# Microsoft 365 Spam Header Decoder

URL: https://iblockspam.com/tools/microsoft-365-header-analyzer
Last updated: 2026-10-22

> Paste the headers of a message from a Microsoft 365 mailbox to see why it landed in Junk, quarantine or the Inbox: every SFV, CAT, SCL, BCL and compauth value, explained.

Free tool: Paste Microsoft 365 headers to decode SFV, CAT, SCL, BCL and compauth reason codes in plain English — runs in your browser. Use it at https://iblockspam.com/tools/microsoft-365-header-analyzer

## What the decoder does

Every message delivered to a Microsoft 365 mailbox is scanned for spam, malware and phishing, and Microsoft writes the results into three headers ([Microsoft Learn: Anti-spam message headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)):

- **X-Forefront-Antispam-Report:** how the message was processed, as `FIELD:value` pairs separated by semicolons.
- **X-Microsoft-Antispam:** extra information about bulk mail and phishing, including the bulk complaint level (BCL).
- **Authentication-Results:** SPF, DKIM and DMARC results, plus Microsoft's composite authentication result (`compauth`) and its three-digit reason code.

The decoder finds those headers in what you paste and explains each value in plain English, using Microsoft's own definitions. It also reads `X-MS-Exchange-Organization-SCL` and any `X-CustomSpam` lines, and gives you a short summary of what Microsoft 365 decided and why.

**It runs in your browser. Nothing is uploaded.** The headers are decoded on your device with JavaScript, and every value is shown as plain text.

## How to get the headers

1. In Outlook on the web or the new Outlook, open the message, select **More actions**, then **View** → **View message details** ([Microsoft Support](https://support.microsoft.com/office/cd039382-dc6e-4264-ac74-c048563d212c)).
2. In classic Outlook for Windows, open the message and select **File** → **Properties**. The headers are in the **Internet headers** box.
3. Copy all of it and paste it into the box above.

Copy the headers from the recipient's mailbox, not from a forwarded copy. Forwarding creates a new message with new headers.

## Read these fields first

| Field | Where | What it tells you |
|---|---|---|
| `SFV` | X-Forefront-Antispam-Report | The spam filtering verdict: spam, not spam, or skipped because of an allow or block list or a rule |
| `CAT` | X-Forefront-Antispam-Report | The category of protection that acted, such as `BULK`, `SPM`, `HSPM`, `PHSH`, `HPHSH`, `SPOOF` or `MALW` |
| `DIR` | X-Forefront-Antispam-Report | Direction: `INB` inbound, `OUT` outbound, `INT` internal |
| `BCL` | X-Microsoft-Antispam | Bulk complaint level, 0 to 9 |
| `compauth` and `reason` | Authentication-Results | Microsoft's verdict on whether the From domain is authentic, with a three-digit code |

Microsoft says the SCL no longer determines whether a message is spam or what happens to it in cloud organizations, and tells you to use `CAT` and `DIR` instead ([Microsoft Learn: SCL](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)). The decoder still shows the SCL, because on-premises Exchange and mail flow rules use it.

### SFV values

| Value | Meaning |
|---|---|
| `SFV:NSPM` | Spam filtering marked the message as not spam. |
| `SFV:SPM` | Spam filtering marked the message as spam. |
| `SFV:SKA` | Skipped filtering: the sender is on an anti-spam policy's allowed senders or domains list. |
| `SFV:SKB` | Marked as spam: the sender is on an anti-spam policy's blocked senders or domains list. |
| `SFV:SKI` | Skipped filtering: the source IP is on the connection filter's IP Allow List. |
| `SFV:SKN` | Skipped filtering because of a mail flow rule. |
| `SFV:SKS` | Marked as spam before filtering, by a mail flow rule that set the SCL or a decision from on-premises Exchange. |
| `SFV:SFE` | Skipped filtering: the sender is on the user's Safe Senders list. |
| `SFV:BLK` | Blocked: the sender is on the user's Blocked Senders list. |
| `SFV:SKQ` | Released from quarantine. |

`SKA`, `SKI`, `SKN` and `SFE` matter most when unwanted mail gets through. They mean an allow entry or rule that you or a user configured switched filtering off for that message, so the fix is that entry or rule.

### BCL: is it bulk?

Microsoft assigns a bulk complaint level to mail from bulk senders ([Microsoft Learn: BCL](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)):

| BCL | Meaning |
|---|---|
| 0 | Not from a bulk sender |
| 1–3 | A bulk sender that generates few complaints |
| 4–7 | A bulk sender that generates a mixed number of complaints |
| 8–9 | A bulk sender that generates a high number of complaints |

Mail at or above the threshold in your anti-spam policy is treated as bulk. The threshold is 7 in the default policy, 6 in the Standard preset and 5 in the Strict preset. If newsletters your users want keep landing in Junk with a high BCL, that's the threshold at work, not a fault.

## Composite authentication and its reason codes

`compauth` combines SPF, DKIM, DMARC and other signals to decide whether the From domain is genuine. Microsoft notes that a message can still be allowed despite a compauth failure if nothing else looks suspicious. The reason code says why:

| Code | Result | Meaning |
|---|---|---|
| 000 | fail | Failed DMARC, and the sender's policy is p=quarantine or p=reject |
| 001 | fail | The sender has no authentication records, or only weak ones (SPF ~all or ?all, DMARC p=none) |
| 010 | fail | Failed DMARC with an enforced policy, and the domain is one of your own accepted domains |
| 1xx | pass | Passed, for example 100 (SPF or DKIM passed and aligned) or 101 (DKIM-signed by the From domain) |
| 2xx | softpass | Soft-passed implicit authentication |
| 905 | none | DMARC not enforced because of complex routing, such as mail passing through another service first |

The decoder explains every code Microsoft lists, including 108, 112, 130 and the 5xx, 6xx and 7xx ranges.

If your MX points at a filtering service in front of Microsoft 365, codes like 905, or failures that name the filter's IP address, usually mean Microsoft is judging the filter instead of the original sender. [Enhanced Filtering for Connectors](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) on the inbound connector lets Microsoft see past it.

### The DMARC action value

In Microsoft's `Authentication-Results`, `dmarc=fail` comes with an `action`. `action=oreject` means the sender publishes p=reject; Microsoft rejects such mail when **Honor DMARC record policy** is on in the anti-phishing policy, so seeing it in a mailbox means that setting is off or an override applied ([Microsoft Learn: DMARC](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)). `pct.quarantine` and `pct.reject` mean the sender's pct was below 100 and the action wasn't applied to this message.

## Common patterns and what to do

**Legitimate newsletter in Junk with `CAT:BULK` and a high BCL.** The sender's complaint rate pushed it over your bulk threshold. Raise the threshold only if many users want this kind of mail, or let users move it themselves.

**Phishing in the Inbox with `SFV:SKA`, `SKI` or `SKN`.** An allow list, IP allow entry or mail flow rule skipped filtering. Narrow or remove it. Allowing a whole domain is risky, because a spoofed message from that domain is allowed too.

**Your own domain marked `CAT:SPOOF` with compauth reason 010.** Mail from your domain failed DMARC. Often it comes from a service you use that isn't in your SPF record or doesn't sign with DKIM. Check with the [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).

**`X-CustomSpam` present.** An Advanced Spam Filter setting in your anti-spam policy flagged the message. The value names the setting ([Microsoft Learn: ASF settings](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-asf-settings-about)).

For the full background, read [Microsoft 365 spam headers explained](https://iblockspam.com/blog/microsoft-365-spam-headers-explained). For the delivery path and delays between hops, paste the same headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).

## Limitations

- It decodes the fields Microsoft documents. Many other fields in these headers are, in Microsoft's words, used only by its anti-spam team for diagnostics; the decoder lists them but can't explain them.
- Headers can be forged. Values added before the message reached your Microsoft 365 organization prove nothing. Copies with "-Untrusted" in the header name aren't decoded.
- It reports what Microsoft recorded at delivery. It doesn't re-run any check, and your policies or the sender's DNS may have changed since.
- On-premises Exchange Server writes different anti-spam stamps. The decoder reads `X-MS-Exchange-Organization-SCL`, where -1 means the message bypassed antispam scanning and 0 to 9 rates the spam probability ([Microsoft Learn: Antispam stamps](https://learn.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps)), but not the other Exchange Server stamps.

## Sources

- [Microsoft Learn: Anti-spam message headers in cloud organizations](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
- [Microsoft Learn: Spam confidence level (SCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)
- [Microsoft Learn: Bulk complaint level (BCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)
- [Microsoft Learn: Set up DMARC to validate the From address domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [Microsoft Learn: Advanced Spam Filter (ASF) settings](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-asf-settings-about)
- [Microsoft Learn: Antispam stamps in Exchange Server](https://learn.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps)
- [Microsoft Support: View internet message headers in Outlook](https://support.microsoft.com/office/cd039382-dc6e-4264-ac74-c048563d212c)

## Frequently asked questions

### Which header shows why Microsoft 365 sent a message to Junk?

X-Forefront-Antispam-Report. Its SFV field holds the spam filtering verdict, such as SFV:SPM for spam or SFV:SKA for a sender allowed by policy, and its CAT field names the protection that acted, such as BULK, PHSH or SPOOF. Read those two first, then BCL and compauth.

### What does SFV:SKA mean in Microsoft 365 headers?

SFV:SKA means the message skipped spam filtering and went to the Inbox because the sender is on the allowed senders or allowed domains list of an anti-spam policy. If unwanted mail arrives with SKA, the allow entry let it in: narrow it to the exact sender you trust or remove it.

### Why does a message have SCL 1 but still go to Junk?

In Microsoft 365 the SCL no longer decides the verdict or the action. Microsoft says filtering uses categories and other signals, so the same SCL can appear on messages with different verdicts. Use SFV and CAT to see what happened; SCL mainly matters to on-premises Exchange and mail flow rules.

### What does compauth reason 001 mean?

Reason 001 means the message failed implicit authentication: the sending domain publishes no email authentication records, or only a weak policy such as SPF ~all, SPF ?all or DMARC p=none. The fix is on the sender's side: publish SPF, sign with DKIM and publish an enforced DMARC policy.

### Does the decoder work for Outlook.com or Gmail headers?

It decodes the fields Microsoft documents for cloud mailboxes, which are the X-Forefront-Antispam-Report, X-Microsoft-Antispam and Authentication-Results headers that Microsoft 365 adds. Other providers write different headers; for those, use the general Email Header Analyzer, which reads Received hops and authentication results from any provider.

---

Source: iBlockSpam, https://iblockspam.com/tools/microsoft-365-header-analyzer (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt