Investigations Using Composite Authentication

Security analysts use Composite Authentication results within Microsoft Defender XDR to investigate phishing attacks, email spoofing, business email compromise attempts and suspicious email activity.