Security Policy Errors

Fix Office 365 Marking Authenticated Business Emails as Spam

Maira Mehtab Oct 26, 2026 870 views

Question details

Business emails are incorrectly classified as spam in Microsoft Defender for Office 365 even though they pass all standard email authentication checks.

How to Fix Office 365 Marking Authenticated Emails as Spam

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Sending standard business communications to recipients hosted on Microsoft Office 365.
Observed behavior: Messages successfully pass SPF, DKIM, DMARC, and composite authentication, but still receive a Spam Confidence Level (SCL) of 5 and are routed to the junk folder.

Before you start

Obtain a copy of the original email's message header from the recipient's junk folder to analyze the exact Spam Confidence Level (SCL) and verify that no malicious links or flagged keywords triggered the content filter.

Solution 1Recommended

Review Microsoft Defender Anti-Spam Policies

Check if the sender's domain or IP address has been inadvertently added to a blocked list in your organization's anti-spam settings.

Even when authentication passes, localized tenant settings can override global Microsoft rules. Ensure the sender is not on a local block list and consider adding them to the Tenant Allow/Block List if they are a trusted partner.

Access Defender Portal

Navigate to the Microsoft 365 Defender portal and log in with admin credentials.

Locate Anti-spam Policies

Go to Policies & rules > Threat policies > Anti-spam.

Edit Inbound Policy

Open the 'Anti-spam inbound policy (Default)' or your organization's custom inbound policy.

Check Blocked Senders

Scroll to the 'Allowed and blocked senders and domains' section and click 'Edit'.

Adjust Settings

Verify that the sending domain or email address is not listed under blocked senders. If necessary, add the sender to the allowed list for testing purposes.

Review Microsoft Defender Anti-Spam Policies

Solution 2

Create a Narrowly Scoped Mail Flow Rule

Use the Exchange Admin Center to create a rule that sets the SCL to a safe level for specific, trusted business communications.

Free Microsoft Office alternative

Experience Seamless Document Creation with WPS Office

While resolving complex Exchange Server and Office 365 routing rules, you may want a reliable, lightweight alternative for your daily document needs. WPS Office provides an all-in-one suite for Word, Excel, and PowerPoint files without the heavy subscription costs.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the Suite: Run the downloaded setup file and follow the on-screen prompts to complete the installation in seconds.
3. Open Your Documents: Launch WPS Office and directly open any existing Microsoft Word, Excel, or PowerPoint files with perfect formatting preservation.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Lightweight design ensures fast loading and smooth performance on any device.Free to use with a familiar, easy-to-navigate tabbed interface.Includes a built-in PDF editor to handle business documents effortlessly.

microsoft office alternative - wps office

Frequently Asked Questions

What does a Spam Confidence Level (SCL) of 5 mean?

An SCL of 5 or 6 indicates that Microsoft Exchange considers the message to be suspected spam. These messages are typically delivered to the recipient's Junk Email folder by default instead of the primary inbox.

Why does my email go to spam if it passes DMARC, SPF, and DKIM?

Email authentication protocols (DMARC, SPF, DKIM) verify the sender's identity, but they do not guarantee inbox delivery. Content filters may still flag emails as spam if they contain suspicious links, poorly formatted HTML, spam-trigger keywords, or if the sending IP address has a poor reputation.

Is it safe to whitelist an entire domain in Microsoft Defender?

Whitelisting entire domains is generally discouraged. If an external trusted domain is compromised, attackers can bypass your filters and send malicious emails directly to your users' inboxes. It is safer to use the Tenant Allow/Block List for specific sender addresses or use closely monitored IP-based mail flow rules.

Microsoft Office Security Issues