Send & Receive Issues

How to Prevent Legitimate Emails from Being Quarantined as Bulk Spam in Microsoft 365

Algirdas Jasaitis Oct 16, 2026 868 views

Question details

The user needs to configure Microsoft 365 or Exchange to stop legitimate bulk emails from being intercepted and incorrectly sent to quarantine by spam filters.

How to Prevent Legitimate Emails from Being Quarantined as Bulk Spam in Microsoft 365

Product: Microsoft 365 / Exchange
Device & OS: not provided
Scenario: Administrators are configuring mail-flow transport rules to ensure trusted incoming bulk emails bypass spam filters and are successfully delivered to user inboxes.
Observed behavior: Legitimate bulk emails continue to be quarantined by the system, even when mail-flow rules explicitly set the Spam Confidence Level (SCL) to -1 to bypass spam filtering.

Before you start

Ensure you are logged in to your Microsoft 365 tenant with Global Administrator or Exchange Administrator privileges, as you will need access to the Microsoft 365 Defender portal and mail-flow settings.

Solution 1Recommended

Investigate Message Traces and Adjust Defender Policies

Use the Microsoft 365 Defender portal to trace the quarantined messages and verify why the SCL -1 rule was bypassed by other filtering mechanisms.

Spam filtering in Microsoft 365 evaluates multiple signals including sender reputation, authentication records (SPF, DKIM, DMARC), and Bulk Complaint Levels (BCL). Mail-flow rules that set the Spam Confidence Level (SCL) to -1 may not be sufficient if these additional security signals trigger a quarantine decision.

Run a Message Trace

Open the Exchange admin center, navigate to 'Mail flow' > 'Message trace', and start a trace for the affected sender to identify the exact filtering verdict and routing path.

Review Quarantine Details

Go to the Microsoft 365 Defender portal, navigate to 'Email & collaboration' > 'Review' > 'Quarantine', and carefully inspect the headers and reasons listed for the blocked emails.

Update Anti-Spam Policies

Under 'Email & collaboration' > 'Policies & rules' > 'Threat policies' > 'Anti-spam', adjust your bulk email threshold (BCL) settings or add the sender's domain or IP to the trusted allowed list.

Investigate Message Traces and Adjust Defender Policies

Authentication Matters: Ensure the sending domain has properly configured SPF, DKIM, and DMARC records, as strict email authentication failures will bypass allow rules.

Solution 2

Open a Microsoft Support Request

If legitimate emails are still being quarantined after policy adjustments, escalate the issue by opening a formal support ticket with Microsoft.

Free Microsoft Office alternative

Manage Your Documents Seamlessly with WPS Office

While Microsoft 365 manages your complex enterprise email routing and server security, you don't need an expensive subscription for powerful document editing. WPS Office provides a lightweight, free alternative for your daily word processing, spreadsheet, and presentation tasks.

1. Download the Application: Visit the official WPS Office website and download the free installer for your specific operating system (Windows, Mac, Linux, or Mobile).
2. Install the Suite: Run the downloaded installer and follow the quick on-screen prompts to set up the software on your device.
3. Edit Your Documents: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office files without losing any original formatting.

Fully compatible with Microsoft Office formats like .docx, .xlsx, and .pptxLightweight installation ensures fast launch times on any PC or mobile deviceAll-in-one suite with a familiar user interface for seamless migrationBuilt-in PDF editing, document conversion, and formatting tools

Frequently Asked Questions

Why is my SCL -1 transport rule not stopping legitimate emails from going to quarantine?

Microsoft 365 uses a multi-layered filtering approach. Even if a transport rule sets the Spam Confidence Level (SCL) to -1, the system also evaluates sender reputation, email authentication (SPF/DKIM), and Bulk Complaint Level (BCL) thresholds. If these other signals indicate a high risk, they can override your custom rule.

How can I manually release legitimate bulk emails from quarantine?

Administrators can access the Microsoft 365 Defender portal, navigate to 'Email & collaboration' > 'Review' > 'Quarantine', select the falsely flagged emails, and click 'Release message'. You can also choose to release the message and report it as a false positive to improve future filtering accuracy.

What is a Bulk Complaint Level (BCL) signal?

The Bulk Complaint Level (BCL) is a score assigned to bulk email senders based on their sending patterns and user complaint rates. A high BCL score indicates the sender is likely generating unwanted bulk email, which often causes the message to be quarantined regardless of standard spam rules.

Outlook & Email Problems