Frequently asked questions - Anti-spam protection

Tip

Did you know you can try the features in Microsoft Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft Defender portal trials hub. Learn about who can sign up and trial terms on Try Microsoft Defender for Office 365.

Applies to

• Built-in security features for all cloud mailboxes
• Microsoft Defender for Office 365 Plan 1 and Plan 2
• Microsoft Defender XDR

This article provides frequently asked questions and answers about anti-spam protection for Microsoft 365 organizations with cloud mailboxes.

For questions and answers about the quarantine, see Quarantine FAQ.

For questions and answers about anti-malware protection, see Frequently asked questions: Anti-malware protection.

For questions and answers about anti-spoofing protection, see Anti-spoofing protection FAQ.

By default, what happens to a message that's detected as spam?

• Inbound messages: Most spam is detected via connection filtering at the edge of the service, which is based on the IP address of the source email server. Anti-spam policies (also known as spam filter policies or content filter policies) inspect and classify messages as bulk, spam, high confidence spam, phishing, or high confidence phishing.

  Anti-spam policies are used in the Standard and Strict preset security policies. You can create custom anti-spam policies that apply to specific groups of users. There's also a default anti-spam policy that applies to all recipients who aren't specified in the Standard and Strict preset security policies or in custom policies.

  By default, messages that are identified as spam are moved to the Junk Email folder by the Standard preset security policy, custom anti-spam policies (configurable), and the default anti-spam policy (configurable). In the Strict preset security policy, spam messages are quarantined.

  For more information, see Configure anti-spam policies and Recommended anti-spam policy settings.

  Important

  In environments where the built-in security features for all cloud mailboxes protect on-premises Exchange mailboxes, you need to configure Exchange mail flow rules (also known as transport rules) in your on-premises Exchange organization to recognize the spam filtering verdicts from the cloud. For details, see Deliver cloud-detected spam to the Junk Email folder in on-premises mailboxes.

  After you manually create the rule in Microsoft 365 to match the rule in on-premises Exchange, the rule replicates in hybrid environments.

• Outbound messages: The message is either routed through the high-risk delivery pool or is returned to the sender in a non-delivery report (also known as an NDR or bounce message). For more information, see Outbound spam protection.

What's a zero-day spam variant and how is it handled by the service?

A zero-day spam variant is a first generation, previously unknown variant of spam that's never been captured or analyzed, so our anti-spam filters can't yet detect it. After a zero-day spam sample is captured and analyzed by our spam analysts, if it meets the spam classification criteria, our anti-spam filters are updated to detect it, and it's no longer considered "zero-day."

Note

If you receive a message that might be a zero-day spam variant, to help us improve the service, submit the message to Microsoft using one of the methods described in Report messages and files to Microsoft.

Do I need to configure the service to provide anti-spam protection?

No. The default anti-spam policy protects all current and future cloud recipients in your Microsoft 365 organization after you sign up for the service and add your domain.

As an admin, you can use the following methods to further refine anti-spam protection:

• Add users to the Standard and Strict preset security policies.
• Edit the default spam filtering settings in the default anti-spam policy.
• Create anti-spam policies that apply to specified users, groups, or domains in your organization.

For more information, see the following articles:

• Recommended anti-spam policy settings
• Configure anti-spam policies
• Preset security policies

If I change an anti-spam policy, how long does it take for the changes to take effect?

Changes might take up to 1 hour to take effect after you save them.

If I modify a distribution group that's used to scope an anti-spam policy, how long does it take for the changes to take effect for added or removed group members?

Policy enforcement might be delayed when you add a user to a group that's used to scope an existing policy. This delay isn't caused by policy update latency. Instead, group membership expansion and caching latency cause the delay. Anti-spam and other threat policy rule objects rely on the same rules engine used by Exchange mail flow rules (also known as transport rules), so they inherit the same group membership evaluation behavior. If a policy change needs to take effect quickly for a specific user, scope the policy to the individual rather than a group.

Is bulk email filtering automatically enabled?

Yes. For more information about bulk email, see What's the difference between junk email and bulk email? and Bulk complaint level (BCL).

Does the service provide URL filtering?

Yes, the service has a URL filter that checks for URLs within messages. If URLs associated with known spam or malicious content are detected, the message is marked as spam.

Customers with Microsoft Defender for Office 365 licenses also get Safe Links protection. For more information, see Safe Links in Microsoft Defender for Office 365.

How can Microsoft 365 customers send false positive (bad) and false negative (good) messages to Microsoft?

See Report messages and files to Microsoft.

Can I get spam reports?

Yes. The following reports are available:

• Spam detections report
• Threat protection status report
• Submissions report (admins)
• User reported messages report

Someone sent me a message and I can't find it. I suspect that it may have been detected as spam. Is there a tool that I can use to find out?

Yes, the message trace tool enables you to follow email messages as they pass through the service, to find out what happened to them. For more information about how to use the message trace tool to find out why a message was marked as spam, see Was a message marked as spam?.

Does the service throttle (rate limit) my mail if users send outbound spam?

If more than half of the email sent by a user within a certain time frame (for example, per hour) is identified as spam, the user is blocked from sending messages. In most cases, outbound spam is routed through the high-risk delivery pool, which reduces the probability of the normal outbound IP pool being added to blocklists.

Notifications are automatically sent when users are blocked due to sending outbound spam or exceeding sending limits. For more information, see Outbound spam protection.

Can I use a non-Microsoft anti-spam and anti-malware provider with Microsoft 365?

Yes. Although we recommend that you point your MX record directly to Microsoft, we realize that there are legitimate business reasons to route your email to somewhere other than Microsoft first.

• Inbound: Change your MX records to point to the non-Microsoft provider, who then routes the messages to Microsoft 365 for delivery. For more information, see Enhanced Filtering for connectors in Exchange Online.
• Outbound: Configure smart host routing from Microsoft 365 to the destination non-Microsoft provider.

Does Microsoft have any documentation about how I can protect myself from phishing scams?

Yes. For more information, see Protect your privacy on the internet

Are spam and malware messages being investigated as to who sent them, or being transferred to law enforcement entities?

The service focuses on spam and malware detection and removal, though we might occasionally investigate especially dangerous or damaging campaigns and pursue the perpetrators. This pursuit might involve working with our legal and digital crime units to take down a botnet, blocking the spammer from using the service (if they're using it for sending outbound email), and passing the information on to law enforcement for criminal prosecution.

What are the best practices for outbound mail that help to ensure my mail is delivered?

The guidelines at External senders - Troubleshoot email sent to Microsoft 365 and the following guidelines are best practices for sending outbound email messages:

• The source email domain should resolve in DNS: For example, if the sender is user@fabrikam, the domain fabrikam resolves to the IP address 192.168.43.10.

  If a sending domain has no A-record and no MX record in DNS, the service routes the message through its higher risk delivery pool, regardless of the message content. For more information about the high risk delivery pool, see High-risk delivery pool for outbound messages.

• The source email server should have a reverse DNS (PTR) entry: For example, if the email source IP address is 192.168.43.10, the reverse DNS entry would be 43-10.any.icann.org.

• The HELO/EHLO and MAIL FROM commands should be consistent, present, and use a domain name rather than an IP address: The HELO/EHLO command should be configured to match the reverse DNS of the sending IP address. This setting helps ensure that the domain remains the same across the various parts of the message headers.

• Ensure that proper SPF records are set up in DNS: SPF records are a mechanism for validating that mail sent from a domain really is coming from that domain and isn't spoofed. For more information about SPF records, see the following links:

  • Set up SPF to identify valid email sources for your custom cloud domains
  • Domains FAQ

• Signing email with DKIM, sign with relaxed canonicalization: If a sender wants to sign their messages using Domain Keys Identified Mail (DKIM) and they want to send outbound mail through the service, they should sign using the relaxed header canonicalization algorithm. Signing with strict header canonicalization may invalidate the signature when it passes through the service.

• Domain owners should have accurate information in the WHOIS database: This configuration identifies the owners of the domain and how to contact them by entering the stable parent company, point of contact, and name servers.

• Format outbound bounce messages: When messages generate non-delivery reports (also known as NDRs or bounce messages), senders should follow the format of a bounce as specified in RFC 3464.

• Remove bounced email addresses for non-existent users: If you receive an NDR indicating that an email address is no longer in use, remove the non-existent email alias from your list. Email addresses change over time, and people sometimes discard them.

• Use Outlook.com's Smart Network Data Services (SNDS) program: For more information, see Smart Network Data Service.

How do I turn off spam filtering?

If you use a non-Microsoft protection service or device to scan email before it's delivered to Microsoft 365, you can use a mail flow rule (also known as a transport rule) to bypass most spam filtering for incoming messages. For instructions, see Use mail flow rules to set the spam confidence level (SCL) in messages. Scanning for malware and high confidence phishing messages can't be skipped.

If you use a non-Microsoft protection service or device to scan email before it's delivered to Microsoft 365, you should also enable Enhanced Filtering for Connectors (also known as skip listing) so detection, reporting, and investigation features in Microsoft 365 are able to correctly identify message sources. For more information, see Enhanced Filtering for Connectors.

If you need to bypass spam filtering for SecOps mailboxes or phishing simulations, don't use mail flow rules. For more information, see Configure the delivery of non-Microsoft phishing simulations to users and unfiltered messages to SecOps mailboxes.

Why was my legitimate email flagged as spam?

Legitimate email can be incorrectly flagged as spam (a false positive) for several reasons. The following table describes the most common causes and what to do about them:

Cause	Details	Resolution
Email authentication failure	The message failed SPF, DKIM, or DMARC checks, which caused composite authentication (compauth) to fail. Microsoft 365 treats unauthenticated messages with higher suspicion.	Verify that SPF, DKIM, and DMARC are correctly configured for the sending domain.
Sender reputation	The sending IP address or domain has a poor reputation due to historical spam complaints, blocklist entries, or low sending volume.	Check whether the sending IP is on any non-Microsoft blocklists. Verify the sender's IP has a valid reverse DNS (PTR) record. If the sender is external, ask them to check their reputation at Microsoft SNDS.
Message content triggers	The message body, subject, or attachments contain characteristics associated with spam. For example: Excessive links URL shorteners Form tags Embedded scripts Image-only content	Review the message content. Check if any Advanced Spam Filter (ASF) settings are enabled in the applicable anti-spam policy that could flag the content. For example: Empty messages Embed tags in HTML JavaScript or VBScript in HTML
Bulk complaint level (BCL) threshold	The message was classified as bulk because the sender's BCL met or exceeded the threshold configured in the anti-spam policy. Bulk mail (also known as gray mail) includes newsletters, promotions, and marketing email that the user previously opted into.	Bulk mail isn't the same as spam. See How to fix bulk email going to the Junk Email folder? in this article.
User or organization overrides	An Exchange mail flow rule (transport rule), anti-spam policy, or Outlook Blocked Senders list is configured to treat the sender or domain as spam.	Review mail flow rules on the Rules page in the Exchange admin center at https://admin.exchange.microsoft.com/#/transportrules. Check the applicable anti-spam policy for blocked senders/domains. Ask the user to check their Blocked Senders list in Outlook.
Non-Microsoft filtering interference	A non-Microsoft email security service routes messages to Microsoft 365, but the original source IP information is lost. Microsoft 365 evaluates the intermediary's IP address instead of the true source, which can cause SPF and authentication failures.	Configure Enhanced Filtering for Connectors (also known as skip listing) on the inbound connector to preserve the original source IP.

How to investigate a false positive

1. Examine the message headers: Look at the X-Forefront-Antispam-Report header for the spam confidence level (SCL), bulk complaint level (BCL), and the filtering verdict. Check the Authentication-Results header for SPF, DKIM, and DMARC results.

   For more information about interpreting anti-spam headers, see Anti-spam message headers.

2. Use Message trace: In the Exchange admin center, go to Mail flow > Message trace to track the message and see which filtering rule or policy flagged it.

3. Check Threat Explorer or Real-time detections (requires Microsoft Defender for Office 365): Use Threat Explorer to find the message and review the detection technology, delivery action, and override details.

4. Submit the message to Microsoft: Report the false positive to Microsoft for analysis. For more information, see Report messages and files to Microsoft.

How to prevent future false positives

Caution

Allowlists create a high risk of attackers successfully delivering malicious email that would otherwise be filtered. Use allow entries carefully and only when necessary. Messages identified as malware or high confidence phishing are always filtered, regardless of allow list entries.

Use the following methods (in order of preference) to prevent legitimate email from being flagged:

1. Fix the root cause: If the false positive is caused by authentication failures, fix the SPF, DKIM, or DMARC configuration. If it's caused by content, work with the sender to adjust the message content.

2. Report the false positive: Use the Submissions page in the Microsoft Defender portal to submit the message to Microsoft. If appropriate, Microsoft creates an allow entry in the Tenant Allow/Block List. For more information, see Report good email to Microsoft.

3. Create a Tenant Allow/Block List entry: Temporarily allow the sender, domain, or URL while Microsoft reviews the submission. For more information, see Tenant Allow/Block List.

4. Use mail flow rules (with caution): Create a mail flow rule to set the SCL to -1 for messages from the specific sender, but only if you're confident the sender is legitimate. For more information, see Use mail flow rules to set the SCL in messages.

For a complete step-by-step guide, see How to handle legitimate emails getting blocked (false positives).

What's the difference between spam and high-confidence spam?

Microsoft 365 spam filtering assigns a spam confidence level (SCL) to every inbound message. Messages with SCL 5 or 6 are classified as Spam, while messages with SCL 7, 8, or 9 are classified as High confidence spam. For a complete breakdown of SCL values and their default actions, see Spam confidence level (SCL).

Key differences

	Spam (SCL 5-6)	High confidence spam (SCL 7-9)
Confidence level	Moderate probability of being spam.	High probability of being spam.
Default action (default policy)	Move to Junk Email folder.	Move to Junk Email folder.
Default action (Standard preset policy)	Move to Junk Email folder.	Quarantine.
Default action (Strict preset policy)	Quarantine.	Quarantine.
User overrides	Users can retrieve from Junk Email and add to Safe Senders.	Users can retrieve from Junk Email (default policy) or request release from quarantine (preset policies).
Admin configurable	Yes. The action is configurable in anti-spam policies.	Yes. The action is configurable in anti-spam policies.
Common triggers	Promotional content patterns, suspicious links, low sender reputation.	Known spam signatures, phishing-like characteristics, embedded scripts, ASF rule matches (for example, empty messages, form tags, JavaScript in HTML).

The action for both Spam and High confidence spam verdicts is configurable in anti-spam policies. For more information, see Configure anti-spam policies and Recommended anti-spam policy settings.

How to fix bulk email going to the Junk Email folder?

Bulk email (also known as gray mail) includes newsletters, marketing messages, and promotions that users opted in to receive. Unlike spam, bulk email is typically from legitimate senders, but the volume and content characteristics can resemble spam.

Microsoft 365 assigns a bulk complaint level (BCL) to each inbound message. The BCL value ranges from 0 (unlikely bulk) to 9 (most likely bulk). For the full BCL value breakdown, see Bulk complaint level (BCL).

If the BCL of a message meets or exceeds the bulk email threshold set in the applicable anti-spam policy, the message is treated as Bulk and the configured action is applied (by default, move to Junk Email folder).

Step 1: Identify the BCL threshold and message BCL

1. Find the current BCL threshold: Check the Bulk email threshold value in the applicable anti-spam policy. For the default BCL thresholds in each policy type, see Bulk complaint level (BCL). For instructions on viewing the threshold, see Open the bulk senders insight in the Microsoft Defender portal.

2. Find the message's BCL value: Examine the message headers and look for the X-Microsoft-Antispam header. The BCL: value indicates the bulk complaint level assigned to the message. For example:

   X-Microsoft-Antispam: BCL:5;
   

Step 2: Choose a fix

Based on your situation, use one or more of the following methods:

Option A: Adjust the BCL threshold (recommended for organization-wide tuning)

If too many legitimate bulk messages are going to the Junk Email folder, raise the BCL threshold in the applicable anti-spam policy. A higher value means fewer messages are classified as bulk. You can also use the bulk senders insight to simulate the effect of threshold changes before you apply them. For more information, see How to tune bulk email and Configure anti-spam policies.

Note

Settings in the Standard or Strict preset security policies override custom anti-spam policy settings for recipients included in those policies.

Option B: Change the bulk email action

By default, messages that meet the bulk threshold are moved to the Junk Email folder. You can change this action to No action if you want bulk email delivered to the Inbox. For more information, see Configure anti-spam policies.

• Microsoft Defender portal: In the anti-spam policy > Actions > set the Bulk complaint level (BCL) met or exceeded action to No action or another preferred action.

• PowerShell:

  Set-HostedContentFilterPolicy -Identity "<Policy Name>" -BulkSpamAction NoAction
  

Option C: Allow specific bulk senders

If the issue is limited to a specific sender:

1. Organization-level: Report the message as not junk: Use the Submissions page in the Microsoft Defender portal at https://security.microsoft.com/reportsubmission to report the message as a false positive. During submission, you can also create an allow entry for the sender in the Tenant Allow/Block List. For more information, see Report good email to Microsoft.

2. User-level: Add to Safe Senders: The user can add the sender to their Safe Senders list in Outlook or Outlook on the web. Messages from Safe Senders aren't delivered to the Junk Email folder. For more information, see Use Junk Email Filters to control which messages you see.

   Admins can use PowerShell to add senders to the Safe Senders list in cloud mailboxes. For more information, see Configure the safelist collection on a mailbox.

   Caution

   Don't add domains to Safe Senders lists. Attackers could then successfully deliver email from those domains that would otherwise be filtered.

Option D: Use the Promotions folder (Preview)

If available in your organization, you can route bulk email that falls below the BCL threshold to a dedicated Promotions folder instead of the Inbox.

For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.

Option E: Use the Bulk senders insight

Use the Bulk senders insight in the Microsoft Defender portal to identify the top bulk senders delivering mail to your organization. This insight helps you identify which senders to allow, block, or tune thresholds for.

For more information, see Bulk senders insight.

Diagnostic workflow

Use the following workflow to diagnose and fix bulk email routing issues:

Is the email going to Junk Email folder?
│
├─ Yes → Check message headers for BCL value
│        │
│        ├─ BCL ≥ threshold → Message classified as Bulk
│        │   │
│        │   ├─ Raise BCL threshold in anti-spam policy (Option A)
│        │   ├─ Change Bulk action to No action (Option B)
│        │   └─ Allow specific sender (Option C)
│        │
│        └─ BCL < threshold → Not a bulk issue; check SCL value
│            │
│            ├─ SCL 5-6 → Classified as Spam (see "Why was my legitimate email flagged as spam?")
│            └─ SCL 7-9 → Classified as High confidence spam
│
└─ No → Email is delivering correctly

Related bulk email resources

• What's the difference between junk email and bulk email?
• Bulk complaint level (BCL) values
• Tune bulk email filtering
• Bulk senders insight
• Configure anti-spam policies

Tip

Did you know you can try the features in Microsoft Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft Defender portal trials hub. Learn about who can sign up and trial terms on Try Microsoft Defender for Office 365.

Applies to

• Built-in security features for all cloud mailboxes
• Microsoft Defender for Office 365 Plan 1 and Plan 2
• Microsoft Defender XDR

This article provides frequently asked questions and answers about anti-spam protection for Microsoft 365 organizations with cloud mailboxes.

For questions and answers about the quarantine, see Quarantine FAQ.

For questions and answers about anti-malware protection, see Frequently asked questions: Anti-malware protection.

For questions and answers about anti-spoofing protection, see Anti-spoofing protection FAQ.

• Inbound messages: Most spam is detected via connection filtering at the edge of the service, which is based on the IP address of the source email server. Anti-spam policies (also known as spam filter policies or content filter policies) inspect and classify messages as bulk, spam, high confidence spam, phishing, or high confidence phishing.

  Anti-spam policies are used in the Standard and Strict preset security policies. You can create custom anti-spam policies that apply to specific groups of users. There's also a default anti-spam policy that applies to all recipients who aren't specified in the Standard and Strict preset security policies or in custom policies.

  By default, messages that are identified as spam are moved to the Junk Email folder by the Standard preset security policy, custom anti-spam policies (configurable), and the default anti-spam policy (configurable). In the Strict preset security policy, spam messages are quarantined.

  For more information, see Configure anti-spam policies and Recommended anti-spam policy settings.

  Important

  In environments where the built-in security features for all cloud mailboxes protect on-premises Exchange mailboxes, you need to configure Exchange mail flow rules (also known as transport rules) in your on-premises Exchange organization to recognize the spam filtering verdicts from the cloud. For details, see Deliver cloud-detected spam to the Junk Email folder in on-premises mailboxes.

  After you manually create the rule in Microsoft 365 to match the rule in on-premises Exchange, the rule replicates in hybrid environments.

• Outbound messages: The message is either routed through the high-risk delivery pool or is returned to the sender in a non-delivery report (also known as an NDR or bounce message). For more information, see Outbound spam protection.

A zero-day spam variant is a first generation, previously unknown variant of spam that's never been captured or analyzed, so our anti-spam filters can't yet detect it. After a zero-day spam sample is captured and analyzed by our spam analysts, if it meets the spam classification criteria, our anti-spam filters are updated to detect it, and it's no longer considered "zero-day."

Note

If you receive a message that might be a zero-day spam variant, to help us improve the service, submit the message to Microsoft using one of the methods described in Report messages and files to Microsoft.

No. The default anti-spam policy protects all current and future cloud recipients in your Microsoft 365 organization after you sign up for the service and add your domain.

As an admin, you can use the following methods to further refine anti-spam protection:

• Add users to the Standard and Strict preset security policies.
• Edit the default spam filtering settings in the default anti-spam policy.
• Create anti-spam policies that apply to specified users, groups, or domains in your organization.

For more information, see the following articles:

• Recommended anti-spam policy settings
• Configure anti-spam policies
• Preset security policies

Changes might take up to 1 hour to take effect after you save them.

Policy enforcement might be delayed when you add a user to a group that's used to scope an existing policy. This delay isn't caused by policy update latency. Instead, group membership expansion and caching latency cause the delay. Anti-spam and other threat policy rule objects rely on the same rules engine used by Exchange mail flow rules (also known as transport rules), so they inherit the same group membership evaluation behavior. If a policy change needs to take effect quickly for a specific user, scope the policy to the individual rather than a group.

Yes. For more information about bulk email, see What's the difference between junk email and bulk email? and Bulk complaint level (BCL).

Yes, the service has a URL filter that checks for URLs within messages. If URLs associated with known spam or malicious content are detected, the message is marked as spam.

Customers with Microsoft Defender for Office 365 licenses also get Safe Links protection. For more information, see Safe Links in Microsoft Defender for Office 365.

See Report messages and files to Microsoft.

Yes. The following reports are available:

• Spam detections report
• Threat protection status report
• Submissions report (admins)
• User reported messages report

Yes, the message trace tool enables you to follow email messages as they pass through the service, to find out what happened to them. For more information about how to use the message trace tool to find out why a message was marked as spam, see Was a message marked as spam?.

If more than half of the email sent by a user within a certain time frame (for example, per hour) is identified as spam, the user is blocked from sending messages. In most cases, outbound spam is routed through the high-risk delivery pool, which reduces the probability of the normal outbound IP pool being added to blocklists.

Notifications are automatically sent when users are blocked due to sending outbound spam or exceeding sending limits. For more information, see Outbound spam protection.

Yes. Although we recommend that you point your MX record directly to Microsoft, we realize that there are legitimate business reasons to route your email to somewhere other than Microsoft first.

• Inbound: Change your MX records to point to the non-Microsoft provider, who then routes the messages to Microsoft 365 for delivery. For more information, see Enhanced Filtering for connectors in Exchange Online.
• Outbound: Configure smart host routing from Microsoft 365 to the destination non-Microsoft provider.

Yes. For more information, see Protect your privacy on the internet

The service focuses on spam and malware detection and removal, though we might occasionally investigate especially dangerous or damaging campaigns and pursue the perpetrators. This pursuit might involve working with our legal and digital crime units to take down a botnet, blocking the spammer from using the service (if they're using it for sending outbound email), and passing the information on to law enforcement for criminal prosecution.

The guidelines at External senders - Troubleshoot email sent to Microsoft 365 and the following guidelines are best practices for sending outbound email messages:

• The source email domain should resolve in DNS: For example, if the sender is user@fabrikam, the domain fabrikam resolves to the IP address 192.168.43.10.

  If a sending domain has no A-record and no MX record in DNS, the service routes the message through its higher risk delivery pool, regardless of the message content. For more information about the high risk delivery pool, see High-risk delivery pool for outbound messages.

• The source email server should have a reverse DNS (PTR) entry: For example, if the email source IP address is 192.168.43.10, the reverse DNS entry would be 43-10.any.icann.org.

• The HELO/EHLO and MAIL FROM commands should be consistent, present, and use a domain name rather than an IP address: The HELO/EHLO command should be configured to match the reverse DNS of the sending IP address. This setting helps ensure that the domain remains the same across the various parts of the message headers.

• Ensure that proper SPF records are set up in DNS: SPF records are a mechanism for validating that mail sent from a domain really is coming from that domain and isn't spoofed. For more information about SPF records, see the following links:

  • Set up SPF to identify valid email sources for your custom cloud domains
  • Domains FAQ

• Signing email with DKIM, sign with relaxed canonicalization: If a sender wants to sign their messages using Domain Keys Identified Mail (DKIM) and they want to send outbound mail through the service, they should sign using the relaxed header canonicalization algorithm. Signing with strict header canonicalization may invalidate the signature when it passes through the service.

• Domain owners should have accurate information in the WHOIS database: This configuration identifies the owners of the domain and how to contact them by entering the stable parent company, point of contact, and name servers.

• Format outbound bounce messages: When messages generate non-delivery reports (also known as NDRs or bounce messages), senders should follow the format of a bounce as specified in RFC 3464.

• Remove bounced email addresses for non-existent users: If you receive an NDR indicating that an email address is no longer in use, remove the non-existent email alias from your list. Email addresses change over time, and people sometimes discard them.

• Use Outlook.com's Smart Network Data Services (SNDS) program: For more information, see Smart Network Data Service.

If you use a non-Microsoft protection service or device to scan email before it's delivered to Microsoft 365, you can use a mail flow rule (also known as a transport rule) to bypass most spam filtering for incoming messages. For instructions, see Use mail flow rules to set the spam confidence level (SCL) in messages. Scanning for malware and high confidence phishing messages can't be skipped.

If you use a non-Microsoft protection service or device to scan email before it's delivered to Microsoft 365, you should also enable Enhanced Filtering for Connectors (also known as skip listing) so detection, reporting, and investigation features in Microsoft 365 are able to correctly identify message sources. For more information, see Enhanced Filtering for Connectors.

If you need to bypass spam filtering for SecOps mailboxes or phishing simulations, don't use mail flow rules. For more information, see Configure the delivery of non-Microsoft phishing simulations to users and unfiltered messages to SecOps mailboxes.

Legitimate email can be incorrectly flagged as spam (a false positive) for several reasons. The following table describes the most common causes and what to do about them:

Cause	Details	Resolution
Email authentication failure	The message failed SPF, DKIM, or DMARC checks, which caused composite authentication (compauth) to fail. Microsoft 365 treats unauthenticated messages with higher suspicion.	Verify that SPF, DKIM, and DMARC are correctly configured for the sending domain.
Sender reputation	The sending IP address or domain has a poor reputation due to historical spam complaints, blocklist entries, or low sending volume.	Check whether the sending IP is on any non-Microsoft blocklists. Verify the sender's IP has a valid reverse DNS (PTR) record. If the sender is external, ask them to check their reputation at Microsoft SNDS.
Message content triggers	The message body, subject, or attachments contain characteristics associated with spam. For example: Excessive links URL shorteners Form tags Embedded scripts Image-only content	Review the message content. Check if any Advanced Spam Filter (ASF) settings are enabled in the applicable anti-spam policy that could flag the content. For example: Empty messages Embed tags in HTML JavaScript or VBScript in HTML
Bulk complaint level (BCL) threshold	The message was classified as bulk because the sender's BCL met or exceeded the threshold configured in the anti-spam policy. Bulk mail (also known as gray mail) includes newsletters, promotions, and marketing email that the user previously opted into.	Bulk mail isn't the same as spam. See How to fix bulk email going to the Junk Email folder? in this article.
User or organization overrides	An Exchange mail flow rule (transport rule), anti-spam policy, or Outlook Blocked Senders list is configured to treat the sender or domain as spam.	Review mail flow rules on the Rules page in the Exchange admin center at https://admin.exchange.microsoft.com/#/transportrules. Check the applicable anti-spam policy for blocked senders/domains. Ask the user to check their Blocked Senders list in Outlook.
Non-Microsoft filtering interference	A non-Microsoft email security service routes messages to Microsoft 365, but the original source IP information is lost. Microsoft 365 evaluates the intermediary's IP address instead of the true source, which can cause SPF and authentication failures.	Configure Enhanced Filtering for Connectors (also known as skip listing) on the inbound connector to preserve the original source IP.

How to investigate a false positive

1. Examine the message headers: Look at the X-Forefront-Antispam-Report header for the spam confidence level (SCL), bulk complaint level (BCL), and the filtering verdict. Check the Authentication-Results header for SPF, DKIM, and DMARC results.

   For more information about interpreting anti-spam headers, see Anti-spam message headers.

2. Use Message trace: In the Exchange admin center, go to Mail flow > Message trace to track the message and see which filtering rule or policy flagged it.

3. Check Threat Explorer or Real-time detections (requires Microsoft Defender for Office 365): Use Threat Explorer to find the message and review the detection technology, delivery action, and override details.

4. Submit the message to Microsoft: Report the false positive to Microsoft for analysis. For more information, see Report messages and files to Microsoft.

How to prevent future false positives

Caution

Allowlists create a high risk of attackers successfully delivering malicious email that would otherwise be filtered. Use allow entries carefully and only when necessary. Messages identified as malware or high confidence phishing are always filtered, regardless of allow list entries.

Use the following methods (in order of preference) to prevent legitimate email from being flagged:

1. Fix the root cause: If the false positive is caused by authentication failures, fix the SPF, DKIM, or DMARC configuration. If it's caused by content, work with the sender to adjust the message content.

2. Report the false positive: Use the Submissions page in the Microsoft Defender portal to submit the message to Microsoft. If appropriate, Microsoft creates an allow entry in the Tenant Allow/Block List. For more information, see Report good email to Microsoft.

3. Create a Tenant Allow/Block List entry: Temporarily allow the sender, domain, or URL while Microsoft reviews the submission. For more information, see Tenant Allow/Block List.

4. Use mail flow rules (with caution): Create a mail flow rule to set the SCL to -1 for messages from the specific sender, but only if you're confident the sender is legitimate. For more information, see Use mail flow rules to set the SCL in messages.

For a complete step-by-step guide, see How to handle legitimate emails getting blocked (false positives).

Microsoft 365 spam filtering assigns a spam confidence level (SCL) to every inbound message. Messages with SCL 5 or 6 are classified as Spam, while messages with SCL 7, 8, or 9 are classified as High confidence spam. For a complete breakdown of SCL values and their default actions, see Spam confidence level (SCL).

Key differences

	Spam (SCL 5-6)	High confidence spam (SCL 7-9)
Confidence level	Moderate probability of being spam.	High probability of being spam.
Default action (default policy)	Move to Junk Email folder.	Move to Junk Email folder.
Default action (Standard preset policy)	Move to Junk Email folder.	Quarantine.
Default action (Strict preset policy)	Quarantine.	Quarantine.
User overrides	Users can retrieve from Junk Email and add to Safe Senders.	Users can retrieve from Junk Email (default policy) or request release from quarantine (preset policies).
Admin configurable	Yes. The action is configurable in anti-spam policies.	Yes. The action is configurable in anti-spam policies.
Common triggers	Promotional content patterns, suspicious links, low sender reputation.	Known spam signatures, phishing-like characteristics, embedded scripts, ASF rule matches (for example, empty messages, form tags, JavaScript in HTML).

The action for both Spam and High confidence spam verdicts is configurable in anti-spam policies. For more information, see Configure anti-spam policies and Recommended anti-spam policy settings.

Bulk email (also known as gray mail) includes newsletters, marketing messages, and promotions that users opted in to receive. Unlike spam, bulk email is typically from legitimate senders, but the volume and content characteristics can resemble spam.

Microsoft 365 assigns a bulk complaint level (BCL) to each inbound message. The BCL value ranges from 0 (unlikely bulk) to 9 (most likely bulk). For the full BCL value breakdown, see Bulk complaint level (BCL).

If the BCL of a message meets or exceeds the bulk email threshold set in the applicable anti-spam policy, the message is treated as Bulk and the configured action is applied (by default, move to Junk Email folder).

Step 1: Identify the BCL threshold and message BCL

1. Find the current BCL threshold: Check the Bulk email threshold value in the applicable anti-spam policy. For the default BCL thresholds in each policy type, see Bulk complaint level (BCL). For instructions on viewing the threshold, see Open the bulk senders insight in the Microsoft Defender portal.

2. Find the message's BCL value: Examine the message headers and look for the X-Microsoft-Antispam header. The BCL: value indicates the bulk complaint level assigned to the message. For example:

   X-Microsoft-Antispam: BCL:5;
   

Step 2: Choose a fix

Based on your situation, use one or more of the following methods:

Option A: Adjust the BCL threshold (recommended for organization-wide tuning)

If too many legitimate bulk messages are going to the Junk Email folder, raise the BCL threshold in the applicable anti-spam policy. A higher value means fewer messages are classified as bulk. You can also use the bulk senders insight to simulate the effect of threshold changes before you apply them. For more information, see How to tune bulk email and Configure anti-spam policies.

Note

Settings in the Standard or Strict preset security policies override custom anti-spam policy settings for recipients included in those policies.

Option B: Change the bulk email action

By default, messages that meet the bulk threshold are moved to the Junk Email folder. You can change this action to No action if you want bulk email delivered to the Inbox. For more information, see Configure anti-spam policies.

• Microsoft Defender portal: In the anti-spam policy > Actions > set the Bulk complaint level (BCL) met or exceeded action to No action or another preferred action.

• PowerShell:

  Set-HostedContentFilterPolicy -Identity "<Policy Name>" -BulkSpamAction NoAction
  

Option C: Allow specific bulk senders

If the issue is limited to a specific sender:

1. Organization-level: Report the message as not junk: Use the Submissions page in the Microsoft Defender portal at https://security.microsoft.com/reportsubmission to report the message as a false positive. During submission, you can also create an allow entry for the sender in the Tenant Allow/Block List. For more information, see Report good email to Microsoft.

2. User-level: Add to Safe Senders: The user can add the sender to their Safe Senders list in Outlook or Outlook on the web. Messages from Safe Senders aren't delivered to the Junk Email folder. For more information, see Use Junk Email Filters to control which messages you see.

   Admins can use PowerShell to add senders to the Safe Senders list in cloud mailboxes. For more information, see Configure the safelist collection on a mailbox.

   Caution

   Don't add domains to Safe Senders lists. Attackers could then successfully deliver email from those domains that would otherwise be filtered.

Option D: Use the Promotions folder (Preview)

If available in your organization, you can route bulk email that falls below the BCL threshold to a dedicated Promotions folder instead of the Inbox.

For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.

Option E: Use the Bulk senders insight

Use the Bulk senders insight in the Microsoft Defender portal to identify the top bulk senders delivering mail to your organization. This insight helps you identify which senders to allow, block, or tune thresholds for.

For more information, see Bulk senders insight.

Diagnostic workflow

Use the following workflow to diagnose and fix bulk email routing issues:

Is the email going to Junk Email folder?
│
├─ Yes → Check message headers for BCL value
│        │
│        ├─ BCL ≥ threshold → Message classified as Bulk
│        │   │
│        │   ├─ Raise BCL threshold in anti-spam policy (Option A)
│        │   ├─ Change Bulk action to No action (Option B)
│        │   └─ Allow specific sender (Option C)
│        │
│        └─ BCL < threshold → Not a bulk issue; check SCL value
│            │
│            ├─ SCL 5-6 → Classified as Spam (see "Why was my legitimate email flagged as spam?")
│            └─ SCL 7-9 → Classified as High confidence spam
│
└─ No → Email is delivering correctly

Related bulk email resources

• What's the difference between junk email and bulk email?
• Bulk complaint level (BCL) values
• Tune bulk email filtering
• Bulk senders insight
• Configure anti-spam policies