# Why is spam getting through the Microsoft 365 spam filter, and how do you fix it?

URL: https://iblockspam.com/blog/microsoft-365-spam-getting-through
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Why spam reaches Microsoft 365 inboxes: allow lists, SCL -1 rules, weak policies, Direct Send. How to find the cause in headers and fix it step by step.

## Short answer

Spam usually gets through Microsoft 365 because something told the filter to skip it: an allowed sender or domain, a user's Safe Senders entry, an IP Allow List entry or a mail flow rule that sets SCL -1. Read the X-Forefront-Antispam-Report header to find which, remove broad allows, apply the Standard or Strict preset policy and submit misses to Microsoft.

Microsoft 365 filters every inbound message, and you can't turn spam filtering off. So when spam lands in inboxes, the usual cause isn't that the filter is broken. It's that a setting told the filter to step aside, or that the policy is set to deliver suspect mail more gently than you'd like.

This guide shows how to find out which, in the order we'd check. For phishing and impersonation settings, see [how to stop phishing emails in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365).

## How do you find out why a spam message reached the inbox?

Start with the evidence, not the settings. Ask a user to forward a missed spam message as an attachment, or open it in the Defender portal. Then read its headers. Microsoft records its decisions in three header fields ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)):

- `X-Forefront-Antispam-Report`: the spam filtering verdict (SFV), connection verdict (IPV), category (CAT) and connecting IP (CIP).
- `X-Microsoft-Antispam`: the bulk complaint level (BCL).
- `Authentication-Results`: SPF, DKIM, DMARC and Microsoft's composite result (compauth).

Paste the headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) (it runs in your browser) and look at the SFV value first.

| Header value | What it means | Where to look |
|---|---|---|
| `SFV:NSPM` | Filtering ran and judged the message not spam | Submit it to Microsoft; consider a stricter policy |
| `SFV:SFE` | Skipped because the sender is in the user's Safe Senders list | The user's junk email settings |
| `SFV:SKA` | Skipped because of an allowed sender or domain in an anti-spam policy | Anti-spam policy allow lists |
| `SFV:SKI` or `IPV:CAL` | Skipped because the source IP is in the IP Allow List | Connection filter policy |
| `SFV:SKN` | Bypassed by a mail flow (transport) rule | Exchange admin center rules |
| `SFV:SPM` | Marked as spam | Check what the policy does with spam |
| `SRV:BULK` | Identified as bulk at your BCL threshold | Bulk threshold and bulk action |

One trap: don't judge a message by its SCL number. Microsoft now says the SCL value in cloud organizations "doesn't determine whether spam filtering identifies a message as Spam or High confidence spam," and recommends the CAT and DIR fields instead ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)).

If the `Authentication-Results` header shows the message came from a gateway's IP rather than the real sender, skip ahead to the section on gateways. Our guide to [reading email headers](https://iblockspam.com/blog/how-to-read-email-headers) covers the other fields. If your problem is the opposite, good mail landing in Junk, see [why legitimate email goes to Junk in Microsoft 365](https://iblockspam.com/blog/microsoft-365-emails-going-to-junk).

## Which allow lists override Microsoft 365 spam filtering?

Most "the filter stopped working" cases are allow lists. Microsoft ranks the ways to allow a sender from most to least recommended ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)):

1. Allow entries in the Tenant Allow/Block List.
2. Exchange mail flow rules.
3. Outlook Safe Senders.
4. The IP Allow List in the connection filter policy.
5. Allowed sender or domain lists in anti-spam policies.

The bottom of that list is where spam leaks in.

### Allowed senders and domains in anti-spam policies

Microsoft says to avoid these "if at all possible" because senders "bypass all spam, spoof, phishing protection (except high confidence phishing), and sender authentication (SPF, DKIM, DMARC)." It calls them best for temporary testing. An allowed domain such as a big webmail provider or a popular SaaS brand lets anyone forge that domain past your filter.

Open **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-spam** (or go to `https://security.microsoft.com/antispam`), open each inbound policy and check the **Allow & block list** section. Remove anything that isn't a short-term test.

### The IP Allow List

The connection filter policy's IP Allow List skips spam filtering for the listed IPs. On its [allowlist page](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365), Microsoft warns that, "without other verification", mail from those IPs skips spam filtering and sender authentication (SPF, DKIM and DMARC). The bypass isn't absolute: malware and high confidence phishing are still filtered, and Microsoft's secure by default behavior "might not honor" it. Remove ranges that belong to shared or consumer services. You'll find it under **Connection filter policy (Default)** on the same Anti-spam policies page ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/connection-filter-policies-configure)).

### User Safe Senders

Each user's Safe Senders list affects only that mailbox, but Microsoft describes it as creating "a high risk of attackers successfully delivering email that would otherwise be filtered." If one person gets far more spam than colleagues, check their list with `Get-MailboxJunkEmailConfiguration`. Our guide to [whitelisting senders safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) explains narrower alternatives.

## Is a mail flow rule bypassing your spam filter?

A rule with the action **Set the spam confidence level (SCL)** > **Bypass spam filtering** stamps `SFV:SKN`. Microsoft's troubleshooting guide lists "a mail flow rule sets SCL to -1 for too broad a scope" as the likely cause when spam reaches the inbox ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting)).

To find these rules:

1. In the Exchange admin center, open **Mail flow** > **Rules** (`https://admin.exchange.microsoft.com/#/transportrules`).
2. Look for any rule whose action sets the SCL to **Bypass spam filtering** or **-1**.
3. Or list them in Exchange Online PowerShell:

```powershell
Get-TransportRule | Where-Object {$_.SetSCL -ne $null} | Format-Table Name, State, Priority, SetSCL
```

4. For each one, check the conditions. Microsoft says never to use the sender domain as the only condition, and never your own accepted domains. If you must keep a bypass, add a condition that the `Authentication-Results` header contains `dmarc=pass` or `dmarc=bestguesspass`.
5. If the rule exists because mail arrives through a filtering gateway, delete it and use Enhanced Filtering for Connectors instead (see below).

## Are your anti-spam policies too gentle?

The default anti-spam policy moves spam, high confidence spam and phishing to the Junk Email folder, and quarantines only high confidence phishing. Its bulk threshold is 7, so a fair amount of grey mail lands in the inbox ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)).

The preset security policies tighten this:

| Setting | Default policy | Standard preset | Strict preset |
|---|---|---|---|
| Bulk threshold (BCL) | 7 | 6 | 5 |
| Spam | Junk Email | Junk Email | Quarantine |
| High confidence spam | Junk Email | Quarantine | Quarantine |
| Phishing | Junk Email | Quarantine | Quarantine |
| Bulk at or above threshold | Junk Email | Junk Email | Quarantine |
| Spam kept in quarantine | 15 days | 30 days | 30 days |

To apply them, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset Security Policies** in the **Templated policies** section (`https://security.microsoft.com/presetSecurityPolicies`). Turn on **Standard protection** for everyone and **Strict protection** for the people who get hammered ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies)).

Two side effects to know:

- Settings in the default or custom anti-spam policies are ignored for anyone covered by a preset policy. Allowed sender lists in custom policies stop working for them, so move any genuine exceptions to the Tenant Allow/Block List.
- More mail goes to quarantine. Make sure users get quarantine notifications and know how to request a release. Our guide to [releasing quarantined email](https://iblockspam.com/blog/release-quarantined-email-microsoft-365) walks through it.

Also leave zero-hour auto purge (ZAP) on. It's on by default for spam and phishing, and moves already-delivered messages once a later verdict comes in ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure)).

## Can spammers bypass Microsoft 365 filtering with Direct Send?

Yes. Direct Send lets a device or application deliver unauthenticated mail straight to your `mail.protection.outlook.com` host, using your own domain as the sender, so the same path can carry spam that appears to come from inside your organization. If no printer or app of yours needs it, `Set-OrganizationConfig -RejectDirectSend $true` rejects anonymous messages that use one of your accepted domains and don't match an inbound connector ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps)). It doesn't stop spam from other domains. Our guide to [blocking Direct Send and filter bypass](https://iblockspam.com/blog/block-direct-to-tenant-bypass) covers how to check what uses it, and how to lock down the connector if you use a gateway.

## What if your MX points to a gateway?

If your MX records point to a filtering service in front of Microsoft 365, two misconfigurations let spam through:

1. **No Enhanced Filtering for Connectors.** Microsoft 365 then sees the gateway's IP as the source, which weakens SPF, DMARC and reputation checks. Turn it on for the inbound connector, as described in our [Enhanced Filtering setup guide](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering).
2. **Open direct delivery.** Spammers who look up your tenant host can skip the gateway entirely. Restrict the connector to the gateway, as covered in [how to block filter bypass](https://iblockspam.com/blog/block-direct-to-tenant-bypass).

An [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows where your mail is really delivered.

## How do you report spam that Microsoft missed?

Admins can submit missed spam to Microsoft for a verdict, and the same flow checks whether one of your own settings let it in.

1. In the Defender portal, go to **Actions & submissions** > **Submissions** (`https://security.microsoft.com/reportsubmission`).
2. On the **Emails** tab, select **Submit to Microsoft for analysis**.
3. Add the network message ID (from the `X-MS-Exchange-Organization-Network-Message-Id` header) or upload the .eml or .msg file.
4. Choose a recipient who had the problem. Microsoft runs a policy check to show whether an allow or override let the message through.
5. Under **Why are you submitting this message to Microsoft?**, select **I've confirmed it's a threat** and choose **Spam**, **Phish** or **Malware**.
6. Optionally select **Block all emails from this sender or domain**, which creates a Tenant Allow/Block List entry. The default expiry is 30 days.

The policy check in step 4 is often the fastest way to spot a forgotten allow ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin)). For users, turn on the built-in **Report** button in Outlook so reports flow to you, Microsoft or both.

## When does a filtering gateway help?

If you've removed broad allows, applied a preset policy and spam still gets through, a second layer can help. A gateway in front of Microsoft 365 gives you a different detection engine, plus controls such as geographic or attachment-type filters and per-user quarantine digests. The trade-off is another system to configure correctly. Our comparison of [Microsoft 365 built-in filtering vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) sets out both sides.

iBlockSpam is one such option: MX-level filtering with a Partner connector and Enhanced Filtering set up through a guided process. Fix the settings above first either way. A gateway can't help if an allow rule in Microsoft 365 waves spam through, and it can't stop spam sent directly to your tenant.

## Next steps

1. Pull headers from three recent missed spam messages and note the `SFV` value of each.
2. Remove allowed domains from anti-spam policies and review every SCL -1 mail flow rule.
3. Turn on the Standard preset policy for all users, and Strict for the most targeted.
4. Run `Set-OrganizationConfig -RejectDirectSend $true` if nothing of yours uses Direct Send.
5. Run a free [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your MX, SPF and DMARC are where you expect them.

If you're considering a filter in front of Microsoft 365, the iBlockSpam [portal demo](https://iblockspam.com/demo) shows the dashboard and setup checklist with sample data, and [pricing](https://iblockspam.com/pricing) is per domain rather than per user.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Why is Office 365 suddenly letting so much spam through?

Check for a recent change first: a new allowed domain, a mail flow rule that bypasses filtering, an MX change to a gateway without Enhanced Filtering, or users adding Safe Senders. Then read the X-Forefront-Antispam-Report header on a few missed messages. An SFV value of SFE, SKA, SKI or SKN means filtering was skipped on purpose.

### Does Microsoft 365 learn when users click Report as junk?

Reports made with the built-in Report button can go to Microsoft, a reporting mailbox or both, depending on your user reported settings. Reporting a message as junk also moves it to Junk Email and adds the sender to the user's Blocked Senders list. Microsoft uses reported messages to improve its filtering.

### Can I make Microsoft 365 spam filtering more aggressive?

Yes. Assign the Strict preset security policy to the users who get the most spam. It lowers the bulk threshold to 5 and quarantines spam, bulk and phishing instead of sending it to Junk Email. Expect more false positives, and check quarantine regularly for the first few weeks.

### What does SFV:SKN mean in an email header?

SFV:SKN means the message bypassed spam filtering because of an Exchange mail flow rule, also called a transport rule. If spam shows SFV:SKN, find the rule that sets the spam confidence level to -1 and narrow its conditions, or replace it with Enhanced Filtering if it exists for a gateway.

### Should I block spam by country or language in Microsoft 365?

Anti-spam policies can mark mail as spam by source country or language, but Microsoft has no specific recommendation for either setting. Use them only if you never expect legitimate mail from those places, and watch quarantine for false positives after you turn them on.

## Sources

- [Microsoft Learn: Configure spam filter policies](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure)
- [Microsoft Learn: Troubleshoot common anti-spam policy issues](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting)
- [Microsoft Learn: Create allowlists](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)
- [Microsoft Learn: Anti-spam message headers in cloud organizations](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
- [Microsoft Learn: Preset security policies](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies)
- [Microsoft Learn: Submit messages, URLs, and attachments for analysis](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin)
- [Microsoft Learn: Configure the default connection filter policy](https://learn.microsoft.com/en-us/defender-office-365/connection-filter-policies-configure)
- [Microsoft Learn: Set-OrganizationConfig (RejectDirectSend)](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-spam-getting-through (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt