Why Microsoft 365 Marks Legitimate Emails as Spam and How to Fix It
Question details
Users need to understand why legitimate emails are incorrectly classified as spam by Microsoft 365 and how to ensure proper delivery.
- Product
- Microsoft 365 / Exchange Online
- Device & OS
- not provided
- Scenario
- Receiving important, legitimate emails that are incorrectly filtered into the junk or spam folder.
- Observed behavior
- Microsoft 365 classifies the message as spam, assigning an Exchange Online Protection Spam Confidence Level (SCL) of 5 or 6 and a verdict of SFV:SPM in the headers, without explicitly stating the exact cause.
Ensure you have access to the original email message headers for analysis and verify that you have administrator privileges in the Exchange Admin Center if you need to adjust organization-wide spam policies.
Submit Message for Analysis and Whitelist the Sender
Report the false positive to Microsoft for a long-term fix and temporarily add the sender to your allowed list to guarantee immediate email delivery.
Because header values like SCL:5 or SFV:SPM do not pinpoint a specific issue (such as an IP blacklist or poor domain reputation), submitting the message directly to Microsoft helps improve their spam filters for your tenant.
Locate the false positive email in your Junk folder and use the 'Report Message' add-in to report it as 'Not Junk', or submit it directly through the Microsoft 365 Defender portal.
Log in to the Microsoft 365 admin center with administrator credentials and navigate to the Exchange Admin Center.
Go to Policies & Rules, select Threat Policies, and then click on Anti-spam.
Edit your active 'Anti-spam inbound policy', scroll to the 'Allowed and blocked senders and domains' section, and add the trusted sender's email address or domain.
Review Sender Authentication and Reputation
Investigate the sender's domain configuration to identify missing or failing email authentication protocols that trigger the spam filter.
Looking for a Hassle-Free Office Suite? Try WPS Office
While you troubleshoot your Microsoft 365 email delivery issues, consider WPS Office for your daily document productivity. It is a lightweight, full-featured alternative to Microsoft Office that lets you manage documents, spreadsheets, and presentations seamlessly.
- 1. Download the installer: Visit the official WPS Office website to download the free installation package for your operating system.
- 2. Install the software: Run the downloaded installer and follow the simple on-screen instructions to set up WPS Office on your device.
- 3. Open existing documents: Launch WPS Office and open your existing Microsoft Office files with perfect formatting preservation.
Frequently Asked Questions
What does SCL 5 or 6 mean in Microsoft 365?
SCL stands for Spam Confidence Level. A score of 5 or 6 indicates that Exchange Online Protection suspects the email is spam and typically routes it to the user's Junk Email folder by default.
How can I check the SCL score of an email?
You can find the SCL score by viewing the email's internet headers (usually via File > Properties in Outlook desktop) and searching for the line that begins with 'X-MS-Exchange-Organization-SCL:' or simply 'SCL:'.
What does SFV:SPM stand for in an email header?
SFV:SPM stands for Spam Filtering Verdict: Spam. It means that the content filtering policies applied by Exchange Online Protection have evaluated the message and flagged it as spam.
Why would an email from a trusted partner suddenly go to spam?
This can happen if the partner recently changed their email server, misconfigured their SPF, DKIM, or DMARC authentication records, or if their sending IP address was temporarily placed on an industry blacklist.
