Microsoft 365 spam headers explained: how to read SFV, CAT, BCL and compauth

Every message that reaches a Microsoft 365 mailbox carries a record of what the filter decided and why. It sits in the message headers, written as short codes such as SFV:SKA or CAT:BULK. Once you can read those codes, most "why did this land in Junk?" and "why did this spam get through?" questions take a couple of minutes.

This guide lists the fields Microsoft documents, what each value means, and the order to read them in. For headers in general, including the Received chain, start with how to read email headers.

How do you see message headers in Outlook?

Microsoft's Outlook support article gives these steps:

Copy the whole block. Then paste it into our Email Header Analyzer, which splits the fields out and runs in your browser, so the headers aren't uploaded.

If a user forwards you a message, the headers belong to the forward. Ask for it as an attachment instead.

Which headers does Microsoft 365 add?

Microsoft 365 scans all incoming mail and writes its results into three headers (Microsoft Learn):

A fourth, X-CustomSpam, appears only when an Advanced Spam Filter setting flags the message. More on that below.

Microsoft notes that the antispam report contains many fields it doesn't document. Those are "used exclusively by the Microsoft anti-spam team for diagnostic purposes," so don't try to interpret them.

What does each X-Forefront-Antispam-Report field mean?

The header is a list of FIELD:value pairs separated by semicolons. A real one looks like Microsoft's example:

X-Forefront-Antispam-Report: CIP:198.51.100.50;CTRY:US;LANG:en;
  SFV:SPM;IPV:NLI;SRV:;H:mail.adatum.com;PTR:mail.adatum.com;
  CAT:SPM;SFTY:;DIR:INB;

These are the documented fields:

Watch CIP if your MX points to a filtering gateway. If it shows the gateway's IP rather than the original sender's, Microsoft is judging the gateway. Enhanced Filtering for Connectors fixes that.

What do the SFV values mean?

SFV is the field that tells you which component decided the message's fate. Microsoft's troubleshooting guide maps each value to its source:

The "skipped" values (SKA, SKI, SKN, SFE) are the ones to look for when spam reaches the inbox. Our guide to spam getting through Microsoft 365 shows how to remove each kind of allow.

What do the CAT values mean?

CAT names the type of protection that applied. When several detections fire, the highest-priority policy wins (Microsoft Learn).

* Defender for Office 365 only.

Why shouldn't you trust the SCL number?

SCL (spam confidence level) runs from -1 to 9, and older advice says 5 or above means spam. Microsoft now says the value "doesn't determine whether spam filtering identifies a message as Spam or High confidence spam, and it doesn't determine the action taken on the message" (Microsoft Learn). The same SCL can appear on messages with different verdicts. Use CAT and DIR instead.

SCL still matters in two places: mail flow rules that request a bypass (-1) or a spam verdict (5, 6 or 9), and on-premises or hybrid Exchange, where Junk Email thresholds use it. Even when a rule requests -1, the stamped value may be 0 or 1.

What do BCL and SRV:BULK mean?

The bulk complaint level, in X-Microsoft-Antispam, rates how likely a bulk sender's mail is to draw complaints (Microsoft Learn):

Mail at or above your policy's threshold gets SRV:BULK and the bulk action. The threshold is 7 in the default policy, 6 in the Standard preset and 5 in Strict. If newsletters people want keep landing in Junk, a BCL just over your threshold is the usual reason.

What does an X-CustomSpam header mean?

X-CustomSpam means one of the Advanced Spam Filter (ASF) settings in your anti-spam policy matched. The value names it: Web bug, SPF Record Fail, Image links to remote sites and so on (Microsoft Learn).

These settings are off by default, and Microsoft calls them "an aggressive approach to spam filtering." Its troubleshooting guide adds that Microsoft "no longer recommends enabling ASF settings." Two practical limits: ASF detections can't be reported to Microsoft as false positives, and the header is added after mail flow rules run, so a rule can't act on it. If a legitimate message carries X-CustomSpam, turn that setting off. To see which ones are on:

Get-HostedContentFilterPolicy `
  | Format-Table Identity, MarkAsSpam*, IncreaseScoreWith* -AutoSize

How do you read Authentication-Results and compauth?

Microsoft writes SPF, DKIM and DMARC results into Authentication-Results, the header defined in RFC 8601. A typical failure:

Authentication-Results: spf=fail (sender IP is 198.51.100.77)
  smtp.mailfrom=fabrikam.com; dkim=none;
  dmarc=fail action=quarantine header.from=fabrikam.com;
  compauth=fail reason=000

Compare the three domains: smtp.mailfrom (checked by SPF), header.d (the DKIM signer) and header.from (what the reader sees). DMARC passes when SPF or DKIM passes for a domain aligned with header.from. Our SPF vs DKIM vs DMARC guide explains alignment.

Two Microsoft-specific values matter here. dmarc=bestguesspass means the domain has no DMARC record, but would pass if it had one. In action, oreject means the sender published p=reject. Whether Microsoft then rejected the message or sent it to Junk depends on the recipient's Honor DMARC record policy setting in its anti-phishing policy (Microsoft Learn).

compauth is Microsoft's composite verdict: pass, fail, softpass or none. It uses the From domain and blends SPF, DKIM, DMARC and other signals. Microsoft notes that a message can be allowed "despite a compauth failure" if nothing else looks suspicious. The reason code tells you why:

If 905 appears on all your inbound mail, look at your routing before you look at the senders. And if the failing domain is your own, our guide to why DMARC fails covers the common causes.

How do you find out what filtered a message?

Microsoft's troubleshooting guide suggests this order:

1. Get the full headers from the original message, using the steps above.
2. Read SFV. It names the component: spam filter, an allow or block list, a mail flow rule or quarantine.
3. Check IPV. IPV:CAL alongside SFV:SKI confirms the IP Allow List skipped filtering.
4. Look for X-CustomSpam. If present, an ASF setting triggered.
5. Read CAT. It tells you whether spam, bulk, phishing, spoofing or malware protection acted. CAT:HPHSH can't be overridden by allow lists.
6. Check compauth. compauth=fail with CAT:SPOOF points at sender authentication, not content.
7. Check BCL. If SRV:BULK is present, compare the BCL with your policy threshold.
8. Confirm the user-level lists if SFV shows SFE or BLK:

Get-MailboxJunkEmailConfiguration -Identity "user@example.com" `
  | Select-Object TrustedSendersAndDomains, BlockedSendersAndDomains

Microsoft also offers a built-in diagnostic, Run Tests: Email Threat Policies (https://aka.ms/mdopolicy), which lists the policies that apply to a recipient and the inbound connector used.

What do common header combinations tell you?

For good mail landing in Junk without any of these signs, our guide to Microsoft 365 emails going to Junk goes further. Don't respond to SKA or SFE problems by adding more allows. Our guide to whitelisting senders safely explains narrower options.

Next steps

1. Pull the headers from one message you know is fine and one that was misfiled, and compare their SFV, CAT and compauth values.
2. Paste both into the free Email Header Analyzer. It runs in your browser.
3. If you see X-CustomSpam on legitimate mail, list your ASF settings with the PowerShell above and turn off the ones you don't need.
4. If inbound mail passes through a gateway (iBlockSpam or another), check that CIP shows the real sender and that compauth isn't 905 on everything.
5. Check your own domain's records with the DMARC Checker, so mail you send reads compauth=pass at the other end.

Browse more guides on running email day to day.