# Legitimate email flagged as spam: why false positives happen and how to fix them safely

URL: https://iblockspam.com/blog/false-positives-legitimate-email-flagged
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Why real business email gets quarantined or junked, how to release it safely, and how to allowlist senders without opening a door for spoofed mail.

## Short answer

Release the single message first, then read its headers to find the cause: failed sender authentication, poor sender reputation, spam-like content, or your own routing confusing the filter. Fix the cause, or ask the sender to. Only allowlist a sender with verification turned on, so attackers can't spoof that address to skip filtering.

## Why does legitimate email get flagged as spam?

No spam filter is perfect. Filters weigh many signals, and real mail sometimes looks like spam on enough of them. If the mail is landing in Junk in Microsoft 365, see [why Microsoft 365 sends legitimate email to junk](https://iblockspam.com/blog/microsoft-365-emails-going-to-junk). The common causes:

| Cause | What you'll see | Whose fix |
|---|---|---|
| Sender's SPF, DKIM or DMARC fails | `spf=fail`, `dkim=fail` or `dmarc=fail` in Authentication-Results | Sender |
| Mail forwarded or sent via a mailing list | SPF fails; DKIM may fail if a footer was added | Usually nobody; allow with verification if needed |
| Sender's IP or domain has poor reputation | Blocklist or reputation notes in the filter's log | Sender |
| Content resembles spam | High spam score, URL or phrase hits | Sender, or a release |
| Blocked attachment type or Office macro | Quarantined for attachment policy | Your policy; adjust if the type is needed |
| Geographic filter | Blocked by country rule | Your policy |
| Your mailbox platform judges the gateway, not the sender | Lots of external mail junked after a gateway goes live | You (connector settings) |
| Double filtering | Mail passes the gateway, then the mailbox platform junks it | You |

## How do you handle a false positive, step by step?

1. **Find the message.** Check the user's personal quarantine, the admin quarantine and the mailbox's junk folder. Note the time, sender and subject.

2. **Read the verdict.** The quarantine entry or log says why it was held: spam score, policy rule, attachment type, authentication failure.

3. **Check the headers.** Paste them into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). Look at the `Authentication-Results` header ([RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html)) added by **your** gateway or mail platform. Did SPF, DKIM and DMARC pass for the From domain?

4. **Decide whether it's genuinely legitimate.** Did the user expect it? Does the sender's address exactly match the real one? Are the links going where they claim? A message that "looks like" a known supplier but fails DMARC may be the attack you were protected from.

5. **Release the single message.** If it's genuine, release it to the recipient. That fixes today's problem without changing future filtering.

6. **Fix the cause, if it's yours.** For example, allow an attachment type your business uses, adjust a geographic rule, or fix the connector settings described below.

7. **Tell the sender, if it's theirs.** Failing authentication or a poor reputation will hurt their delivery everywhere. Send them the relevant header lines.

8. **Allowlist only if it keeps happening, and only with verification.** See the next section.

9. **Review allowlist entries regularly.** Remove entries for suppliers you no longer use.

## Should you release the message or allowlist the sender?

These two actions solve different problems.

**Release** delivers one message that you've checked. The risk is limited to that message. It's the right default.

**Allowlisting** changes how every future message from that sender is treated. If the entry only matches the From address, it has a serious flaw: **the From address is trivial to forge**. An attacker who knows you allowlist `invoices@supplier.example` can put that address on a phishing message and it may skip spam checks.

Microsoft makes the same point in its [allowlist guidance](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365). It says never to create a rule with only the sender domain as the condition to skip spam filtering, because attackers can spoof the domain and skip filtering. It recommends adding a condition that the `Authentication-Results` header contains `dmarc=pass`, and warns against allowing domains you own or popular domains.

### Allowlisting with verification

A verified allowlist entry only applies when the message proves it came from the sender:

- The sender's domain passes DMARC, or
- SPF or DKIM passes for that exact domain, depending on how the filter defines verification.

A forged message fails verification and is filtered normally. The real sender gets through.

| Approach | Stops future false positives | Risk of spoofing bypass | Use when |
|---|---|---|---|
| Release one message | No | None beyond that message | Default for one-offs |
| Allowlist address, no verification | Yes | High | Avoid |
| Allowlist address or domain, with verification | Yes, if the sender authenticates | Low | Repeat false positives from a known sender |
| Allowlist IP range | Yes | Medium; shared IPs are risky | Fixed, dedicated sending servers only |
| Allowlist your own domain | — | Very high | Never |

### When the sender can't authenticate

Some small senders have no SPF or DKIM at all. Verification can't help them. Prefer releasing individual messages, ask them to fix their setup, and if you must allow them, use the narrowest rule you can: one address, not a whole domain, and never a free-mail domain like a public webmail service.

## What routine should your team follow?

False positives become a problem when nobody owns them. A light routine keeps them manageable:

1. **Users check their digest.** Ask everyone to skim their quarantine digest at whatever schedule suits them. Most false positives are spotted here first.
2. **Users report, admins decide.** Users can say "this was real". An admin decides whether to release only, fix a policy, or add a verified allowlist entry.
3. **Keep a short log.** Note the sender, the reason it was held, and what you did. Three entries for the same sender in a month is a pattern worth fixing at the source.
4. **Review allowlists quarterly.** Remove suppliers you no longer work with. Each allowlist entry is a small, permanent exception to your protection.
5. **Watch for "urgent" exceptions.** Requests to allowlist a sender because "the invoice is overdue" are a classic social-engineering pattern. Verify the request through a known phone number, not by replying to the email.

### Questions to ask before any allowlist entry

- Does the sender's mail pass DMARC? If so, a verified entry is safe to add.
- Is it an individual address or a whole domain? Prefer the narrowest match.
- Is the domain shared by many people, such as a free-mail or large platform domain? If so, don't allowlist it.
- Would a release plus a note to the sender fix this instead?

## Can a filtering gateway cause false positives?

If you put a filtering gateway in front of Microsoft 365 or Google Workspace and don't tell the mailbox platform about it, the platform sees all external mail arriving from the gateway's IP addresses. It may then decide that mail from your suppliers fails SPF or looks spoofed.

- **Microsoft 365:** use an inbound Partner connector and enable [Enhanced Filtering for Connectors](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors). Microsoft says this preserves the original source IP and reduces DMARC false positives. It also says to disable mail flow rules that set SCL to -1 for that connector once Enhanced Filtering is on.
- **Google Workspace:** list the gateway's addresses under [inbound gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway) settings.

## How iBlockSpam helps

Every iBlockSpam user gets a personal quarantine with scheduled digest emails (hourly, daily, a chosen weekday or custom), so people can see what was held for them. Admins get a domain-wide shared quarantine. Approved and blocked sender lists can require sender verification, so an allowlisted address can't simply be forged to skip filtering. Attachment-type, Office macro and geographic filters are settings you control. Our guided setup covers the Microsoft 365 Partner connector with Enhanced Filtering for Connectors, and the Google Workspace inbound gateway. No filter catches every spam message without ever flagging a real one; these tools make mistakes quick to find and safe to correct.

## Next steps

1. Open the held message's headers in the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and note the verdict and authentication results.
2. Ask the sender to check their domain with the [Email Health Check](https://iblockspam.com/tools/email-health-check) if SPF, DKIM or DMARC failed.
3. Prefer a narrow, verified allow entry over a broad one; see [allow and block lists](https://iblockspam.com/features/allow-block-lists).

Related: [why did this email land in spam?](https://iblockspam.com/blog/why-did-this-email-land-in-spam), [how to allow a sender in Microsoft 365 and Google Workspace](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) and [Outlook junk email filter settings](https://iblockspam.com/blog/outlook-junk-email-filter-settings).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Is it safe to allowlist a whole domain?

Only with verification. If the allowlist entry requires the message to pass authentication for that domain, a forged copy won't qualify. Without it, anyone can put that domain in From and skip filtering. Never allowlist your own domain or large free-mail domains.

### Should I ask the sender to fix something?

Often, yes. If their SPF, DKIM or DMARC fails, their mail will be flagged by many receivers, not just you. Send them the Authentication-Results line from the headers so they can see the problem.

### Why do all my external emails suddenly go to junk after adding a gateway?

Your mailbox platform is probably judging the gateway's IP address instead of the real sender's. In Microsoft 365, enable Enhanced Filtering for Connectors; in Google Workspace, configure the inbound gateway setting.

### Releasing a message: does it train the filter?

That depends on the filter. Release delivers the one message. Don't assume it changes future decisions. If the same sender keeps getting caught, investigate the cause rather than releasing every day.

## Sources

- [Microsoft Learn: Create allowlists (Defender for Office 365)](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)
- [Microsoft Learn: Quarantined email messages in EOP and Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
- [Google Workspace Admin Help: Set up an inbound mail gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)
- [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html)
- [RFC 9989: DMARC](https://www.rfc-editor.org/rfc/rfc9989.html)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/false-positives-legitimate-email-flagged (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt