What does the question mark on a sender's photo in Outlook mean?

When Outlook replaces a sender's photo or initials with a ?, or shows an unverified sender warning above the message, it's telling you it couldn't confirm the message really came from the address it shows. That is a useful clue, not a verdict. This guide explains exactly what triggers the question mark, how to tell a harmless misconfiguration from a spoofed email, and what senders and Microsoft 365 admins can do about it.

What does the question mark in Outlook mean?

The question mark means Outlook couldn't verify the sender's identity using email authentication. Microsoft's support page on suspicious behavior says that when Outlook "can't verify the identity of the sender by using its email authentication techniques", it "displays a '?' in the sender photo". If a message is suspicious but isn't judged malicious, "the sender will be marked as unverified".

The exact rule is in Microsoft Learn. The question mark is added "if the message doesn't pass SPF or DKIM checks and the message doesn't pass DMARC or composite authentication". Those terms, briefly:

• SPF (Sender Policy Framework) checks that the sending server is listed in the DNS record of the envelope sender's domain. See what is SPF.
• DKIM (DomainKeys Identified Mail) checks a cryptographic signature added by the sending domain. See what is DKIM.
• DMARC checks that SPF or DKIM passed for the same domain shown in the From address. See what is DMARC.
• Composite authentication (compauth) is Microsoft's own combined verdict. It uses SPF, DKIM and DMARC plus signals such as sender reputation and history, so a domain with no DMARC record can still pass.

In plain terms: Outlook isn't saying the email is dangerous. It's saying nobody proved the From address is real.

Where do you see it?

The indicator comes from the mailbox service, not the Outlook app. It appears for Microsoft 365 work or school mailboxes and for Outlook.com accounts. In Microsoft 365, admins control it with the Show (?) for unauthenticated senders for spoof setting, which Microsoft's recommended settings list as on by default.

Microsoft has also added a more visible warning. In May 2024 the Microsoft 365 Insider blog announced that "an unverified sender warning has been added to the reading pane and message list" for Outlook on the web and new Outlook for Windows, with an option to delete the message, and said Outlook for iOS, Android and new Outlook for Mac would follow. Microsoft's admin message center (MC1112452, July 2025) then announced the matching banner in the reading pane of Outlook for iOS and Android, rolling out from July to late October 2025. That notice says the banner has no admin setting to configure or turn it off. At the time of writing (November 2026), Microsoft's support page still describes only the ? and the via tag, so the exact wording of the banner may differ between apps.

What other sender warnings does Outlook show?

Outlook has several sender warnings, and each one checks something different. People often confuse the question mark with the External tag or the first contact tip, but they answer different questions.

The last row is important. A scammer who registers contoso-billing.com and sets up SPF, DKIM and DMARC for it gets no question mark. Our guides to lookalike domain phishing and display name spoofing cover the attacks the question mark can't see, and Outlook's External tag explains that banner.

Is an email from an unverified sender safe to open?

Opening and reading it is generally fine. Acting on it is where the risk is. Microsoft says not every message that fails authentication is malicious, but adds that if a sender you know normally has no question mark and you suddenly see one, "that could be a sign the sender is being spoofed (impersonated)".

Use this checklist before you do anything the email asks:

1. Check the real address. Hover over or tap the sender's name. Compare the domain letter by letter with the one you expect.
2. Ask whether you expected it. An invoice from a supplier you pay monthly is different from a surprise "urgent wire" request.
3. Look at the request, not the logo. Changed bank details, gift cards, password resets and "sign in to view" links are the high-risk asks.
4. Verify through another channel. Call the person on a number you already have. Don't use phone numbers or links in the email.
5. Don't click links or open attachments until you've verified. Our guide to checking if a link is safe shows how to inspect one without visiting it.
6. Report it if it's fake. Use Report > Report phishing. Microsoft notes that reporting doesn't block the sender, so add them to Blocked Senders too if you want their mail out of your inbox.

If you've already clicked a link or entered a password, follow what to do after clicking a phishing link.

Why do legitimate emails get the question mark?

Legitimate emails get the question mark when the sender's domain hasn't set up authentication for the service that sent them. It's a configuration gap on the sender's side, and it's common. These are the usual causes:

• A third-party platform sends as the company's address. An invoicing app, CRM or booking system puts billing@company.com in the From line but signs with its own domain, or doesn't sign at all.
• The domain has no SPF, DKIM or DMARC records. Many small organizations never published them. Microsoft's reason code 001 covers exactly this case.
• The message was forwarded or rewritten. Forwarding breaks SPF, and a mailing list that edits the subject or adds a footer can break DKIM. Our guide to forwarding and ARC explains why.
• A website contact form sends "from" the visitor's address. The form's server isn't authorized to send for the visitor's domain, so every submission fails.

None of these makes the message safe, but they explain why a known supplier's invoice can arrive with a question mark. The checklist above still applies.

How do you check why a message is unverified?

Open the message headers and read the Authentication-Results line. It records the SPF, DKIM, DMARC and composite authentication results Microsoft 365 or Outlook.com reached. In Outlook on the web, Outlook.com and new Outlook, select More actions (...) at the top of the message, then View > View message details. In classic Outlook, open the message in its own window and select File > Properties. Our guide to reading email headers covers other clients.

Here is an example of what an unverified message can look like. The domains are placeholders:

Authentication-Results: spf=none (sender IP is 203.0.113.25)
  smtp.mailfrom=bulk-sender.example; dkim=none (message not signed)
  header.d=none; dmarc=none action=none header.from=contoso.com;
  compauth=fail reason=001
From: "Contoso Accounts" <accounts@contoso.com>

Read it like this:

• smtp.mailfrom=bulk-sender.example is the envelope sender. It's a different domain from header.from=contoso.com, the From address you see.
• spf=none and dkim=none mean neither method proved anything for the From domain.
• compauth=fail reason=001 is Microsoft's verdict. Microsoft Learn defines reason 001 as failed implicit authentication: the domain "didn't have email authentication records published, or if they did, they had a weaker failure policy (SPF ~all or ?all, or a DMARC policy of p=none)".

Some other codes you may see: 000 means the message failed DMARC and the domain's policy is quarantine or reject; 601 means the From domain is one of your own accepted domains, which usually points to a service sending as you without authentication. Paste the full header into our Microsoft 365 Spam Header Decoder to translate every code, or use the Email Header Analyzer for headers from any provider.

How do you stop your own emails showing a question mark?

Make every service that sends as your domain pass SPF or DKIM in a way that aligns with your From address, then publish DMARC. Microsoft's Learn page says that for the question mark, "SPF or DKIM are the most important". The fix is on the sending side. The recipient's settings can't repair your authentication.

1. Get a header from an affected message. Ask a recipient on Microsoft 365 or Outlook.com to send you the headers, or send a test to an Outlook.com address you control.
2. Identify the sending service. The smtp.mailfrom domain, the header.d value and the sending IP usually point to the platform: a CRM, invoicing app, website form plugin or help desk.
3. Turn on DKIM for your domain in that service. Most platforms give you CNAME or TXT records to publish. Our third-party sender authentication guide walks through it.
4. Add the service to SPF if it uses your domain as the envelope sender, while staying under the 10-lookup limit. The SPF Checker counts lookups for you.
5. Publish DMARC and read the aggregate reports to catch senders you missed. Start with how to read DMARC reports.
6. Retest and confirm the header shows dkim=pass with your domain in header.d, or spf=pass with your domain in smtp.mailfrom, and compauth=pass.

Our step-by-step guide to checking whether an email passed SPF, DKIM and DMARC explains how to confirm each result.

What can Microsoft 365 admins do about the question mark?

Admins have three options, and only the first two are good ones. Fix the sender's authentication where you can, allow a specific spoofed sender pair where you can't, and leave the indicator itself switched on.

Ask the sender to fix authentication

If a real partner's mail shows a question mark, send them the header and point them at the steps above. This fixes the problem for every recipient on the internet, not just your tenant.

Allow the spoofed sender pair

When a legitimate service can't authenticate as the From domain, you can allow that exact combination of From domain and sending infrastructure. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Tenant Allow/Block Lists, then the Spoofed senders tab. Microsoft says allowing the spoofed sender also stops the via tag appearing, "even if the Show 'via' tag setting is turned on". Our spoof intelligence guide shows how to find and allow the pair safely.

Turning the indicator off

The setting lives in each anti-phishing policy, under Email & collaboration > Policies & rules > Threat policies > Anti-phishing, in the Safety tips & indicators section. It's only available while spoof intelligence is on. In Exchange Online PowerShell the parameters are EnableUnauthenticatedSender and EnableViaTag on Set-AntiPhishPolicy, both $true by default and in the Standard and Strict presets.

Turning them off hides a warning that is right far more often than it is annoying. It may also not remove every warning: Microsoft's message center notice for the mobile unverified sender banner says that banner has no admin controls. If one sender is the problem, allow that pair instead.

If your MX record points to a filtering service in front of Microsoft 365, make sure Enhanced Filtering for Connectors is on, so Microsoft still sees the original sending IP when it judges authentication. Our Microsoft 365 platform page explains how that setup works with iBlockSpam.

Next steps

• Teach staff the rule: a question mark means "identity not proven", so verify before acting.
• If your own mail shows a question mark, check your domain's records with the DMARC Checker and fix the unauthenticated service.
• Admins: review the Spoofed senders tab monthly and remove allow entries you no longer need.
• If spoofed and unauthenticated mail keeps reaching Microsoft 365 mailboxes, a filtering layer in front of Exchange Online adds its own spoofing checks. See how iBlockSpam works with Microsoft 365.