Legitimate email flagged as spam: why false positives happen and how to fix them safely

Why does legitimate email get flagged as spam?

No spam filter is perfect. Filters weigh many signals, and real mail sometimes looks like spam on enough of them. If the mail is landing in Junk in Microsoft 365, see why Microsoft 365 sends legitimate email to junk. The common causes:

How do you handle a false positive, step by step?

1. Find the message. Check the user's personal quarantine, the admin quarantine and the mailbox's junk folder. Note the time, sender and subject.

2. Read the verdict. The quarantine entry or log says why it was held: spam score, policy rule, attachment type, authentication failure.

3. Check the headers. Paste them into the Email Header Analyzer. Look at the Authentication-Results header (RFC 8601) added by your gateway or mail platform. Did SPF, DKIM and DMARC pass for the From domain?

4. Decide whether it's genuinely legitimate. Did the user expect it? Does the sender's address exactly match the real one? Are the links going where they claim? A message that "looks like" a known supplier but fails DMARC may be the attack you were protected from.

5. Release the single message. If it's genuine, release it to the recipient. That fixes today's problem without changing future filtering.

6. Fix the cause, if it's yours. For example, allow an attachment type your business uses, adjust a geographic rule, or fix the connector settings described below.

7. Tell the sender, if it's theirs. Failing authentication or a poor reputation will hurt their delivery everywhere. Send them the relevant header lines.

8. Allowlist only if it keeps happening, and only with verification. See the next section.

9. Review allowlist entries regularly. Remove entries for suppliers you no longer use.

Should you release the message or allowlist the sender?

These two actions solve different problems.

Release delivers one message that you've checked. The risk is limited to that message. It's the right default.

Allowlisting changes how every future message from that sender is treated. If the entry only matches the From address, it has a serious flaw: the From address is trivial to forge. An attacker who knows you allowlist invoices@supplier.example can put that address on a phishing message and it may skip spam checks.

Microsoft makes the same point in its allowlist guidance. It says never to create a rule with only the sender domain as the condition to skip spam filtering, because attackers can spoof the domain and skip filtering. It recommends adding a condition that the Authentication-Results header contains dmarc=pass, and warns against allowing domains you own or popular domains.

Allowlisting with verification

A verified allowlist entry only applies when the message proves it came from the sender:

• The sender's domain passes DMARC, or
• SPF or DKIM passes for that exact domain, depending on how the filter defines verification.

A forged message fails verification and is filtered normally. The real sender gets through.

When the sender can't authenticate

Some small senders have no SPF or DKIM at all. Verification can't help them. Prefer releasing individual messages, ask them to fix their setup, and if you must allow them, use the narrowest rule you can: one address, not a whole domain, and never a free-mail domain like a public webmail service.

What routine should your team follow?

False positives become a problem when nobody owns them. A light routine keeps them manageable:

1. Users check their digest. Ask everyone to skim their quarantine digest at whatever schedule suits them. Most false positives are spotted here first.
2. Users report, admins decide. Users can say "this was real". An admin decides whether to release only, fix a policy, or add a verified allowlist entry.
3. Keep a short log. Note the sender, the reason it was held, and what you did. Three entries for the same sender in a month is a pattern worth fixing at the source.
4. Review allowlists quarterly. Remove suppliers you no longer work with. Each allowlist entry is a small, permanent exception to your protection.
5. Watch for "urgent" exceptions. Requests to allowlist a sender because "the invoice is overdue" are a classic social-engineering pattern. Verify the request through a known phone number, not by replying to the email.

Questions to ask before any allowlist entry

• Does the sender's mail pass DMARC? If so, a verified entry is safe to add.
• Is it an individual address or a whole domain? Prefer the narrowest match.
• Is the domain shared by many people, such as a free-mail or large platform domain? If so, don't allowlist it.
• Would a release plus a note to the sender fix this instead?

Can a filtering gateway cause false positives?

If you put a filtering gateway in front of Microsoft 365 or Google Workspace and don't tell the mailbox platform about it, the platform sees all external mail arriving from the gateway's IP addresses. It may then decide that mail from your suppliers fails SPF or looks spoofed.

• Microsoft 365: use an inbound Partner connector and enable Enhanced Filtering for Connectors. Microsoft says this preserves the original source IP and reduces DMARC false positives. It also says to disable mail flow rules that set SCL to -1 for that connector once Enhanced Filtering is on.
• Google Workspace: list the gateway's addresses under inbound gateway settings.

How iBlockSpam helps

Every iBlockSpam user gets a personal quarantine with scheduled digest emails (hourly, daily, a chosen weekday or custom), so people can see what was held for them. Admins get a domain-wide shared quarantine. Approved and blocked sender lists can require sender verification, so an allowlisted address can't simply be forged to skip filtering. Attachment-type, Office macro and geographic filters are settings you control. Our guided setup covers the Microsoft 365 Partner connector with Enhanced Filtering for Connectors, and the Google Workspace inbound gateway. No filter catches every spam message without ever flagging a real one; these tools make mistakes quick to find and safe to correct.

Next steps

1. Open the held message's headers in the free Email Header Analyzer and note the verdict and authentication results.
2. Ask the sender to check their domain with the Email Health Check if SPF, DKIM or DMARC failed.
3. Prefer a narrow, verified allow entry over a broad one; see allow and block lists.

Related: why did this email land in spam?, how to allow a sender in Microsoft 365 and Google Workspace and Outlook junk email filter settings.

Browse more guides on running email day to day.