# Why did this email go to spam or quarantine?

URL: https://iblockspam.com/blog/why-did-this-email-land-in-spam
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Why an email went to the spam folder or quarantine, what each spam verdict means, how to find the reason in the headers, and how to fix or release the message.

## Short answer

Check whether it's in Junk or in quarantine. Junk means the filter delivered it but judged it unwanted; quarantine means it was held outside the mailbox because the risk looked higher. The reason is in the headers: SPF, DKIM and DMARC results, plus the filter's verdict, such as Microsoft's CAT and SFV values.

Spam filters don't just say yes or no. They deliver a message to the inbox, deliver it to the spam or Junk folder, hold it in quarantine, or reject it outright. Where a message ended up tells you how risky the filter thought it was, and the headers tell you why. If it's your own outgoing mail that recipients find in spam, read [why are my emails going to spam](https://iblockspam.com/blog/why-are-my-emails-going-to-spam) instead.

## Is it in the spam folder or in quarantine?

| Where it is | What happened | Who can get it back |
|---|---|---|
| Spam or Junk folder | Delivered, but the filter judged it unwanted | The user, by moving it and marking it not spam |
| Quarantine | Held outside the mailbox because the verdict was riskier | The user or an admin, depending on the verdict and policy |
| Nowhere (bounced) | Rejected during delivery; the sender got a bounce | Only the sender, by fixing the cause and resending |

Microsoft 365 shows the split clearly. Its default anti-spam policy moves spam, high confidence spam and phishing to the Junk Email folder, and quarantines high confidence phishing ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)). Microsoft says high confidence phishing is always quarantined, and "recipients can't release messages quarantined as high confidence phishing" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure)). Gmail delivers spam to the Spam folder unless an admin has set up admin quarantine.

To get a message back, see [what an email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine) and [how to release quarantined email in Microsoft 365](https://iblockspam.com/blog/release-quarantined-email-microsoft-365). If legitimate mail keeps landing in Junk in Microsoft 365, our guide to [Microsoft 365 emails going to junk](https://iblockspam.com/blog/microsoft-365-emails-going-to-junk) covers the usual settings.

## How do you find the reason in the headers?

Every filter records its decision in the message headers. You need three pieces:

1. **The trusted Authentication-Results header.** It's the topmost one, added by your own mail platform or filtering service ([RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html)). It shows whether SPF, DKIM and DMARC passed, and for which domain. DMARC needs SPF or DKIM to pass **for a domain matching From**.
2. **The filter's verdict.** In Microsoft 365, the [`X-Forefront-Antispam-Report`](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo) header holds it. Microsoft says to use `CAT` (the policy category, such as `SPM` spam, `PHSH` phishing, `SPOOF`, `BULK`) and `DIR` rather than `SCL` to understand cloud filtering. `SFV:SPM` means spam filtering marked it as spam. Other systems use headers such as `X-Spam-Status` or `X-Spam-Flag`.
3. **The Received chain**, read from bottom to top, to see which servers handled the message and from which IP.

Our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) pulls these out for you in your browser. For a full walkthrough of every header, with examples for each mail client, see [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers).

## Common verdicts and what they mean

| What you see | Likely cause | What to do |
|---|---|---|
| `spf=fail` and `dmarc=fail`, DKIM missing | Sender's server isn't in their SPF and they don't sign | Sender fixes SPF and DKIM |
| `dkim=fail (body hash did not verify)` | Message changed after signing (list footer, link rewriting) | Usually expected for lists; check ARC |
| `spf=permerror` | Sender's SPF is broken, often over 10 DNS lookups | Sender fixes SPF |
| `dmarc=fail` with `spf=pass` and `dkim=pass` | Neither passing domain aligns with From | Sender sets up custom DKIM |
| All pass, `CAT:BULK` | Microsoft identified bulk mail | Normal for newsletters; adjust bulk threshold if needed |
| All pass, `CAT:SPM` | Content, links or reputation | Release; report as not spam |
| `compauth=fail reason=905` | Mail routed through another service before Microsoft 365 | Enable Enhanced Filtering for Connectors |
| SPF evaluated against your gateway's IP | Mailbox platform doesn't know about the gateway | Configure the connector or inbound gateway |

## When authentication passed but it's still in spam

Passing SPF, DKIM and DMARC proves the sender is who they say. It doesn't prove the mail is wanted. Gmail's [spam help page](https://support.google.com/mail/answer/1366858) lists reasons including senders it can't confirm, look-alike addresses, phishing, admin policies, and earlier messages you reported as spam. Filters also weigh:

- The sending server's IP reputation. The [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker) shows whether an IP from the `Received:` chain is on a public blocklist.
- Links to domains with a poor reputation, or URL shorteners.
- Attachment types commonly used for malware, and Office files with macros.
- Bulk-mail characteristics and complaint rates.
- How users treated earlier mail from the same sender.

For one-off cases, release the message and mark it as not spam. For repeat cases, see our guide on [handling false positives safely](https://iblockspam.com/blog/false-positives-legitimate-email-flagged).

## When the message never arrived at all

Headers only exist for messages that were delivered somewhere. If a message is missing entirely, check the quarantine and junk folders first, then ask the sender for the bounce message they received, if any. A bounce contains an SMTP status code and often the reason, such as [`550 5.7.26`](https://iblockspam.com/smtp-errors/550-5-7-26) for an authentication failure at Gmail, or [`556 5.1.10`](https://iblockspam.com/smtp-errors/556-5-1-10) when the recipient domain publishes Null MX. Our [SMTP error code lookup](https://iblockspam.com/tools/smtp-error-codes) explains other codes in plain English. If the sender got no bounce, the message may still be queued on their side or spooled during an outage.

## How iBlockSpam helps

Our free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) lays out the Received chain, authentication results and alignment, and runs entirely in your browser; nothing is uploaded. iBlockSpam customers can also look up messages in 30 days of message history and see quarantined mail in personal and domain-wide quarantines, which is often faster than digging through headers. Headers still matter when a message was junked after it left our filtering, for example by your mailbox platform.

## Next steps

1. Find the message in Junk or quarantine and open its headers in the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
2. If SPF, DKIM or DMARC failed, ask the sender to check their domain with the [Email Health Check](https://iblockspam.com/tools/email-health-check).
3. If the message is safe, release it and report it as not junk so the filter learns.

Related: [how to allow a sender in Microsoft 365 and Google Workspace](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) and [Outlook junk email filter settings](https://iblockspam.com/blog/outlook-junk-email-filter-settings).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What is the difference between the spam folder and quarantine?

A message in the spam or Junk folder has been delivered into the mailbox, so its links and attachments are a click away. A quarantined message is held outside the mailbox until a user or admin releases it. Filters usually quarantine the riskier verdicts, such as high confidence phishing and malware.

### Which Authentication-Results header should I trust?

The one added by your own mail server or your filtering service, which is normally the highest one in the headers. Anything lower down was added before the message reached you, and a sender can write whatever it likes there.

### The headers say everything passed. Why is it still in spam?

Authentication only proves who sent the message. Filters also weigh content, links, attachments, the sender's reputation, user reports and bulk-mail signals. A perfectly authenticated message can still look like spam.

### What does compauth=fail reason=905 mean in Microsoft 365?

Microsoft documents reason 905 as DMARC not enforced because of complex routing, such as mail passing through a non-Microsoft service first. If you use a filtering gateway, enable Enhanced Filtering for Connectors.

## Sources

- [RFC 5321: Simple Mail Transfer Protocol, section 4.4 Trace Information](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.4)
- [RFC 5322: Internet Message Format](https://www.rfc-editor.org/rfc/rfc5322.html)
- [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html)
- [RFC 8617: Authenticated Received Chain (ARC)](https://www.rfc-editor.org/rfc/rfc8617.html)
- [RFC 6376: DKIM Signatures](https://www.rfc-editor.org/rfc/rfc6376.html)
- [Microsoft Learn: Configure spam filter policies](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure)
- [Microsoft Learn: Recommended settings for EOP and Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [Microsoft Learn: Anti-spam message headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
- [Gmail Help: Report spam in Gmail (spam warnings)](https://support.google.com/mail/answer/1366858)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.
- [Reverse DNS (PTR) Lookup](https://iblockspam.com/tools/ptr-lookup): Check PTR records, forward-confirmed reverse DNS and generic-looking host names.
- [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict.

---

Source: iBlockSpam, https://iblockspam.com/blog/why-did-this-email-land-in-spam (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt