Microsoft blocking all email from Google Workspace

Question

Microsoft blocking all email from Google Workspace

Radu Groza 5

This issue has been ongoing for quite some time, and despite multiple support calls and service requests, we still do not have a resolution. I’m hoping someone can provide direction or insight into what might be causing this.

Emails from the domain electriccastle.ro (hosted on Google Workspace) are being consistently blocked with a spam score of 9 (Worst possible!). Messages are either routed to spam or deleted entirely. Electric Castle is a legitimate, well-established company with a domain that has been active for over 10 years. All emails are strictly business-related, with no bulk sending or spam activity.

We have verified all authentication and authorization headers, and everything appears correct. The domain reputation is strong, and there is no malicious or suspicious content.

All DNS records (SPF, DKIM, DMARC, etc.) are properly configured and validated.

So far, our interactions have consisted mainly of repetitive exchanges with what appears to be Level 1 support, repeatedly requesting .eml files, without providing meaningful progress toward identifying or resolving the root cause.

Example:

X-MS-Exchange-Organization-SCL: 9

Any help would be greatly appreciated ..

1 answer

Your answer

Answer 1

Hi @Radu Groza

Thank you for posting your question in the Q&A Forum.

I understand the frustration, especially when your domain already has valid SPF, DKIM, and DMARC but messages still receive an SCL 9 verdict. These cases can be difficult to assess without visibility into the internal filtering signals that only Microsoft Support can review.

As this is a public community forum, moderators and community members don’t have access to Microsoft’s internal anti‑spam telemetry, so we can only provide general guidance. The detailed investigation will still need to continue through your existing support case.

To help provide clearer technical context, without assuming any specific cause, below are a few official Microsoft Learn references. These outlines describe how Microsoft 365 evaluates inbound mail and how false positives are typically reviewed:

Anti‑spam protection (EOP overview): Outlines how Microsoft 365 processes sender reputation and heuristics when classifying a message. Reference: Anti-spam protection in EOP | Microsoft Learn
Spoof Intelligence & Filtering: Explains how the system evaluates sender identity, which can sometimes influence a verdict even when standard authentication passes. Reference: Anti-spoofing protection in EOP | Microsoft Learn
Admin Submissions (False Positive Review): Explains the process for submitting samples to Microsoft to re-evaluate filtering decisions and improve accuracy. Reference: Admin Submissions overview | Microsoft Learn

Regarding the support process, providing Microsoft Support with full, unmodified .eml samples is part of the standard diagnostic workflow. These allow the engineering teams to correlate the headers with the exact filtering signals that were applied at the time of delivery.

If you’d like, you can share a sanitized header sample here (with any personal or private details removed), and the community can help interpret the visible authentication results. However, any changes to filtering behavior or overrides will still need to be handled through the official Support channel.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Radu Groza 5 Reputation points

2026-02-25T12:39:16.8133333+00:00

Hi ,

Thanks for answering. I've tried to post some headers here, but MS deleted the comment. Anyways, here's a pastebin link: <REMOVED>
Jade-T 10,785 Reputation points Microsoft External Staff Moderator

2026-02-25T13:44:04.93+00:00

Hi @Radu Groza

Thank you for sharing the message headers. Based on the X-Forefront-Antispam-Report field provided, we can interpret the visible anti-spam verdicts as follows:

SCL: 9: Indicates the message was assigned a High Confidence Spam verdict.

SFV: SPM: Confirms that the filtering engine categorized the message as spam.

CAT: HSPM: Stands for "High Confidence Spam," aligning with the SCL 9 score.

IPV: NLI: This status (IP Not Listed) generally indicates that the sending IP was not found on the service's internal reputation lists at the time of the connection.

SFS: These are internal Spam Filter Signatures representing the specific criteria the filtering engine used to reach its verdict.

As this is a public community forum, we do not have access to the internal definitions of the SFS signatures, or the telemetry required to see why they were triggered. These signals are proprietary and can only be analyzed by Microsoft’s internal engineering teams.

To move this forward, it is often necessary for the recipient or their Microsoft 365 admin to submit the message for review through the official Microsoft 365 Defender submission process. This allows the filtering team to analyze the specific message and determine if it is a false positive:

Admin Submissions: Administrators can submit samples via the Microsoft Defender portal: https://security.microsoft.com/reportsubmission

Support Case: You may consider ensuring these specific header details, especially the IPV: NLI and CAT: HSPM results, are included in your existing support case. Only Support can cross-reference these signatures with the backend logs.

As moderators, we don’t have access to internal filtering telemetry, so any adjustment to protection settings or global filter behavior must be handled through Support or the official review workflow.

Share via

Microsoft blocking all email from Google Workspace

1 answer

Your answer