# Why are legitimate emails going to Junk in Microsoft 365, and how do you fix it?

URL: https://iblockspam.com/blog/microsoft-365-emails-going-to-junk
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Why legitimate email lands in Junk in Outlook and Microsoft 365: user lists, bulk scores, spoof checks and sender authentication. Diagnose from headers and fix.

## Short answer

Good mail lands in Junk in Microsoft 365 for one of four reasons: the user blocked the sender, the message scored as bulk, spoof or spam filtering flagged it, or the sender failed SPF, DKIM or DMARC. Read the X-Forefront-Antispam-Report and Authentication-Results headers to tell which, then fix the cause instead of adding broad allow entries.

When a supplier's invoice or a customer's reply lands in Junk, people lose a day before anyone notices. In Microsoft 365, the Junk Email folder is filled by several different mechanisms, and each one has a different fix.

This guide shows how to work out which one moved the message, then how to fix it without opening a hole for spam.

## What decides whether an email goes to Junk in Microsoft 365?

Four things can put a message in the Junk Email folder:

1. **The tenant's anti-spam policy.** When filtering decides a message is spam, bulk or phishing, the policy action is often **Move message to Junk Email folder**. That's the default action for spam, high confidence spam, phishing and bulk in the default anti-spam policy ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)).
2. **The user's own lists.** Each mailbox has a Safe Senders list, a Safe Recipients list and a Blocked Senders list. Mail from a blocked sender is treated as spam.
3. **Outlook's own filter.** Outlook desktop has a client-side Junk Email Filter. At **Low** or **High**, it uses its own filtering, separate from the service's verdict ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)).
4. **Zero-hour auto purge (ZAP).** A message delivered to the Inbox can be moved to Junk later if a new verdict says it's spam.

The quickest way to tell these apart is the message header.

## How do you read the headers of a message in Junk?

Open the message and get its full headers. In Outlook desktop, select **File** > **Properties** and copy the **Internet headers** box. In Outlook on the web, select **...** > **View** > **View message details** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting)). Paste them into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).

Then check three headers ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)):

| Header and value | What it tells you | Likely fix |
|---|---|---|
| `X-Forefront-Antispam-Report: SFV:BLK` | Sender is on the user's Blocked Senders list | Remove the entry |
| `SFV:SPM` with `CAT:SPM` or `CAT:HSPM` | Filtering judged it spam | Check authentication, then report it |
| `SRV:BULK`, plus `BCL` in `X-Microsoft-Antispam` | Treated as bulk at your BCL threshold | Report as not junk; review threshold |
| `CAT:SPOOF` | Spoof intelligence flagged the From domain | Sender fixes authentication, or an allow spoofed sender entry |
| `SFV:NSPM` but still in Junk | The service said not spam | Outlook's client filter or an Inbox rule moved it |
| `compauth=fail` in `Authentication-Results` | Microsoft's composite authentication failed | Sender fixes SPF, DKIM or DMARC |

Don't rely on the `SCL` number. Microsoft says that in cloud organizations the SCL value "doesn't determine whether spam filtering identifies a message as Spam or High confidence spam," and points to the `CAT` and `DIR` fields instead ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)).

Our guide to [why an email landed in spam](https://iblockspam.com/blog/why-did-this-email-land-in-spam) covers the same diagnosis across other providers.

## Is the sender's authentication the real problem?

Very often, yes. Microsoft records SPF, DKIM, DMARC and a composite result in `Authentication-Results`. The `compauth` reason code explains failures:

- **000**: explicit failure. The message failed DMARC and the sender's policy is `p=quarantine` or `p=reject`.
- **001**: implicit failure. The sender has no authentication records, or only weak ones such as SPF `~all` or DMARC `p=none`.
- **010**: the message failed DMARC, the policy is `p=quarantine` or `p=reject`, and it claims to come from one of your own accepted domains.

If you see these, the clean fix is at the sender's end. Send them the header results and point them to their SPF, DKIM and DMARC records. They can check their setup with our [SPF Checker](https://iblockspam.com/tools/spf-checker), [DKIM Checker](https://iblockspam.com/tools/dkim-checker) and [DMARC Checker](https://iblockspam.com/tools/dmarc-checker). Our guide to [SPF, DKIM and DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc) explains how the three fit together.

A common trap is a third-party platform, such as a billing or ticketing system, sending as the sender's domain without DKIM signing for it. Microsoft sees mail that claims to be from `supplier.example` but isn't authenticated as such, and spoof intelligence acts on it.

### When you can't wait for the sender

If the sender can't fix it quickly and the mail is genuinely needed, create an allow entry for the **spoofed sender** pair in the Tenant Allow/Block List. Go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Tenant Allow/Block Lists** in the **Rules** section, then the **Spoofed senders** tab. These entries cover the specific domain and sending infrastructure pair, but Microsoft notes they never expire, so note why you added them and review them ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)).

## Are the user's own junk settings to blame?

If the header shows `SFV:BLK`, the user blocked the sender, often by accident. Reporting a message as junk with Outlook's **Report** button moves it to Junk and adds the sender to the user's Blocked Senders list ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)).

The user can remove the entry in Outlook's junk settings. As an admin, you can do it in Exchange Online PowerShell:

```powershell
Set-MailboxJunkEmailConfiguration "Ori Epstein" -BlockedSendersAndDomains @{Remove="supplier.example"}
Get-MailboxJunkEmailConfiguration -Identity "Ori Epstein" | Format-List trusted*,contacts*,blocked*
```

Microsoft also shows how to remove one blocked domain from every mailbox at once, which is handy after a mistaken company-wide report ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)).

### Outlook's client-side filter

If the header says `SFV:NSPM` (not spam) but the message still ended up in Junk, look at Outlook desktop. Microsoft recommends leaving the Junk Email Filter at **No automatic filtering** in Microsoft 365, "to prevent unnecessary conflicts (both positive and negative) with the spam filtering verdicts." The Safe and Blocked Senders lists still apply at that level. Also check the user's Inbox rules.

## Is the message being treated as bulk mail?

Newsletters, event invitations and marketing from suppliers are often caught as bulk. Microsoft scores each bulk message with a bulk complaint level (BCL) from 0 to 9, shown in the `X-Microsoft-Antispam` header ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)):

| BCL | Meaning |
|---|---|
| 0 | Not from a bulk sender |
| 1 to 3 | Bulk sender with few complaints |
| 4 to 7 | Bulk sender with a mixed number of complaints |
| 8 to 9 | Bulk sender with a high number of complaints |

The default anti-spam policy acts on BCL 7 and above. Standard uses 6, Strict 5. For a single wanted newsletter, have the user report it as **Not junk**. Adjust the threshold only if many wanted senders are affected, and use the bulk senders insight in the policy to see the effect before you change it.

## How do you allow a sender safely?

If the sender passes authentication and Microsoft still junks their mail, an allow entry is reasonable. Microsoft's preferred method is the Tenant Allow/Block List, not anti-spam policy allow lists or broad transport rules ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)).

1. In the Defender portal, go to **Actions & submissions** > **Submissions** (`https://security.microsoft.com/reportsubmission`).
2. On the **Emails** tab, select **Submit to Microsoft for analysis**, add the network message ID or upload the .eml file, and choose the affected recipient.
3. Select **I've confirmed it's clean**, then **Allow this message**. The allow entry is removed **45 days after last used date** by default ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin)).
4. Allow a single address rather than a whole domain wherever possible.

Avoid three shortcuts:

- **Allowed domains in anti-spam policies.** Microsoft says these bypass spam, spoof and phishing protection and sender authentication, and should be avoided "if at all possible."
- **A transport rule that sets SCL -1 on the sender domain alone.** Microsoft warns this "significantly" increases the chance of spoofing. If you must use a rule, require `dmarc=pass` in `Authentication-Results`.
- **Telling every user to add Safe Senders.** It's per mailbox, hard to audit, and Microsoft calls it high risk.

Our guide to [whitelisting senders safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) goes into each option.

## What if everything external suddenly goes to Junk?

If many unrelated senders land in Junk at once, look for a change in your mail path rather than at each sender. The usual cause is a filtering gateway in front of Microsoft 365 without Enhanced Filtering for Connectors, so Microsoft sees the gateway as the sender and authentication checks fail. Our [Enhanced Filtering guide](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) explains the fix. If wanted mail is in quarantine rather than Junk, see [how to release quarantined email](https://iblockspam.com/blog/release-quarantined-email-microsoft-365).

## Next steps

1. Take one misfiled message, read its `SFV`, `CAT`, `BCL` and `compauth` values, and match them to the table above.
2. If authentication failed, send the sender the header results and our [SPF Checker](https://iblockspam.com/tools/spf-checker) link.
3. Set Outlook desktop's Junk Email Filter to No automatic filtering by Group Policy.
4. Replace any domain-wide allow entries with Tenant Allow/Block List entries for single addresses.
5. Read our guide to [false positives](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) for a repeatable triage process.

Related: [Outlook junk email filter settings](https://iblockspam.com/blog/outlook-junk-email-filter-settings) covers the per-user side of the same problem.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Why does email from one particular sender always go to Junk in Outlook?

Check the X-Forefront-Antispam-Report header. SFV:BLK means the sender is on that user's Blocked Senders list, often after someone clicked Report as junk. Otherwise look at Authentication-Results: a sender failing SPF, DKIM or DMARC is the most common cause, and only the sender can fix it properly.

### Does a Safe Senders entry stop Microsoft 365 quarantining a message?

Only partly. Safe Senders entries are honored when the policy action is Move to Junk Email. When the action is quarantine, domain entries are ignored and address entries work only if the message isn't malware or high confidence phishing and isn't blocked in the Tenant Allow/Block List.

### Should I turn off the Junk Email Filter in Outlook desktop?

Microsoft recommends leaving the Outlook Junk Email Filter at No automatic filtering in Microsoft 365. At Low or High, Outlook runs its own filter, separate from the service's verdict, which can move good mail to Junk. Safe and Blocked Senders lists still work at No automatic filtering.

### How do I stop newsletters landing in Junk in Microsoft 365?

Newsletters are usually caught as bulk. Check the BCL value in the X-Microsoft-Antispam header against your policy's threshold, which is 7 by default. Users can report wanted newsletters as Not junk. Raising the threshold affects everyone covered by that policy, so change it only if many wanted senders are affected.

### Can an admin manage a user's Safe Senders and Blocked Senders lists?

Yes, in Exchange Online PowerShell with Set-MailboxJunkEmailConfiguration. Use the TrustedSendersAndDomains and BlockedSendersAndDomains parameters with Add and Remove syntax to change entries without overwriting the list. Get-MailboxJunkEmailConfiguration shows the current entries.

## Sources

- [Microsoft Learn: Anti-spam message headers in cloud organizations](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
- [Microsoft Learn: Configure junk email settings on Exchange Online mailboxes](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)
- [Microsoft Learn: Bulk complaint level (BCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)
- [Microsoft Learn: Create allowlists](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)
- [Microsoft Learn: Allow or block email using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)
- [Microsoft Learn: Report phishing and suspicious email in Outlook](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)
- [Microsoft Learn: Spam confidence level (SCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-emails-going-to-junk (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt