Why are legitimate emails going to Junk in Microsoft 365, and how do you fix it?

When a supplier's invoice or a customer's reply lands in Junk, people lose a day before anyone notices. In Microsoft 365, the Junk Email folder is filled by several different mechanisms, and each one has a different fix.

This guide shows how to work out which one moved the message, then how to fix it without opening a hole for spam.

What decides whether an email goes to Junk in Microsoft 365?

Four things can put a message in the Junk Email folder:

1. The tenant's anti-spam policy. When filtering decides a message is spam, bulk or phishing, the policy action is often Move message to Junk Email folder. That's the default action for spam, high confidence spam, phishing and bulk in the default anti-spam policy (Microsoft Learn).
2. The user's own lists. Each mailbox has a Safe Senders list, a Safe Recipients list and a Blocked Senders list. Mail from a blocked sender is treated as spam.
3. Outlook's own filter. Outlook desktop has a client-side Junk Email Filter. At Low or High, it uses its own filtering, separate from the service's verdict (Microsoft Learn).
4. Zero-hour auto purge (ZAP). A message delivered to the Inbox can be moved to Junk later if a new verdict says it's spam.

The quickest way to tell these apart is the message header.

How do you read the headers of a message in Junk?

Open the message and get its full headers. In Outlook desktop, select File > Properties and copy the Internet headers box. In Outlook on the web, select ... > View > View message details (Microsoft Learn). Paste them into our Email Header Analyzer.

Then check three headers (Microsoft Learn):

Don't rely on the SCL number. Microsoft says that in cloud organizations the SCL value "doesn't determine whether spam filtering identifies a message as Spam or High confidence spam," and points to the CAT and DIR fields instead (Microsoft Learn).

Our guide to why an email landed in spam covers the same diagnosis across other providers.

Is the sender's authentication the real problem?

Very often, yes. Microsoft records SPF, DKIM, DMARC and a composite result in Authentication-Results. The compauth reason code explains failures:

• 000: explicit failure. The message failed DMARC and the sender's policy is p=quarantine or p=reject.
• 001: implicit failure. The sender has no authentication records, or only weak ones such as SPF ~all or DMARC p=none.
• 010: the message failed DMARC, the policy is p=quarantine or p=reject, and it claims to come from one of your own accepted domains.

If you see these, the clean fix is at the sender's end. Send them the header results and point them to their SPF, DKIM and DMARC records. They can check their setup with our SPF Checker, DKIM Checker and DMARC Checker. Our guide to SPF, DKIM and DMARC explains how the three fit together.

A common trap is a third-party platform, such as a billing or ticketing system, sending as the sender's domain without DKIM signing for it. Microsoft sees mail that claims to be from supplier.example but isn't authenticated as such, and spoof intelligence acts on it.

When you can't wait for the sender

If the sender can't fix it quickly and the mail is genuinely needed, create an allow entry for the spoofed sender pair in the Tenant Allow/Block List. Go to Email & collaboration > Policies & rules > Threat policies > Tenant Allow/Block Lists in the Rules section, then the Spoofed senders tab. These entries cover the specific domain and sending infrastructure pair, but Microsoft notes they never expire, so note why you added them and review them (Microsoft Learn).

Are the user's own junk settings to blame?

If the header shows SFV:BLK, the user blocked the sender, often by accident. Reporting a message as junk with Outlook's Report button moves it to Junk and adds the sender to the user's Blocked Senders list (Microsoft Learn).

The user can remove the entry in Outlook's junk settings. As an admin, you can do it in Exchange Online PowerShell:

Set-MailboxJunkEmailConfiguration "Ori Epstein" -BlockedSendersAndDomains @{Remove="supplier.example"}
Get-MailboxJunkEmailConfiguration -Identity "Ori Epstein" | Format-List trusted*,contacts*,blocked*

Microsoft also shows how to remove one blocked domain from every mailbox at once, which is handy after a mistaken company-wide report (Microsoft Learn).

Outlook's client-side filter

If the header says SFV:NSPM (not spam) but the message still ended up in Junk, look at Outlook desktop. Microsoft recommends leaving the Junk Email Filter at No automatic filtering in Microsoft 365, "to prevent unnecessary conflicts (both positive and negative) with the spam filtering verdicts." The Safe and Blocked Senders lists still apply at that level. Also check the user's Inbox rules.

Is the message being treated as bulk mail?

Newsletters, event invitations and marketing from suppliers are often caught as bulk. Microsoft scores each bulk message with a bulk complaint level (BCL) from 0 to 9, shown in the X-Microsoft-Antispam header (Microsoft Learn):

The default anti-spam policy acts on BCL 7 and above. Standard uses 6, Strict 5. For a single wanted newsletter, have the user report it as Not junk. Adjust the threshold only if many wanted senders are affected, and use the bulk senders insight in the policy to see the effect before you change it.

How do you allow a sender safely?

If the sender passes authentication and Microsoft still junks their mail, an allow entry is reasonable. Microsoft's preferred method is the Tenant Allow/Block List, not anti-spam policy allow lists or broad transport rules (Microsoft Learn).

1. In the Defender portal, go to Actions & submissions > Submissions (https://security.microsoft.com/reportsubmission).
2. On the Emails tab, select Submit to Microsoft for analysis, add the network message ID or upload the .eml file, and choose the affected recipient.
3. Select I've confirmed it's clean, then Allow this message. The allow entry is removed 45 days after last used date by default (Microsoft Learn).
4. Allow a single address rather than a whole domain wherever possible.

Avoid three shortcuts:

• Allowed domains in anti-spam policies. Microsoft says these bypass spam, spoof and phishing protection and sender authentication, and should be avoided "if at all possible."
• A transport rule that sets SCL -1 on the sender domain alone. Microsoft warns this "significantly" increases the chance of spoofing. If you must use a rule, require dmarc=pass in Authentication-Results.
• Telling every user to add Safe Senders. It's per mailbox, hard to audit, and Microsoft calls it high risk.

Our guide to whitelisting senders safely goes into each option.

What if everything external suddenly goes to Junk?

If many unrelated senders land in Junk at once, look for a change in your mail path rather than at each sender. The usual cause is a filtering gateway in front of Microsoft 365 without Enhanced Filtering for Connectors, so Microsoft sees the gateway as the sender and authentication checks fail. Our Enhanced Filtering guide explains the fix. If wanted mail is in quarantine rather than Junk, see how to release quarantined email.

Next steps

1. Take one misfiled message, read its SFV, CAT, BCL and compauth values, and match them to the table above.
2. If authentication failed, send the sender the header results and our SPF Checker link.
3. Set Outlook desktop's Junk Email Filter to No automatic filtering by Group Policy.
4. Replace any domain-wide allow entries with Tenant Allow/Block List entries for single addresses.
5. Read our guide to false positives for a repeatable triage process.

Related: Outlook junk email filter settings covers the per-user side of the same problem.

Browse more guides on running email day to day.