Email admin guides: headers, false positives, allow lists and outages
False positives, headers, allow lists, outages and the everyday questions admins get asked.
Start here
More guides
Why is spam getting through the Microsoft 365 spam filter, and how do you fix it?
Why spam reaches Microsoft 365 inboxes: allow lists, SCL -1 rules, weak policies, Direct Send. How to find the cause in headers and fix it step by step.
9 min read Running email day to dayHow do you find and release quarantined email in Microsoft 365?
Find and release quarantined email in the Microsoft Defender portal as an admin or user, set quarantine policies and notifications, and use PowerShell safely.
9 min read Running email day to dayWhy are legitimate emails going to Junk in Microsoft 365, and how do you fix it?
Why legitimate email lands in Junk in Outlook and Microsoft 365: user lists, bulk scores, spoof checks and sender authentication. Diagnose from headers and fix.
9 min read Running email day to dayHow do you test that your spam filter is actually working?
Prove a spam filter works with three checks: mail goes through it, it applies its policies, and clean mail reaches the right inbox. Sign-off sheet included.
9 min read Running email day to dayHow do you manage email security across multiple domains?
Protect every domain your business owns: build an inventory, classify each domain, roll out filtering one at a time, lock down non-sending domains and monitor.
9 min read Running email day to dayHow do you protect a shared mailbox from spam and phishing?
Protect shared mailboxes such as sales@ and accounts@: name an owner, limit access, decide who reviews held mail, add payment checks and test every address.
9 min read Running email day to dayShould you use a catch-all email address?
Why catch-all mailboxes attract spam and dictionary attacks, how to turn them off in Microsoft 365, Google Workspace and cPanel, and what to use instead.
9 min read Running email day to dayWhat are email feedback loops and how do you set them up?
How complaint feedback loops work: ARF reports (RFC 5965), Yahoo CFL, Microsoft JMRP and Gmail's Feedback-ID loop, how to enroll and how to act on complaints.
9 min read Running email day to dayHow do you build an email security incident response plan for a small business?
A small-business playbook for email incidents: roles, first-hour steps, containment in Microsoft 365 and Google Workspace, evidence, notices and lessons.
11 min read Running email day to dayWhich email security metrics should admins track each month?
The email security metrics to track each month, where to find them in Microsoft 365 and Google Workspace reports, and a simple monthly report template to copy.
9 min read Running email day to dayWhat are the email sending limits in Microsoft 365 and Google Workspace?
Per-user email sending limits in Microsoft 365 and Google Workspace, the bounce codes you get when you exceed them, and how to send bulk email the right way.
9 min read Running email day to dayHow do you secure email when an employee leaves?
Offboard leavers safely in Microsoft 365 and Google Workspace: block sign-in, revoke sessions, keep or convert the mailbox, forwarding, delegates and devices.
10 min read Running email day to dayHow do you set up and manage the Gmail admin quarantine in Google Workspace?
How Gmail admin quarantine works in Google Workspace: default and custom quarantines, reviewers, allow and deny, notifications and the 30-day retention limit.
9 min read Running email day to dayHow do you use Email Log Search in Google Workspace?
Use Email Log Search in the Google Admin console to find missing messages, read delivery and spam statuses, and fix what you find. Limits and tips included.
9 min read Running email day to dayHow do you use the Google Workspace security investigation tool to remove phishing email?
Use the Google Workspace security investigation tool to find a phishing email in every mailbox and delete or quarantine it. Editions, privileges and limits.
9 min read Running email day to dayIPv6 email deliverability: what you need before sending over IPv6
Sending mail over IPv6? What Gmail and Microsoft require, why IPv6 gets less benefit of the doubt, SPF ip6 syntax, IPv6 PTR checks and forcing IPv4 in Postfix.
9 min read Running email day to dayHow do you find and block malicious inbox rules and auto-forwarding?
How attackers use inbox rules and forwarding to hide replies and copy mail, how to find them in Outlook, PowerShell and Gmail, and how to block forwarding.
10 min read Running email day to dayWhich Microsoft 365 alert policies matter for email, and how do you set them up?
Which default Microsoft 365 alert policies cover email, who gets notified, how to route alerts to the right people, build custom alerts, and what licenses add.
9 min read Running email day to dayHow do you use the Microsoft 365 audit log to investigate an email incident?
Use Microsoft Purview Audit to investigate a hacked mailbox: MailItemsAccessed, Send, inbox rule and forwarding events, retention and Search-UnifiedAuditLog.
10 min read Running email day to dayHow does automated investigation and response (AIR) work in Microsoft 365?
How AIR in Defender for Office 365 Plan 2 works: which alerts trigger it, what the playbooks check, approving pending actions in the Action center, and limits.
9 min read Running email day to dayHow do you run a message trace in Microsoft 365?
Run a message trace in the Exchange admin center or with Get-MessageTraceV2, search up to 90 days back, and read statuses like Quarantined and Filtered as spam.
9 min read Running email day to dayHow do quarantine policies and notifications work in Microsoft 365?
Design Microsoft 365 quarantine policies: default policies, user permissions, custom policies, notification frequency, branding, languages and assignment.
9 min read Running email day to dayHow do you set up the Report button and user reported settings in Microsoft 365?
Set up the Outlook Report button in Microsoft 365: user reported settings, a reporting mailbox, reviewing reports on the Submissions page and sending users feedback.
10 min read Running email day to dayThreat Explorer vs Real-time detections: how do you investigate email in Microsoft 365?
How Threat Explorer (Plan 2) and Real-time detections (Plan 1) differ: views, filters, finding a phishing campaign, soft delete and move actions, 30-day data.
9 min read Running email day to dayWhat does zero-hour auto purge (ZAP) do in Microsoft 365?
How Microsoft 365 zero-hour auto purge pulls spam, phishing and malware from inboxes after delivery, its 48-hour window, where mail goes and when ZAP won't act.
9 min read Running email day to dayMobile email security: how to protect work email on personal phones
How to secure work email on personal phones: lost devices, risky apps, smishing, Intune app protection, Google mobile management and rules staff can follow.
9 min read Running email day to dayAre out-of-office auto-replies a security risk?
What out-of-office replies leak, why replying to spam confirms your address, and how to limit external auto-replies in Microsoft 365, Outlook and Gmail.
9 min read Running email day to dayHow do you get email delivered to Outlook.com and Hotmail?
Get mail into Outlook.com and Hotmail inboxes: set up SNDS and JMRP, meet the 2025 high-volume sender rules, decode bounce codes and contact sender support.
10 min read Running email day to dayHow do Outlook's junk email filter settings work, and which should you use?
Outlook Junk Email Filter levels, Safe and Blocked Senders lists, size limits, and how classic Outlook, new Outlook and the web app work with Microsoft 365.
9 min read Running email day to dayWhy aren't my password reset emails arriving?
Why password reset and verification emails from your site or app go missing or land in spam, how to diagnose it step by step, and the fixes that hold up.
9 min read Running email day to dayHow do you protect public email addresses like info@ from spam?
Keep info@, sales@ and careers@ addresses usable: how address harvesting works, what obfuscation can't do, safer contact forms, shared mailboxes and filtering.
9 min read Running email day to dayHow do you restrict who can email a distribution list?
Stop outside spam reaching all@ and staff@ lists: restrict senders on Microsoft 365 distribution groups and Google Groups, and allow trusted partners safely.
8 min read Running email day to dayShould you use separate subdomains for marketing and transactional email?
Why to send marketing and transactional email from separate subdomains, how far reputation isolation goes, and how to set up SPF, DKIM and DMARC for each.
9 min read Running email day to dayWhat are spam traps, and how do you avoid them?
What spam traps are, how pristine, recycled and typo traps get onto lists, what a hit does to reputation and blocklist status, and how to avoid them.
9 min read Running email day to dayWho are the unknown sources in my DMARC reports?
How to identify unrecognized IPs in DMARC aggregate reports (forwarders, mailing lists, forgotten SaaS senders, spoofers) and what to do about each one.
9 min read Running email day to dayHow to stop spammers bypassing your filter by delivering straight to your mail server
Spammers can skip your MX and deliver straight to Microsoft 365, Google Workspace or your server. Lock each one to your filter, test it, roll back.
9 min read Running email day to dayHow do you block a sender or domain in Microsoft 365?
Block an email address or domain in Microsoft 365 with the Tenant Allow/Block List, anti-spam policies, mail flow rules or Outlook, and how long blocks last.
9 min read Running email day to dayEmail security checklist for small businesses in 2026
A practical 2026 email security checklist for small businesses: MFA, SPF, DKIM and DMARC, filtering, backups, staff training and an incident plan.
9 min read Running email day to dayEmail security for remote teams: what to set up first
Protect email for a remote or hybrid team: MFA, conditional access basics, personal devices, home networks and verification rules, with CISA and NCSC advice.
9 min read Running email day to dayEmail warm-up: how to warm up a new domain or IP address
How to warm up a new sending domain or IP: why receivers distrust new senders, a cautious ramp based on provider guidance, and the signals to watch as you go.
9 min read Running email day to dayLegitimate email flagged as spam: why false positives happen and how to fix them safely
Why real business email gets quarantined or junked, how to release it safely, and how to allowlist senders without opening a door for spoofed mail.
8 min read Running email day to dayHow do you set up and read Google Postmaster Tools?
Set up Google Postmaster Tools, verify your domain and read each dashboard, from Compliance status to spam rate and delivery errors, with what to do about each.
10 min read Running email day to dayHard bounce vs soft bounce: what's the difference and what should you do?
The difference between hard and soft email bounces, how RFC 3463 status codes classify them, when to retry or remove an address, and how to keep lists clean.
9 min read Running email day to dayHow to read email headers
Read email headers step by step: the Received chain from the bottom up, Authentication-Results, ARC, Return-Path, Message-ID and Microsoft 365 anti-spam fields.
10 min read Running email day to dayWhich Microsoft 365 mail flow rules improve email security, and how do you set them up safely?
Useful Exchange Online mail flow rules for security: block external auto-forwarding, add warnings, stop risky attachments, test safely and avoid SCL -1 rules.
9 min read Running email day to dayMicrosoft 365 spam headers explained: how to read SFV, CAT, BCL and compauth
Read Microsoft 365 anti-spam headers: what SFV, CAT, SCL, BCL, IPV, SFTY, X-CustomSpam and compauth reason codes mean, and how to find what filtered a message.
9 min read Running email day to dayOne-click unsubscribe (RFC 8058): how to set it up and test it
How RFC 8058 one-click unsubscribe works: the List-Unsubscribe and List-Unsubscribe-Post headers, Gmail and Yahoo rules, DKIM coverage and how to test it.
9 min read Running email day to dayHow to get your domain or IP removed from an email blacklist
How to check if your mail server IP or domain is on a DNS blocklist, find the real cause, and request removal from Spamhaus, SpamCop, Barracuda and Microsoft.
9 min read Running email day to dayReverse DNS and PTR records for mail servers
What a PTR record is, why Gmail, Yahoo and others require forward-confirmed reverse DNS for sending IPs, who can set it, and how to check yours is right.
8 min read Running email day to dayShared vs dedicated IP for email: which one do you need?
Shared vs dedicated sending IPs: how each affects reputation, cost and warm-up, what Amazon SES, SendGrid and Mailgun say about volume, and how to choose.
9 min read Running email day to daySpam complaint rate explained: what it is and how to lower it
What a spam complaint rate is, Gmail's 0.1% and 0.3% limits, Yahoo's 0.3%, how to measure it with Postmaster Tools and feedback loops, and how to bring it down.
9 min read Running email day to dayWhy are my website form emails going to spam?
Why WordPress and contact form emails land in spam or vanish: PHP mail(), the From address, SPF and DKIM for the sender, and switching to authenticated SMTP.
9 min read Running email day to dayWhat happens to email when your mail server is down?
Senders retry when your mail server is down, but not forever. How SMTP retries work, 4xx vs 5xx errors, what senders see, and how outage spooling helps.
8 min read Running email day to dayHow do you safely whitelist a sender in Microsoft 365 and Google Workspace?
Safely allow (whitelist) a sender in Microsoft 365 and Google Workspace without opening a spoofing hole: Tenant Allow/Block List, approved senders and gateways.
9 min read Running email day to dayWhy are my emails going to spam, and how do I fix it?
Why your outgoing emails land in spam at Gmail or Outlook: authentication, alignment, spam complaints, blocklists, reverse DNS, new domains and forwarding.
10 min read Running email day to dayWhy did this email go to spam or quarantine?
Why an email went to the spam folder or quarantine, what each spam verdict means, how to find the reason in the headers, and how to fix or release the message.
9 min readAbout these guides
Once mail is flowing, most admin work is answering the same handful of questions. Why did this message land in spam? Why didn't that one arrive at all? Can we trust this sender? Is our server on a blocklist? These guides give you a method for each, built on evidence you can check rather than guesswork.
- Tracing a message: reading email headers, finding the Authentication-Results line your own server added, and seeing where time was lost between hops.
- False positives and allow lists: releasing mail safely, and allow-listing narrowly so you don't open a hole for spoofed senders.
- Reputation: reverse DNS (PTR) for servers that send mail, and getting an IP address or domain off a blocklist.
- Outages and bypasses: what sending servers do when yours is down, and how to stop spammers delivering straight to your mail server.
- Routine checks: a small business email security checklist to work through on a regular schedule.
Headers are usually the fastest route to an answer. Paste them into the free Email Header Analyzer, which runs in your browser so nothing is uploaded. For reputation questions, use the Blacklist Checker and the PTR Lookup. When something keeps breaking, write down what changed and when: many mail problems trace back to a recent DNS or routing change, which is what domain monitoring is designed to catch.
Frequently asked questions
Where should I start when a user says an email never arrived?
Ask the sender for any bounce message first; its SMTP code usually names the reason. Then search your filter's quarantine and message history, and the recipient's junk folder. If there's no bounce and no trace, the sending server may still be retrying, because servers queue temporary failures and try again for several days.
How often should I review allow lists?
On a schedule, for example quarterly, and whenever a supplier or staff member changes. Remove entries nobody can explain, replace whole-domain entries with single addresses where you can, and prefer entries that only apply when the sender passes SPF, DKIM or DMARC. Stale entries let spoofed mail skip filtering.
Why would mail from our own server go to other people's spam?
Common causes are a missing or generic reverse DNS (PTR) record, a sending IP on a public blocklist, failing SPF or DKIM, or a DMARC policy the message doesn't pass. Check each one with the free tools, fix what's wrong, then send a test to a mailbox at another provider and read the result in its headers.