What you’re seeing
- Outlook displays a warning that the sender failed fraud detection checks and may not be who they appear to be.
- Invoices, purchase orders or replies from a long-standing vendor go straight to the Junk Email folder.
- Message headers show "compauth=fail" together with SPF, DKIM or DMARC failures for the partner's domain.
- Only mail from one or two specific outside organizations is affected, while everything else arrives normally.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The partner's SPF record leaves out the service they actually send from, such as a new email platform or hosted accounting system.
- The sender's domain publishes a DMARC policy, but their messages aren't DKIM signed with a key that matches their From address.
- Their messages pass through a forwarding service or mailing list that alters the content and breaks the original authentication.
- Microsoft's composite authentication, which weighs several signals together, scores the sender poorly because their domain setup is weak or incomplete.
- A third-party filtering gateway in front of Microsoft 365 rewrites incoming mail, so Microsoft evaluates the gateway rather than the real sender.
Why it matters
When a trusted partner's mail is junked, payment remittances, contract changes and time-sensitive requests can sit unseen for days. Staff start digging through Junk to find real mail, which trains them to trust messages that a filter flagged, exactly the habit attackers exploit. Simply allowing the sender everywhere can also weaken protection against people impersonating that same partner, so the fix needs to separate a genuine authentication gap from an actual spoofing attempt.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Is the problem on our side or the sender's?
It can be either. Often the partner's domain authentication is incomplete, but filtering gateways or rules on your side can also cause it. An engineer reviews the message headers to tell which.
Can we just mark the sender as safe?
That can hide the symptom, but it may also let impersonators of that partner through. We look for a targeted fix that keeps spoofing protection in place.
Will we need to contact the partner?
Sometimes. If their DNS records are the cause, we give you a plain-English summary of what's wrong that you can pass to their IT contact.