# Microsoft 365 spam headers explained: how to read SFV, CAT, BCL and compauth

URL: https://iblockspam.com/blog/microsoft-365-spam-headers-explained
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Read Microsoft 365 anti-spam headers: what SFV, CAT, SCL, BCL, IPV, SFTY, X-CustomSpam and compauth reason codes mean, and how to find what filtered a message.

## Short answer

Microsoft 365 records its filtering decisions in three headers. X-Forefront-Antispam-Report holds the verdict (SFV), category (CAT), direction (DIR) and connecting IP (CIP). X-Microsoft-Antispam holds the bulk complaint level (BCL). Authentication-Results holds SPF, DKIM, DMARC and compauth. Read SFV and CAT first; Microsoft says SCL no longer decides the verdict.

Every message that reaches a Microsoft 365 mailbox carries a record of what the filter decided and why. It sits in the message headers, written as short codes such as `SFV:SKA` or `CAT:BULK`. Once you can read those codes, most "why did this land in Junk?" and "why did this spam get through?" questions take a couple of minutes.

This guide lists the fields Microsoft documents, what each value means, and the order to read them in. For headers in general, including the Received chain, start with [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers).

## How do you see message headers in Outlook?

Microsoft's [Outlook support article](https://support.microsoft.com/office/cd039382-dc6e-4264-ac74-c048563d212c) gives these steps:

| Client | Steps |
|---|---|
| New Outlook for Windows | Select **More actions** at the top of the message, then **View** > **View message details** |
| Outlook on the web and Outlook.com | Select **More actions**, then **View** > **View message details** |
| Classic Outlook for Windows | Double-click to open the message in its own window, then **File** > **Properties**. Headers are in the **Internet headers** box |

Copy the whole block. Then paste it into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which splits the fields out and runs in your browser, so the headers aren't uploaded.

If a user forwards you a message, the headers belong to the forward. Ask for it as an attachment instead.

## Which headers does Microsoft 365 add?

Microsoft 365 scans all incoming mail and writes its results into three headers ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)):

| Header | What it records |
|---|---|
| `X-Forefront-Antispam-Report` | The verdict and how the message was processed: SFV, CAT, DIR, CIP and more |
| `X-Microsoft-Antispam` | Bulk mail information, chiefly the bulk complaint level (BCL) |
| `Authentication-Results` | SPF, DKIM, DMARC and Microsoft's composite authentication result (compauth) |

A fourth, `X-CustomSpam`, appears only when an Advanced Spam Filter setting flags the message. More on that below.

Microsoft notes that the antispam report contains many fields it doesn't document. Those are "used exclusively by the Microsoft anti-spam team for diagnostic purposes," so don't try to interpret them.

## What does each X-Forefront-Antispam-Report field mean?

The header is a list of `FIELD:value` pairs separated by semicolons. A real one looks like Microsoft's example:

```text
X-Forefront-Antispam-Report: CIP:198.51.100.50;CTRY:US;LANG:en;
  SFV:SPM;IPV:NLI;SRV:;H:mail.adatum.com;PTR:mail.adatum.com;
  CAT:SPM;SFTY:;DIR:INB;
```

These are the documented fields:

| Field | Meaning |
|---|---|
| `CIP` | Connecting IP address |
| `CTRY` | Country or region of the connecting IP, which may differ from the original sender's |
| `H` | The HELO or EHLO name the connecting server used |
| `PTR` | Reverse DNS (PTR record) of the source IP |
| `LANG` | Language the message was written in |
| `DIR` | Direction: `INB` inbound, `OUT` outbound, `INT` internal |
| `IPV` | IP verdict: `CAL` means the IP is in your IP Allow List; `NLI` means it wasn't on any IP reputation list |
| `SFV` | Spam filtering verdict (see the next table) |
| `CAT` | The category of protection applied (see below) |
| `SRV:BULK` | Identified as bulk mail at your BCL threshold |
| `SFTY` | Phishing safety markers: `9.19` domain impersonation, `9.20` user impersonation, `9.25` first contact safety tip |
| `SCL` | Spam confidence level; not the verdict in cloud organizations |
| `ARC` | Authenticated Received Chain details, including the chain validation result (`cv=`) |

Watch `CIP` if your MX points to a filtering gateway. If it shows the gateway's IP rather than the original sender's, Microsoft is judging the gateway. [Enhanced Filtering for Connectors](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) fixes that.

### What do the SFV values mean?

SFV is the field that tells you which component decided the message's fate. Microsoft's [troubleshooting guide](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting) maps each value to its source:

| Value | Decided by | Meaning |
|---|---|---|
| `SFV:NSPM` | Spam filter | Not spam; delivered to the intended recipients |
| `SFV:SPM` | Spam filter | Marked as spam |
| `SFV:SKA` | Anti-spam policy allow list | Skipped filtering: allowed sender or domain |
| `SFV:SKB` | Anti-spam policy block list | Marked as spam: blocked sender or domain |
| `SFV:SKI` | Connection filter | Skipped filtering: source IP in the IP Allow List (look for `IPV:CAL` too) |
| `SFV:SKN` | Mail flow rule | Skipped spam filtering because a rule set SCL to -1 |
| `SFV:SKS` | Mail flow rule or on-premises Exchange | Marked as spam before filtering, and the request was honored |
| `SFV:SFE` | User's Safe Senders list | Skipped filtering |
| `SFV:BLK` | User's Blocked Senders list | Blocked |
| `SFV:SKQ` | Quarantine | Released from quarantine |

The "skipped" values (`SKA`, `SKI`, `SKN`, `SFE`) are the ones to look for when spam reaches the inbox. Our guide to [spam getting through Microsoft 365](https://iblockspam.com/blog/microsoft-365-spam-getting-through) shows how to remove each kind of allow.

### What do the CAT values mean?

CAT names the type of protection that applied. When several detections fire, the highest-priority policy wins ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)).

| CAT | Category | CAT | Category |
|---|---|---|---|
| `SPM` | Spam | `MALW` | Malware |
| `HSPM` | High confidence spam | `AMP` | Anti-malware |
| `PHSH` | Phishing | `FTBP` | Common attachments filter |
| `HPHSH` or `HPHISH` | High confidence phishing | `SAP` | Safe Attachments\* |
| `SPOOF` | Spoofing | `UIMP` | User impersonation\* |
| `BULK` | Bulk | `DIMP` | Domain impersonation\* |
| `INTOS` | Intra-organization phishing | `GIMP` | Mailbox intelligence impersonation\* |
| `OSPM` | Outbound spam | `BIMP` | Brand impersonation\* |

\* Defender for Office 365 only.

## Why shouldn't you trust the SCL number?

SCL (spam confidence level) runs from -1 to 9, and older advice says 5 or above means spam. Microsoft now says the value "*doesn't* determine whether spam filtering identifies a message as **Spam** or **High confidence spam**, and it *doesn't* determine the action taken on the message" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)). The same SCL can appear on messages with different verdicts. Use `CAT` and `DIR` instead.

SCL still matters in two places: mail flow rules that request a bypass (-1) or a spam verdict (5, 6 or 9), and on-premises or hybrid Exchange, where Junk Email thresholds use it. Even when a rule requests -1, the stamped value may be 0 or 1.

## What do BCL and SRV:BULK mean?

The bulk complaint level, in `X-Microsoft-Antispam`, rates how likely a bulk sender's mail is to draw complaints ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)):

| BCL | Meaning |
|---|---|
| 0 | Not from a bulk sender |
| 1 to 3 | Bulk sender with few complaints |
| 4 to 7 | Bulk sender with a mixed number of complaints |
| 8 or 9 | Bulk sender with a high number of complaints |

Mail at or above your policy's threshold gets `SRV:BULK` and the bulk action. The threshold is 7 in the default policy, 6 in the Standard preset and 5 in Strict. If newsletters people want keep landing in Junk, a BCL just over your threshold is the usual reason.

## What does an X-CustomSpam header mean?

`X-CustomSpam` means one of the Advanced Spam Filter (ASF) settings in your anti-spam policy matched. The value names it: `Web bug`, `SPF Record Fail`, `Image links to remote sites` and so on ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-asf-settings-about)).

These settings are off by default, and Microsoft calls them "an aggressive approach to spam filtering." Its troubleshooting guide adds that Microsoft "no longer recommends enabling ASF settings." Two practical limits: ASF detections can't be reported to Microsoft as false positives, and the header is added after mail flow rules run, so a rule can't act on it. If a legitimate message carries `X-CustomSpam`, turn that setting off. To see which ones are on:

```powershell
Get-HostedContentFilterPolicy `
  | Format-Table Identity, MarkAsSpam*, IncreaseScoreWith* -AutoSize
```

## How do you read Authentication-Results and compauth?

Microsoft writes SPF, DKIM and DMARC results into `Authentication-Results`, the header defined in [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html). A typical failure:

```text
Authentication-Results: spf=fail (sender IP is 198.51.100.77)
  smtp.mailfrom=fabrikam.com; dkim=none;
  dmarc=fail action=quarantine header.from=fabrikam.com;
  compauth=fail reason=000
```

Compare the three domains: `smtp.mailfrom` (checked by SPF), `header.d` (the DKIM signer) and `header.from` (what the reader sees). DMARC passes when SPF or DKIM passes for a domain aligned with `header.from`. Our [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc) guide explains alignment.

Two Microsoft-specific values matter here. `dmarc=bestguesspass` means the domain has no DMARC record, but would pass if it had one. In `action`, `oreject` means the sender published `p=reject`. Whether Microsoft then rejected the message or sent it to Junk depends on the recipient's **Honor DMARC record policy** setting in its anti-phishing policy ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)).

`compauth` is Microsoft's composite verdict: `pass`, `fail`, `softpass` or `none`. It uses the From domain and blends SPF, DKIM, DMARC and other signals. Microsoft notes that a message can be allowed "despite a `compauth` failure" if nothing else looks suspicious. The `reason` code tells you why:

| Reason | Result | Meaning |
|---|---|---|
| `000` | fail | Explicit DMARC failure; the sender's policy is quarantine or reject |
| `001` | fail | Implicit failure: no records, or weak ones (`~all`, `?all`, `p=none`) |
| `002` | fail | Your organization explicitly prohibits this sender/domain pair from spoofing |
| `010` | fail | DMARC failure on one of your own accepted domains |
| `100` to `104` | pass | Aligned SPF or DKIM, or PTR alignment |
| `130` | pass | A trusted ARC sealer overrode the DMARC failure |
| `2xx` | softpass | Implicit soft pass |
| `601` | fail | The sending domain is one of your accepted domains (self-to-self spoofing) |
| `701` to `704` | pass | DMARC not enforced because of a history of legitimate mail from that infrastructure |
| `905` | none | DMARC not enforced because of complex routing, such as mail passing through a non-Microsoft service first |

If `905` appears on all your inbound mail, look at your routing before you look at the senders. And if the failing domain is your own, our guide to [why DMARC fails](https://iblockspam.com/blog/why-dmarc-fails) covers the common causes.

## How do you find out what filtered a message?

Microsoft's [troubleshooting guide](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting) suggests this order:

1. **Get the full headers** from the original message, using the steps above.
2. **Read SFV.** It names the component: spam filter, an allow or block list, a mail flow rule or quarantine.
3. **Check IPV.** `IPV:CAL` alongside `SFV:SKI` confirms the IP Allow List skipped filtering.
4. **Look for X-CustomSpam.** If present, an ASF setting triggered.
5. **Read CAT.** It tells you whether spam, bulk, phishing, spoofing or malware protection acted. `CAT:HPHSH` can't be overridden by allow lists.
6. **Check compauth.** `compauth=fail` with `CAT:SPOOF` points at sender authentication, not content.
7. **Check BCL.** If `SRV:BULK` is present, compare the BCL with your policy threshold.
8. **Confirm the user-level lists** if SFV shows `SFE` or `BLK`:

```powershell
Get-MailboxJunkEmailConfiguration -Identity "user@example.com" `
  | Select-Object TrustedSendersAndDomains, BlockedSendersAndDomains
```

Microsoft also offers a built-in diagnostic, **Run Tests: Email Threat Policies** (`https://aka.ms/mdopolicy`), which lists the policies that apply to a recipient and the inbound connector used.

## What do common header combinations tell you?

| You see | Most likely cause | What to do |
|---|---|---|
| `SFV:SKA` on spam | Allowed sender or domain in an anti-spam policy | Remove it; use the Tenant Allow/Block List for narrow exceptions |
| `SFV:SKN` on spam | A mail flow rule sets SCL -1 too broadly | Narrow or remove the rule (see [security mail flow rules](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security)) |
| `SFV:SFE` on spam | The user added the sender to Safe Senders | Clean up the user's list |
| `SFV:SPM` with `X-CustomSpam` on good mail | An ASF setting | Turn that ASF setting off |
| `SRV:BULK` on a wanted newsletter | BCL at or above your threshold | Allow the sender narrowly, or accept Junk delivery |
| `CAT:SPOOF` with `compauth=fail reason=000` | The sender's DMARC failed with an enforcing policy | Ask the sender to fix authentication |
| `SFV:SKB` or `SFV:BLK` on good mail | A block list entry | Review admin and user block lists (see [blocking senders](https://iblockspam.com/blog/block-sender-or-domain-microsoft-365)) |

For good mail landing in Junk without any of these signs, our guide to [Microsoft 365 emails going to Junk](https://iblockspam.com/blog/microsoft-365-emails-going-to-junk) goes further. Don't respond to `SKA` or `SFE` problems by adding more allows. Our guide to [whitelisting senders safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) explains narrower options.

## Next steps

1. Pull the headers from one message you know is fine and one that was misfiled, and compare their SFV, CAT and compauth values.
2. Paste both into the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). It runs in your browser.
3. If you see `X-CustomSpam` on legitimate mail, list your ASF settings with the PowerShell above and turn off the ones you don't need.
4. If inbound mail passes through a gateway (iBlockSpam or another), check that `CIP` shows the real sender and that compauth isn't `905` on everything.
5. Check your own domain's records with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), so mail you send reads `compauth=pass` at the other end.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What does CAT:SPOOF mean in a Microsoft 365 header?

CAT:SPOOF means anti-spoofing protection, not the content filter, decided what happened to the message. It usually appears with a compauth failure in Authentication-Results, for example reason 000 when the sender's DMARC policy is quarantine or reject. Check the sender's SPF, DKIM and DMARC before you allow anything.

### What do BCL values mean in Microsoft 365?

BCL is the bulk complaint level in the X-Microsoft-Antispam header. 0 means the message isn't from a bulk sender, 1 to 3 means few complaints, 4 to 7 a mixed number and 8 or 9 a high number. Mail at or above your policy's threshold, 7 by default, is treated as bulk.

### What does X-CustomSpam mean in an email header?

It means an Advanced Spam Filter setting in your anti-spam policy flagged the message, and the value names the setting, such as Web bug. These settings are off by default, Microsoft no longer recommends them, and ASF detections can't be reported to Microsoft as false positives. Turn off the setting that caused the problem.

### Is compauth=fail the same as dmarc=fail?

No. dmarc is the result of the sender's own DMARC check. compauth is Microsoft's composite result, which combines SPF, DKIM, DMARC and other signals about the From domain. A message can get compauth=fail with no DMARC record at all, and Microsoft says a compauth failure doesn't always mean the message is blocked.

### Can a mail flow rule skip high confidence phishing filtering?

No. Microsoft says a rule that sets SCL to -1 overrides spam filtering only. Malware is always quarantined, and high confidence phishing is too, unless your MX records don't point to Microsoft 365 and an SCL -1 rule is in place. Allow lists can't override a CAT:HPHSH verdict either.

## Sources

- [Microsoft Learn: Anti-spam message headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
- [Microsoft Learn: Troubleshoot anti-spam policies](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting)
- [Microsoft Learn: Spam confidence level (SCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)
- [Microsoft Learn: Bulk email detection and the bulk complaint level (BCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)
- [Microsoft Learn: ASF settings in anti-spam policies](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-asf-settings-about)
- [Microsoft Support: View internet message headers in Outlook](https://support.microsoft.com/office/cd039382-dc6e-4264-ac74-c048563d212c)
- [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-spam-headers-explained (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt