ExchangeOnline SCL=1 vs. Outlook.com SCL=6

Question

Hi,

Our Issue:

exchange online: Inbound email results to: SCL=1. Which is expected.

outlook.com: Inbound email results to: SCL=6. Which is not expected.

Context:

The sender sends from Exchange Online to another Exchange Online tenant as well as to outlook.com, with what is a fully configured system:

• spf=pass, dkim=pass, dmarc=pass, arc=pass, compauth=pass.

The same email that's sent and received by:

Why would the result be: "X-MS-Exchange-Organization-SCL:1" when the recipient is using Exchange Online but then it is: "X-MS-Exchange-Organization-SCL: 6" when the recipient is using outlook.com

The recipient on Exchange Online did not manually adjust any SCL behaviour, meaning that SCL:1 should be valid.

The Email Headers are not being changed in any way in transit with any transporting rules or the likes.

Thanks.

Answer 1

Understood. I'll log an official support ticket with 365 and will report back here.

Thank you kindly.

Answer 2

Dear Cyberflake,

Thank you for your response. I understand your concern about the SCL value difference between the two tenants.

Regarding your question about outbound connectors, it is not a widespread practice between Exchange Online and Outlook.com. However, it can be a useful workaround in cases where there are issues with email delivery.

As for the reason behind the SCL value difference, it could be due to various factors such as the reputation of the sending IP address, the content of the email, or the recipient's email filtering settings. It is difficult to determine the exact cause without further investigation.

As a community moderator, my resources for troubleshooting are limited. If you would like to investigate further, I recommend opening a support ticket with Microsoft. Our support team can analyze the custom domain, license, IP reputation, and email headers to provide more insights into the issue.

To open a Microsoft support ticket, follow these steps:

• Go to Microsoft 365 Admin Center.
• Sign in with your admin credentials.
• In the left-hand navigation pane, select Support.
• Click on New service request.

Thank you in advance for your understanding. Your patience and cooperation will be greatly appreciated. Wishing you all the best!  

Sincerely Feroz Mahmud | Microsoft Community Moderator

Answer 3

Hi Feroz Mahmud,

Unfortunately, the outbound connector has no effect with outlook.com.

Answer 4

Hi Feroz Mahmud,

Thank you for your comprehensive response. Appreciated.

I do comprehend that the two SCL systems are similar but different.

I've even compared two separate 365 tenants and fail to find configuration difference through the common layers. The one tenant results to as expected with a low SCL but the tenant in question, results to above score of 6 which remains unknown, the tenant is a brand-new tenant and does not even send bulk. Does it have to do I.P reputation warmup? No, because it's 365 infrastructure.

Further tests to gmail.com for results are as expected, being delivered to the inbox.

Currently it is only outlook.com with the unexpected result.

Thus, is it fair to say that what you propose, thou an effective solution, is a workaround?

I can't confirm that an outbound connector is part of any known widespread practice between Exchange online and outlook.com, unless I'm mistaken?

It would be most insightful to understand the "why". For instance, if outlook.com hypothetically made BIMI a requirement of their SCL strike algorithm.

Thank you sir.

Answer 5

Dear Cyberflake,   Thank you for reaching out to Microsoft Community. I apologize for any inconvenience you’ve experienced with the SCL (Spam Confidence Level) value.

The difference in SCL values between Exchange Online and Outlook.com could be due to the different anti-spam filters used by each service. While both services utilize similar technologies such as SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance), their algorithms for assessing email spam scores may differ.

As you’ve confirmed that SPF, DKIM, DMARC, ARC (Authenticated Received Chain), and CompAuth (Comprehensive Authentication) are all passing, I recommend creating a partner connector with Outlook.com. Please note that this action requires Global Administrator permissions.

To set up the Outbound Connector, follow these steps:

1. Go to the Exchange Admin Center (EAC).
2. In the left-hand navigation pane, click on “Mail flow.”
3. Select “Connectors.”
4. Click the “+” button to add a new connector.
5. Configure the connector as follows:
   • Connection From: Office 365
   • Connection To: Partner organization
   • Connector Name: Exchange Online to Outlook.com
   • Recipient Domains: Add all affected domains (e.g., outlook.com, gmail.com)
   • Use Only for Email Sent to Those Domains: outlook.com
   • Use the MX Record Associated with the Partner’s Domain

We trust that implementing these measures will help resolve the issue. If you continue to experience difficulties after implementing these recommendations, please do not hesitate to inform us. Thank you for your time and cooperation.   

Sincerely  

Feroz Mahmud | Microsoft Community Moderator