Security Policy Errors

How to Test Advanced Anti-Spam Inbound Policies in Microsoft 365

John Wilson Oct 23, 2026 868 views

Question details

The user needs to reliably test advanced anti-spam settings, including rules for empty messages, SPF hard fails, and nonstandard URL ports.

How to Test Advanced Anti-Spam Inbound Policies Correctly

Product: Microsoft 365 / Microsoft Defender
Device & OS: not provided
Scenario: Testing new or updated anti-spam inbound policies to ensure malicious or non-compliant emails are correctly filtered.
Observed behavior: Test messages are bypassing the newly configured policies and still reaching the inbox, likely due to propagation delays or incorrect priority settings.

Before you start

Ensure you have global administrator or security administrator privileges in your Microsoft 365 tenant, and allow up to 1-2 hours for new policy changes to fully propagate before sending test messages.

Solution 1Recommended

Verify and Test Anti-Spam Policies via Microsoft Defender Portal

Use the Microsoft Defender portal to review your anti-spam inbound policies, check rule priorities, and validate settings.

Microsoft Defender allows administrators to configure Advanced Spam Filter (ASF) settings. When testing specific triggers like port 811 URLs or SPF failures, it is crucial to ensure that the policy applied has the highest priority and that no bypass rules (like Safe Senders) are overriding the spam filter.

Navigate to Threat Policies

Log into the Microsoft Defender portal, go to Email & collaboration in the left navigation menu, and select Policies & rules, then Threat policies.

Access Anti-Spam Settings

Click on Anti-spam to view your list of inbound, outbound, and connection filter policies.

Check Policy Priority

Ensure your custom inbound policy has a priority of 0 (or a lower number than the default policy). Higher priority policies are processed first.

Send a Trigger Test Email

From an external, non-whitelisted email account, send a test email containing your specific trigger, such as an empty body or a URL containing a nonstandard port like http://example.com:811.

Run a Message Trace

Open the Exchange admin center, navigate to Mail flow > Message trace, and trace your test email to verify which anti-spam policy was applied and the resulting Spam Confidence Level (SCL).

Verify and Test Anti-Spam Policies via Microsoft Defender Portal

Propagation Time: Policy changes in Microsoft 365 may take some time to take effect across all datacenters. Always wait before concluding that a policy configuration has failed.

Solution 2

Review Spam Policies Using Exchange Online PowerShell

Connect to Exchange Online via PowerShell to quickly list and verify the exact configurations of your anti-spam inbound policies.

Free Microsoft Office alternative

Switch to WPS Office for a Seamless, Lightweight Productivity Experience

While Microsoft 365 handles complex enterprise email routing and anti-spam policies, for daily document creation, spreadsheet management, and presentation design, WPS Office provides a robust, free, and highly compatible alternative. Enjoy all the essential office tools without the heavy administrative overhead.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install WPS Office: Run the setup file and follow the quick installation prompts to deploy the lightweight office suite on your computer.
3. Edit Your Office Files: Launch WPS Office to instantly open and seamlessly edit your existing Microsoft Office documents without format changes.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation with a clean, familiar tabbed user interface.Built-in PDF editing, conversion, and annotation tools.Free to use with comprehensive document productivity features perfectly suited for standard office work.

microsoft office alternative - wps office

Frequently Asked Questions

Why do my test spam messages still reach the inbox?

This usually happens because the newly created anti-spam policy has not fully propagated across Microsoft's servers, or a higher-priority rule (like a safe sender list or an Exchange mail flow rule) is bypassing the spam filter entirely.

How can I test an SPF hard fail in Microsoft 365?

You can test an SPF hard fail by sending an email from an external domain that you control, intentionally modifying its DNS SPF record to exclude the sending IP address. This triggers an SPF failure during the Microsoft 365 inbound connection check.

Can I block specific nonstandard URL ports in anti-spam policies?

Yes, Advanced Spam Filtering (ASF) settings allow you to increase the spam score of emails that contain URLs redirecting to nonstandard ports (like port 811), though Microsoft generally recommends utilizing modern URL protection features like Safe Links instead.

How do I check which spam policy caught my test email?

You can use the Message Trace feature in the Exchange Admin Center or look at the delivered email's message headers (specifically the X-Forefront-Antispam-Report header) to identify the specific policy and Spam Confidence Level (SCL) applied.

Microsoft Office Security Issues