Why Emails Marked as Spam Reach Your Inbox in Microsoft 365
Question details
The user needs to understand why certain emails that are flagged as spam are still being successfully delivered to their mailbox, sometimes without their email address appearing in the To or Cc fields.
- Product
- Microsoft 365 / Exchange Online
- Device & OS
- not provided
- Scenario
- Investigating the unexpected inbox delivery of emails that should have been filtered as spam.
- Observed behavior
- Message trace results indicate the email was filtered as spam, yet the message bypassed the Junk Email folder or quarantine and was delivered directly to the user's inbox.
Ensure you have administrative access to the Microsoft 365 Exchange Admin Center, as running an extended message trace requires specific administrator permissions.
Run and Analyze an Extended Message Trace
Running an extended message trace in the Exchange Admin Center allows you to see the exact routing, rules, and filtering steps an email went through.
An extended message trace provides deep insights into envelope recipients, forwarding rules, transport rules, distribution groups, and specific spam-filter actions that may have caused the message to bypass standard junk filtering.
Log in to the Microsoft 365 Defender portal or Exchange Admin Center using your global or Exchange administrator credentials.
Go to the 'Mail flow' section in the left navigation menu and select 'Message trace'.
Click 'Start a trace' and enter the specific parameters matching the spam email, such as the sender address, recipient address, and the exact time range of delivery.
Under 'Report type', select the 'Extended report' option. Enter the email address where the generated CSV report should be sent, then click 'Search' or 'Submit'.
Once you receive the report, open the CSV file and review the routing events. Look specifically for transport rules setting the Spam Confidence Level (SCL) to -1, safe sender lists, or hidden distribution group forwarding that allowed the email through.
Boost Your Productivity with WPS Office
Dealing with complex email server configurations and spam filters can be exhausting. When it's time to get back to writing documents, analyzing data, or designing presentations, try WPS Office. It's a free, lightweight, and highly compatible alternative to Microsoft Office that lets you work seamlessly.
- 1. Download the Installer: Visit the official WPS Office website and click the 'Download' button to get the latest version.
- 2. Install the Suite: Run the downloaded installer file and follow the simple on-screen instructions to set up the software.
- 3. Open Your Files: Launch WPS Office and directly open your existing Microsoft Word, Excel, or PowerPoint files without losing any formatting.
Frequently Asked Questions
Why am I receiving spam emails where I am not in the To or Cc fields?
Spammers often use 'Bcc' (Blind Carbon Copy) or manipulate the 'envelope sender' and 'envelope recipient' headers. Your email address was likely included in the hidden envelope routing information, even if it doesn't appear in the visible message headers.
Can transport rules override Microsoft 365 spam filters?
Yes. If an Exchange administrator has set up a mail flow rule (transport rule) that bypasses spam filtering or sets the Spam Confidence Level (SCL) to -1, the email will be delivered to the inbox regardless of Microsoft's spam assessment.
What should I do if a legitimate email is consistently marked as spam?
You can add the sender's email address or domain to your Safe Senders list in Outlook. Alternatively, your IT administrator can adjust anti-spam policies in the Microsoft 365 Defender portal to safely whitelist the sender for the entire organization.
How long does it take to generate an extended message trace?
Extended message traces are processed in the background by Exchange Online and can take anywhere from a few minutes to several hours to generate, depending on the server load and the size of the time range specified.
