What is graymail, and how is it different from spam?

Not everything clogging an inbox is spam. Much of it is mail people once signed up for: software newsletters, webinar invitations, supplier promotions, "your weekly summary" notifications. The industry term for it is graymail, and filters treat it differently from spam because it isn't unwanted by everyone.

This guide defines graymail, shows how Microsoft 365 and Gmail detect and sort it, and gives users and admins a clear way to deal with it.

What is graymail?

Graymail is bulk email from a legitimate sender that the recipient agreed to receive at some point, but may no longer want. Microsoft uses the same idea in its own documentation: "Messages from a bulk sender are known as bulk mail or gray mail" (Microsoft Learn).

Common examples:

• Newsletters from software vendors and industry groups.
• Retail and supplier promotions.
• Event and webinar invitations.
• Social network and app notifications.
• Automated reports nobody reads any more.

The problem is that it's personal. Microsoft puts it this way: "some users want bulk email messages (and in fact, they have deliberately signed up to receive them), while other users consider bulk email to be spam" (Microsoft Learn).

What is the difference between graymail, spam and phishing?

Microsoft defines spam as "an unsolicited and universally unwanted message" (Microsoft Learn). If you aren't sure which category a message is in, our guide on why an email landed in spam explains how to read the verdict.

How do filters detect bulk email?

Microsoft 365: the bulk complaint level

Microsoft 365 gives inbound mail from bulk senders a bulk complaint level (BCL), a score from 0 to 9 (Microsoft Learn). It appears as the BCL field in the X-Microsoft-Antispam header (Microsoft Learn):

Mail at or above the policy's bulk threshold gets the bulk action. The threshold is 7 in the default policy, 6 in the Standard preset and 5 in Strict. By default that action is the Junk Email folder, or quarantine in Strict. Our guide to spam scores compares BCL with other scores.

Gmail: inbox categories

Gmail sorts mail into tabs rather than scoring it publicly. Promotions holds "deals, offers, and other promotional emails", Social holds messages from social networks, Updates holds "automated confirmations, notifications, statements, and reminders", and Forums holds mailing lists (Gmail Help). Dragging a message to another tab teaches Gmail where similar mail belongs.

The headers that mark list mail

Legitimate bulk mail usually carries unsubscribe headers. RFC 2369 defines List-Unsubscribe, and RFC 8058 adds one-click unsubscribe. An example from a newsletter, with illustrative values:

List-Unsubscribe: <https://news.example.com/unsub/a1b2c3>, <mailto:unsub@news.example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
X-Microsoft-Antispam: BCL:5;

Gmail and other mail apps can use these headers to show their own Unsubscribe button. Paste a message's headers into the Email Header Analyzer to see them.

Why are senders being pushed to make graymail easier to leave?

Mailbox providers now require it. Google's email sender guidelines say that senders of more than 5,000 messages a day to Gmail accounts must support one-click unsubscribe for "marketing messages and subscribed messages" and "include a clearly visible unsubscribe link in the message body". They must also keep the spam rate reported in Postmaster Tools below 0.30%, and Google recommends staying below 0.10%.

That's good news for recipients: for most legitimate graymail, unsubscribing works and is safe. If you send newsletters yourself, our guides to one-click unsubscribe and the Gmail, Yahoo and Microsoft bulk sender rules cover what you must do, and the Bulk Sender Requirements Checker tests your domain.

How do I reduce graymail in Microsoft 365?

Admins have four levers, at the time of writing (October 2026):

1. Check the bulk threshold. In https://security.microsoft.com/antispam, each inbound policy has a Bulk email threshold slider. Lower numbers treat more mail as bulk. The bulk senders insight in the same place simulates how much mail each threshold would catch (Microsoft Learn).
2. Confirm bulk actions are on. The PowerShell-only MarkAsSpamBulkMail setting is On by default. If someone turned it off, BCL is stamped but no action is taken.
3. Turn on Bulk moves enabled. This delivers promotional bulk mail below the threshold to a Promotions folder in supported Outlook versions. Microsoft says that as of July 2026, bulk messages "that are promotional in nature" get the Promotions tag automatically. The setting is currently off in the Standard and Strict presets, so users covered by presets need a separate policy (Microsoft Learn).
4. Tell users to unsubscribe. Microsoft's own advice is easy to overlook: if the messages "are from reputable senders that pass spam filtering, have the user check for an unsubscribe option".

Don't push the threshold too low to cut clutter. Supplier notices and event confirmations are bulk mail too, and you'll create false positives. Our anti-spam policy guide covers the related settings.

How do I reduce graymail in Gmail and Google Workspace?

Gmail's tabs do most of the work. Users can:

• Keep the Promotions, Social and Updates tabs turned on, and drag misplaced messages between tabs.
• Use the Unsubscribe option Gmail shows next to the sender for list mail.
• Block a sender that won't stop; future messages go to Spam.

Admins can review spam settings in our Gmail spam settings guide. Gmail doesn't expose a bulk score you can tune the way Microsoft's BCL threshold works.

Should users unsubscribe or report graymail as spam?

Use this checklist:

1. Do you recognize the sender and remember signing up? Unsubscribe.
2. Is it a real company you never signed up with? Use its opt-out once. If it keeps coming, block it and report it as junk.
3. Is there no identifiable company, or does it look like a scam? Don't click anything. Report it as spam or phishing.
4. Do you want it, but not in the inbox? Use the Promotions folder or tab, or an inbox rule.

Reporting newsletters you signed up for as spam isn't ideal. Complaints feed sender reputation, which is what Google's 0.30% spam-rate limit measures. Our guide on whether it's safe to unsubscribe from spam covers the risky cases.

How can a business cut graymail at the source?

Most graymail arrives because someone signed up. A few habits stop it piling up in the first place:

• Use a role address for vendor portals and trials. Sign up for software trials, supplier portals and trade shows with an address such as purchasing@ or it@, routed to a shared mailbox, rather than a personal inbox.
• Untick marketing boxes. Event and download forms often pre-tick "send me updates". Clear them unless you want the newsletter.
• Unsubscribe when a project ends. When a trial, conference or supplier relationship is over, unsubscribe from its lists the same week.
• Clean up during offboarding. A leaver's mailbox keeps receiving every list they joined. Our employee offboarding guide covers what to do with it.
• Review automated reports. Scheduled reports from internal systems are graymail too. Ask owners once a year whether anyone still reads them.

None of this needs a filter. It's simply the cheapest way to keep inboxes readable.

When does an MX-level filter help with graymail?

Built-in tools are often enough for graymail: Microsoft's BCL threshold and Promotions folder, and Gmail's tabs. A filter at the MX level, which receives your mail before your mailbox does, adds most when you want one policy for every mailbox and alias, and want users to manage what's held without filing a ticket.

iBlockSpam gives every user a personal quarantine with scheduled digests (hourly, daily, a chosen weekday or custom), plus approved and blocked sender lists, so users can release a newsletter they want or leave the rest. See quarantine and digests for how it works, and pricing for per-domain plans.

Next steps

• Look up the BCL value in a few newsletters with the Email Header Analyzer to see how Microsoft scores your graymail.
• Review your bulk threshold and run the bulk senders insight before you change it.
• Ask staff to spend ten minutes unsubscribing from lists they no longer read.
• If you send newsletters, run the Bulk Sender Requirements Checker on your domain.
• If you want per-user quarantine digests across a whole domain, see iBlockSpam pricing.

Browse more email security basics.