# How do Outlook's junk email filter settings work, and which should you use?

URL: https://iblockspam.com/blog/outlook-junk-email-filter-settings
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Outlook Junk Email Filter levels, Safe and Blocked Senders lists, size limits, and how classic Outlook, new Outlook and the web app work with Microsoft 365.

## Short answer

Classic Outlook has four Junk Email Filter levels: No Automatic Filtering (the default), Low, High and Safe Lists Only. Microsoft documents no levels for new Outlook or Outlook on the web, only Safe and Blocked Senders lists and simple filters. In Microsoft 365, Microsoft recommends No Automatic Filtering, because the service already filters spam and the lists still apply.

Outlook has its own junk settings that sit on top of whatever your mail service does. They're easy to change, they behave differently in each version of Outlook, and in Microsoft 365 they can quietly undo or duplicate your admin policies. This guide covers what each setting does in classic Outlook, new Outlook and Outlook on the web, and how they interact with the filtering your organization runs.

If you're chasing one specific message in Junk, start with [why Microsoft 365 emails go to junk](https://iblockspam.com/blog/microsoft-365-emails-going-to-junk), which covers the header diagnosis. This guide is about the settings themselves.

## Which junk settings does each version of Outlook have?

The three Outlook versions most people use today don't offer the same options.

| Setting | Classic Outlook for Windows | New Outlook for Windows and Outlook on the web |
|---|---|---|
| Where to find it | **Home** > **Block** > **Junk E-mail Options** | **Settings** > **Mail** > **Junk email** |
| Protection levels | No Automatic Filtering, Low, High, Safe Lists Only | None documented |
| Safe Senders | **Safe Senders** tab | **Safe senders and domains** |
| Safe Recipients (mailing lists) | **Safe Recipients** tab | **Safe mailing lists** |
| Blocked Senders | **Blocked Senders** tab | **Blocked senders and domains** |
| Trust contacts | **Also trust email from my Contacts** | **Trust email from my contacts** |
| Only accept safe lists | **Safe Lists Only** level | **Only trust email from addresses in my Safe senders and domains list and Safe mailing lists** |
| Delete junk instead of moving it | **Permanently delete suspected junk email** option | Not documented |

The menu paths come from Microsoft's [classic Outlook protection level article](https://support.microsoft.com/en-us/office/change-the-level-of-protection-in-the-junk-email-filter-e89c12d8-9d61-4320-8c57-d982c8d52f6b) and its [new Outlook and Outlook on the web article](https://support.microsoft.com/en-us/office/filter-junk-email-and-spam-in-outlook-db786e79-54e2-40cc-904f-d89d57b7f41d). The setting names for the filters come from Microsoft's [mapping of Outlook settings to PowerShell parameters](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes). Microsoft's [Junk Email Filter overview](https://support.microsoft.com/office/5ae3ea8e-cf41-4fa0-b02a-3b96e21de089) notes that its classic Outlook steps "are not applicable to new Outlook for Windows."

The lists are shared. Microsoft says the safelist collection "is saved in the Exchange Online mailbox so that the changes to the safelist collection in Outlook appear in Outlook on the web, and vice-versa." The protection level is not; it's a classic Outlook client setting.

## What do the classic Outlook protection levels do?

Microsoft's descriptions of the four levels ([Microsoft Support](https://support.microsoft.com/en-us/office/change-the-level-of-protection-in-the-junk-email-filter-e89c12d8-9d61-4320-8c57-d982c8d52f6b)):

| Level | What Microsoft says | Our take |
|---|---|---|
| **No Automatic Filtering** (default) | Turns off the automatic filter, but "messages are still evaluated by using the domain names and email addresses in your Blocked Senders List" | Right choice for Microsoft 365 and most hosted mail |
| **Low** | For people who "want to filter only the messages that are the most obvious junk" | Adds a second, client-side verdict |
| **High** | For people who receive lots of junk; Microsoft recommends checking the Junk folder occasionally | Expect false positives |
| **Safe Lists Only** | "Any message that isn't from someone on your Safe Senders List or isn't to a mailing list on your Safe Recipients List, is classified as junk" | Only for a mailbox that should hear from a known few |

Microsoft warns that "the higher you set the protection level, the greater the risk of some legitimate messages being identified as junk." The **Permanently delete suspected junk email** option goes further and removes your chance to review mistakes. We'd never turn it on in a business mailbox.

### Why Microsoft recommends No Automatic Filtering

At **Low** or **High**, Microsoft says Outlook "uses its own SmartScreen filter technology to identify and move spam," and that this classification "is separate from the spam filtering verdict from Microsoft 365." Two filters can disagree, and when they do, users see good mail in Junk with nothing in the headers to explain it.

Microsoft's advice for Microsoft 365 organizations is to "leave the Junk Email Filter in Outlook set to **No automatic filtering** to prevent unnecessary conflicts (both positive and negative) with the spam filtering verdicts" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)). The Safe Senders, Safe Recipients and Blocked Senders lists keep working at that level.

## How do Safe Senders and Blocked Senders interact with admin policies?

This is where most confusion comes from. A user's lists are inputs to Microsoft 365 filtering, not the final word.

**Blocked Senders** always win against the sender. Microsoft adds `X-Forefront-Antispam-Report: SFV:BLK` to messages from a blocked sender and classifies them as spam. The message then goes to Junk or to quarantine, depending on the action in the anti-spam policy.

**Safe Senders** are weaker than most people assume. Microsoft says entries "are inputs to spam filtering, but don't determine the final verdict. Malware, high confidence phishing, and other detections take precedence." What happens depends on the policy action that matched ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)):

| Policy action for the verdict | Safe Senders domain entry | Safe Senders address entry |
|---|---|---|
| **Move message to Junk Email folder** | Honored | Honored |
| **Quarantine message** | Ignored, message is quarantined | Honored, unless the message is malware or high confidence phishing, or the sender is blocked in the Tenant Allow/Block List |

When a Safe Senders entry does skip filtering, the header shows `SFV:SFE` ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)). Microsoft's [secure by default](https://learn.microsoft.com/en-us/defender-office-365/secure-by-default) policy lists Outlook Safe Senders among the overrides that aren't applied to malware or high confidence phishing, and says Microsoft found Safe Senders "too broad," "causing more harm than good." It also matches only the From address, which is the part of a message an attacker controls.

That's why Microsoft ranks Safe Senders below the Tenant Allow/Block List in its [allowlist guidance](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365). For a sender the whole company needs, an admin should add a tenant entry instead. Our guide to [whitelisting a sender safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) walks through it, and [blocking a sender or domain in Microsoft 365](https://iblockspam.com/blog/block-sender-or-domain-microsoft-365) covers the opposite.

### The Report button changes Blocked Senders

When a user selects **Report** > **Junk** in Outlook, Microsoft says "the messages are moved to the Junk Email folder, and the sender is automatically added to the user's Blocked Senders list" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)). One wrong click on a newsletter can block a supplier's whole address. If someone stops receiving a sender's mail, check their Blocked Senders first.

### Does turning off junk filtering in Outlook stop Junk?

Not in Exchange Online. Microsoft says Microsoft 365 "uses a mail flow delivery agent to route messages to the Junk Email folder. It doesn't use the junk email rule in the mailbox." The `Enabled` parameter of `Set-MailboxJunkEmailConfiguration` "has no effect on mail flow in cloud mailboxes." Spam verdicts from your anti-spam policy still land in Junk, and the user's lists still work.

The older Outlook Web App for Exchange Server 2013 and 2010 did have a **Don't move email to my Junk Email folder** option. Microsoft's [help for that version](https://support.microsoft.com/en-us/office/block-or-allow-junk-email-settings-48c9f6f7-2309-4f95-9a4d-de987e880e46) warns that with it selected, spam detected by Exchange Online Protection is delivered to the Inbox when the admin's action is Move to Junk. If you still run on-premises Exchange, check nobody has ticked it.

## How big can the Safe and Blocked Senders lists get?

Large lists fail silently, so it's worth knowing the numbers. These are Microsoft's limits for Exchange Online at the time of writing (October 2026) ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)):

| Limit | Value | What happens past it |
|---|---|---|
| Safelist collection in the mailbox | 510 KB, all lists plus other junk settings | Outlook shows "You are over the size allowed on the server" and the server-side junk filter is disabled until the lists shrink |
| Safe Senders plus Safe Recipients plus contacts (when trusted) synced to Microsoft 365 | 1,024 entries | PowerShell and Outlook on the web stop accepting entries with no error; classic Outlook can still use extra entries locally |
| Blocked Senders and Blocked Domains synced | 65,535 entries | Microsoft's stated sync limit for blocked entries |
| Blocked Senders with hashes synced to Microsoft Entra ID | First 500 entries | Later entries don't get a **User Block** verdict, so quarantine and notification behavior differs |

Because the limit is in kilobytes, long addresses fill it faster than short domains. **Trust email from my contacts** also eats into the 1,024 entries, and Microsoft suggests turning it off by Group Policy if that's a concern. Note too that safe senders for shared mailboxes aren't synchronized to Microsoft Entra ID.

Our view: a Safe Senders list in the hundreds is a symptom. It usually means real senders fail authentication or the tenant policy is too strict. Fix those causes and the lists can stay short.

## How do admins manage users' junk settings?

### In Exchange Online PowerShell

Admins can edit any mailbox's lists with `Set-MailboxJunkEmailConfiguration`. Use the `@{Add=...; Remove=...}` syntax to change entries without overwriting the list:

```powershell
Set-MailboxJunkEmailConfiguration "Ori Epstein" -BlockedSendersAndDomains @{Remove="supplier.example"} -ContactsTrusted $false
Get-MailboxJunkEmailConfiguration -Identity "Ori Epstein" | Format-List trusted*,contacts*,blocked*
```

`TrustedListsOnly` maps to the Safe Lists Only behavior and `ContactsTrusted` to trusting contacts. You can't edit Safe Recipients directly; Microsoft says changes to Safe Senders are synchronized to it.

### With Group Policy for classic Outlook

Microsoft documents a [Group Policy method](https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/email-security/deploy-junk-email-settings) for classic Outlook:

1. Install the current Office Administrative Template files on your domain controller.
2. In the Group Policy Management Console, go to **User Configuration** > **Administrative Templates** and open the **Junk E-mail** node.
3. Set the junk email protection level to **No Automatic Filtering**. Microsoft's own example does this "because Exchange Online already has junk filtering."
4. Optionally deploy Safe Senders, Safe Recipients or Blocked Senders lists with **Specify path to Safe Senders list** and the matching policies. The files must exist when Outlook starts.
5. Enable **Trigger to apply junk email list settings**, and decide whether **Overwrite or Append Junk Mail Import** should replace users' own entries.

Settings deployed this way appear disabled in Outlook. One catch: you can't add your own domain or accepted domains to these lists. Microsoft says Outlook "automatically removes these entries" when it refreshes the Safe Senders list, which is the right outcome, since attackers spoof your own domain.

New Outlook and Outlook on the web don't read these policies. Their lists live in the mailbox, so manage them with PowerShell.

## What should a small business standardize on?

1. **Set classic Outlook to No Automatic Filtering** everywhere, by Group Policy or a quick visit to each PC.
2. **Never use Permanently delete suspected junk email.**
3. **Keep Safe Senders for personal contacts only.** Business-critical senders go in the Tenant Allow/Block List, added by an admin.
4. **Teach users that Report > Junk blocks the sender**, and that they should use **Not junk** to rescue good mail.
5. **Audit list sizes yearly.** Anyone near 1,024 Safe Senders or the 510 KB limit has a filtering problem to fix.
6. **Leave Safe Lists Only to special mailboxes**, such as a board member's private address.

If you filter mail before it reaches Microsoft 365, the same logic applies one layer up. A gateway's [approved and blocked sender lists](https://iblockspam.com/features/allow-block-lists) handle company-wide decisions, with sender verification to stop forged From addresses, and Outlook's lists stay as personal preferences.

## Next steps

- Check one user's settings with `Get-MailboxJunkEmailConfiguration` and look for a long Safe Senders list or surprise Blocked Senders entries.
- Paste the headers of a misfiled message into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and look for `SFV:BLK` or `SFV:SFE`.
- Review the policy actions that decide between Junk and quarantine in our [Microsoft 365 anti-spam policy guide](https://iblockspam.com/blog/microsoft-365-anti-spam-policies).
- Learn how messages can move to Junk after delivery in [zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap).

Related: our hub on [legitimate email flagged as spam](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) and [why did this email land in spam?](https://iblockspam.com/blog/why-did-this-email-land-in-spam).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What is the default Junk Email Filter level in classic Outlook?

No Automatic Filtering. Microsoft says this turns off Outlook's own automatic filter, but messages are still checked against your Blocked Senders list. In a Microsoft 365 mailbox, the service's spam filtering still moves junk to the Junk Email folder, so the default level doesn't mean you get no spam protection.

### Does new Outlook have Low and High junk filter levels?

Not as far as Microsoft documents. Its help for new Outlook for Windows and Outlook on the web describes Safe senders and domains, Blocked senders and domains, and a few filter options, but no protection levels. The Low, High and Safe Lists Only levels belong to classic Outlook for Windows.

### How many entries can an Outlook Safe Senders list hold in Microsoft 365?

The whole safelist collection is limited to 510 KB per mailbox. Microsoft 365 synchronizes up to 1,024 Safe Senders and Safe Recipients entries combined (including contacts if Trust email from my contacts is on) and 65,535 blocked entries. Classic Outlook can use extra entries locally up to the 510 KB limit.

### Why does a sender on my Safe Senders list still end up in quarantine?

Safe Senders entries only partly override quarantine. When the policy action is quarantine, Microsoft ignores domain entries, and honors address entries only if the message isn't malware or high confidence phishing and the sender isn't blocked in the Tenant Allow/Block List. Malware and high confidence phishing are always quarantined.

### Can admins stop users changing their Outlook junk settings?

For classic Outlook, yes. Microsoft's Group Policy templates include a Junk E-mail node where you can set the protection level, deploy Safe Senders and Blocked Senders lists, hide the junk mail interface and stop users from adding Safe Senders. Settings deployed by policy appear disabled in Outlook's options.

## Sources

- [Microsoft Support: Change the level of protection in the Junk Email Filter in Outlook](https://support.microsoft.com/en-us/office/change-the-level-of-protection-in-the-junk-email-filter-e89c12d8-9d61-4320-8c57-d982c8d52f6b)
- [Microsoft Support: Overview of the Junk Email Filter in classic Outlook](https://support.microsoft.com/office/5ae3ea8e-cf41-4fa0-b02a-3b96e21de089)
- [Microsoft Support: Filter junk email and spam in Outlook (new Outlook and Outlook on the web)](https://support.microsoft.com/en-us/office/filter-junk-email-and-spam-in-outlook-db786e79-54e2-40cc-904f-d89d57b7f41d)
- [Microsoft Learn: Configure junk email settings on Exchange Online mailboxes](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)
- [Microsoft Learn: How to deploy junk email settings by using Group Policy](https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/email-security/deploy-junk-email-settings)
- [Microsoft Learn: Create allowlists](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365)
- [Microsoft Learn: Secure by default in cloud organizations](https://learn.microsoft.com/en-us/defender-office-365/secure-by-default)
- [Microsoft Learn: Report phishing and suspicious emails in Outlook for admins](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/outlook-junk-email-filter-settings (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt