Microsoft 365 Spam Header Decoder

What the decoder does

Every message delivered to a Microsoft 365 mailbox is scanned for spam, malware and phishing, and Microsoft writes the results into three headers (Microsoft Learn: Anti-spam message headers):

• X-Forefront-Antispam-Report: how the message was processed, as FIELD:value pairs separated by semicolons.
• X-Microsoft-Antispam: extra information about bulk mail and phishing, including the bulk complaint level (BCL).
• Authentication-Results: SPF, DKIM and DMARC results, plus Microsoft's composite authentication result (compauth) and its three-digit reason code.

The decoder finds those headers in what you paste and explains each value in plain English, using Microsoft's own definitions. It also reads X-MS-Exchange-Organization-SCL and any X-CustomSpam lines, and gives you a short summary of what Microsoft 365 decided and why.

It runs in your browser. Nothing is uploaded. The headers are decoded on your device with JavaScript, and every value is shown as plain text.

How to get the headers

1. In Outlook on the web or the new Outlook, open the message, select More actions, then View → View message details (Microsoft Support).
2. In classic Outlook for Windows, open the message and select File → Properties. The headers are in the Internet headers box.
3. Copy all of it and paste it into the box above.

Copy the headers from the recipient's mailbox, not from a forwarded copy. Forwarding creates a new message with new headers.

Read these fields first

Microsoft says the SCL no longer determines whether a message is spam or what happens to it in cloud organizations, and tells you to use CAT and DIR instead (Microsoft Learn: SCL). The decoder still shows the SCL, because on-premises Exchange and mail flow rules use it.

SFV values

SKA, SKI, SKN and SFE matter most when unwanted mail gets through. They mean an allow entry or rule that you or a user configured switched filtering off for that message, so the fix is that entry or rule.

BCL: is it bulk?

Microsoft assigns a bulk complaint level to mail from bulk senders (Microsoft Learn: BCL):

Mail at or above the threshold in your anti-spam policy is treated as bulk. The threshold is 7 in the default policy, 6 in the Standard preset and 5 in the Strict preset. If newsletters your users want keep landing in Junk with a high BCL, that's the threshold at work, not a fault.

Composite authentication and its reason codes

compauth combines SPF, DKIM, DMARC and other signals to decide whether the From domain is genuine. Microsoft notes that a message can still be allowed despite a compauth failure if nothing else looks suspicious. The reason code says why:

The decoder explains every code Microsoft lists, including 108, 112, 130 and the 5xx, 6xx and 7xx ranges.

If your MX points at a filtering service in front of Microsoft 365, codes like 905, or failures that name the filter's IP address, usually mean Microsoft is judging the filter instead of the original sender. Enhanced Filtering for Connectors on the inbound connector lets Microsoft see past it.

The DMARC action value

In Microsoft's Authentication-Results, dmarc=fail comes with an action. action=oreject means the sender publishes p=reject; Microsoft rejects such mail when Honor DMARC record policy is on in the anti-phishing policy, so seeing it in a mailbox means that setting is off or an override applied (Microsoft Learn: DMARC). pct.quarantine and pct.reject mean the sender's pct was below 100 and the action wasn't applied to this message.

Common patterns and what to do

Legitimate newsletter in Junk with CAT:BULK and a high BCL. The sender's complaint rate pushed it over your bulk threshold. Raise the threshold only if many users want this kind of mail, or let users move it themselves.

Phishing in the Inbox with SFV:SKA, SKI or SKN. An allow list, IP allow entry or mail flow rule skipped filtering. Narrow or remove it. Allowing a whole domain is risky, because a spoofed message from that domain is allowed too.

Your own domain marked CAT:SPOOF with compauth reason 010. Mail from your domain failed DMARC. Often it comes from a service you use that isn't in your SPF record or doesn't sign with DKIM. Check with the SPF Checker and DMARC Checker.

X-CustomSpam present. An Advanced Spam Filter setting in your anti-spam policy flagged the message. The value names the setting (Microsoft Learn: ASF settings).

For the full background, read Microsoft 365 spam headers explained. For the delivery path and delays between hops, paste the same headers into the Email Header Analyzer.

Limitations

• It decodes the fields Microsoft documents. Many other fields in these headers are, in Microsoft's words, used only by its anti-spam team for diagnostics; the decoder lists them but can't explain them.
• Headers can be forged. Values added before the message reached your Microsoft 365 organization prove nothing. Copies with "-Untrusted" in the header name aren't decoded.
• It reports what Microsoft recorded at delivery. It doesn't re-run any check, and your policies or the sender's DNS may have changed since.
• On-premises Exchange Server writes different anti-spam stamps. The decoder reads X-MS-Exchange-Organization-SCL, where -1 means the message bypassed antispam scanning and 0 to 9 rates the spam probability (Microsoft Learn: Antispam stamps), but not the other Exchange Server stamps.

Sources

• Microsoft Learn: Anti-spam message headers in cloud organizations
• Microsoft Learn: Spam confidence level (SCL)
• Microsoft Learn: Bulk complaint level (BCL)
• Microsoft Learn: Set up DMARC to validate the From address domain
• Microsoft Learn: Advanced Spam Filter (ASF) settings
• Microsoft Learn: Antispam stamps in Exchange Server
• Microsoft Support: View internet message headers in Outlook