Why did this email go to spam or quarantine?

Spam filters don't just say yes or no. They deliver a message to the inbox, deliver it to the spam or Junk folder, hold it in quarantine, or reject it outright. Where a message ended up tells you how risky the filter thought it was, and the headers tell you why. If it's your own outgoing mail that recipients find in spam, read why are my emails going to spam instead.

Is it in the spam folder or in quarantine?

Microsoft 365 shows the split clearly. Its default anti-spam policy moves spam, high confidence spam and phishing to the Junk Email folder, and quarantines high confidence phishing (Microsoft Learn). Microsoft says high confidence phishing is always quarantined, and "recipients can't release messages quarantined as high confidence phishing" (Microsoft Learn). Gmail delivers spam to the Spam folder unless an admin has set up admin quarantine.

To get a message back, see what an email quarantine is and how to release quarantined email in Microsoft 365. If legitimate mail keeps landing in Junk in Microsoft 365, our guide to Microsoft 365 emails going to junk covers the usual settings.

How do you find the reason in the headers?

Every filter records its decision in the message headers. You need three pieces:

1. The trusted Authentication-Results header. It's the topmost one, added by your own mail platform or filtering service (RFC 8601). It shows whether SPF, DKIM and DMARC passed, and for which domain. DMARC needs SPF or DKIM to pass for a domain matching From.
2. The filter's verdict. In Microsoft 365, the X-Forefront-Antispam-Report header holds it. Microsoft says to use CAT (the policy category, such as SPM spam, PHSH phishing, SPOOF, BULK) and DIR rather than SCL to understand cloud filtering. SFV:SPM means spam filtering marked it as spam. Other systems use headers such as X-Spam-Status or X-Spam-Flag.
3. The Received chain, read from bottom to top, to see which servers handled the message and from which IP.

Our Email Header Analyzer pulls these out for you in your browser. For a full walkthrough of every header, with examples for each mail client, see how to read email headers.

Common verdicts and what they mean

When authentication passed but it's still in spam

Passing SPF, DKIM and DMARC proves the sender is who they say. It doesn't prove the mail is wanted. Gmail's spam help page lists reasons including senders it can't confirm, look-alike addresses, phishing, admin policies, and earlier messages you reported as spam. Filters also weigh:

• The sending server's IP reputation. The Blacklist Checker shows whether an IP from the Received: chain is on a public blocklist.
• Links to domains with a poor reputation, or URL shorteners.
• Attachment types commonly used for malware, and Office files with macros.
• Bulk-mail characteristics and complaint rates.
• How users treated earlier mail from the same sender.

For one-off cases, release the message and mark it as not spam. For repeat cases, see our guide on handling false positives safely.

When the message never arrived at all

Headers only exist for messages that were delivered somewhere. If a message is missing entirely, check the quarantine and junk folders first, then ask the sender for the bounce message they received, if any. A bounce contains an SMTP status code and often the reason, such as 550 5.7.26 for an authentication failure at Gmail, or 556 5.1.10 when the recipient domain publishes Null MX. Our SMTP error code lookup explains other codes in plain English. If the sender got no bounce, the message may still be queued on their side or spooled during an outage.

How iBlockSpam helps

Our free Email Header Analyzer lays out the Received chain, authentication results and alignment, and runs entirely in your browser; nothing is uploaded. iBlockSpam customers can also look up messages in 30 days of message history and see quarantined mail in personal and domain-wide quarantines, which is often faster than digging through headers. Headers still matter when a message was junked after it left our filtering, for example by your mailbox platform.

Next steps

1. Find the message in Junk or quarantine and open its headers in the free Email Header Analyzer.
2. If SPF, DKIM or DMARC failed, ask the sender to check their domain with the Email Health Check.
3. If the message is safe, release it and report it as not junk so the filter learns.

Related: how to allow a sender in Microsoft 365 and Google Workspace and Outlook junk email filter settings.

Browse more guides on running email day to day.