Security Policy Errors

How to Test Microsoft 365 Spam Filtering Safely

Partner Editor Oct 10, 2026 868 views

Question details

The user needs to safely test how Microsoft 365 Exchange Online Protection (EOP) classifies messages and evaluates the Spam Confidence Level (SCL) without affecting real users.

How to Test Microsoft 365 Spam Filtering Safely

Product: Microsoft 365
Device & OS: not provided
Scenario: Testing email security and spam filtering rules safely.
Observed behavior: The user wants to verify message classification and inspect spam confidence levels in received message headers through controlled testing.

Before you start

Ensure you have created a dedicated test mailbox in your Microsoft 365 admin center to prevent test spam from reaching actual users and triggering false security alerts.

Solution 1Recommended

Test Spam Filtering Using the GTUBE String

Use the industry-standard GTUBE string to trigger a guaranteed spam classification in Exchange Online Protection.

The GTUBE (Generic Test for Unsolicited Bulk Email) string is universally recognized by spam filters, including Exchange Online Protection. When included in an email, it forces the system to assign a high Spam Confidence Level (SCL) so you can verify your routing and quarantine policies.

Compose a test email

Open an external email client (e.g., a personal Gmail or Yahoo account) and create a new email.

Address the email

Enter the email address of your dedicated Microsoft 365 test mailbox in the 'To' field.

Insert the GTUBE string

Paste the exact GTUBE string into the body of the message: XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

Send and verify

Send the email. Log into your Microsoft 365 test mailbox and check if the email was correctly routed to the Junk Email folder or quarantine based on your organization's anti-spam policies.

Inspect message headers

Open the delivered message, view the internet headers, and look for the 'X-MS-Exchange-Organization-SCL' header to confirm the spam confidence level assigned by EOP.

Test Spam Filtering Using the GTUBE String

Standardized Testing: Using the GTUBE string is the safest and most reliable way to verify your EOP settings because it guarantees a high-confidence spam classification without relying on unpredictable content heuristics.

Solution 2

Send Realistic Test Messages with Spam Characteristics

Manually craft emails with spam-like elements to test how content filtering and machine learning evaluate different triggers.

Free Microsoft Office alternative

Looking for a Lightweight Alternative for Your Office Needs?

While you manage Exchange Online Protection and security policies, you might also be looking for a cost-effective suite for your documents, spreadsheets, and presentations. WPS Office offers powerful productivity tools with full compatibility for Microsoft Office formats at no cost.

1. Download the installer: Visit the official WPS Office website and click the free download button.
2. Install the software: Run the downloaded installer and follow the on-screen instructions to complete the setup.
3. Open your documents: Launch WPS Office and seamlessly open any existing Microsoft Office files to start editing immediately.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Free, lightweight software with fast installation and low system requirementsFamiliar user interface requiring no steep learning curveBuilt-in PDF editing, conversion, and annotation tools

microsoft office alternative - wps office

Frequently Asked Questions

What does Spam Confidence Level (SCL) mean in Microsoft 365?

SCL is a number ranging from -1 to 9 that Exchange Online Protection assigns to an incoming email. Higher numbers indicate a greater likelihood that the message is spam, with an SCL of 9 representing high-confidence spam.

Where can I find the SCL in a received email?

You can find the SCL by viewing the message headers in your email client (e.g., Outlook). Look for the specific header labeled 'X-MS-Exchange-Organization-SCL' to see the numerical value assigned by the filter.

Why shouldn't I test spam filtering on real user accounts?

Testing on real users can disrupt their daily workflow, trigger false security alerts to administrators, and potentially skew the machine learning models that analyze typical user email patterns.

Does the GTUBE string test phishing filters as well?

No, the GTUBE string is specifically designed to trigger spam filters. To safely test anti-phishing policies, Microsoft recommends using the Attack Simulation Training feature available in Microsoft 365 Defender.

Microsoft Office Security Issues