InboxRatio
Check your domain

How the Outlook spam filter judges your mail: Microsoft's filtering layers, from a sender's side

Most pages about the Outlook spam filter are written for the person reading the mail: how to find the Junk folder, how to add a safe sender. This one is written for the person sending it. If your newsletter, invoices or sales mail keep landing in junk at Microsoft addresses, the recipient-side settings are the last and smallest part of the story. (Recipients looking for those settings will find them in Microsoft Support's junk email pages.) What decides placement happens earlier, in systems Microsoft documents for senders and administrators, and the first surprise is that there is more than one of them.

Which Outlook is filtering you

"Outlook" is a brand stretched over three different filtering contexts, and a sender needs to know which one is in play.

  • Outlook.com consumer mailboxes: outlook.com, hotmail.com, live.com and related addresses. Microsoft publishes provider-level sender rules for these through its Outlook.com postmaster site, along with the SNDS and JMRP programs.
  • Microsoft 365 business tenants: any company domain whose mail is hosted in Exchange Online. Inbound mail passes through Exchange Online Protection (EOP), whose anti-spam policies each organization's administrators can tune.
  • The Outlook app itself: the classic Outlook client's Junk Email Filter and every user's Safe Senders and Blocked Senders lists.

The same message can pass one and fail another. The quickest way to tell a consumer recipient from a business one is the recipient domain's MX record: an MX lookup showing a mail.protection.outlook.com host means a Microsoft 365 tenant.

Layer one: the connection

Before content is considered, Microsoft looks at the machine talking to it. The Outlook.com postmaster policies require valid reverse DNS on sending servers (a PTR record you can confirm with the reverse DNS checker), warn that connections from dynamic IP space may not be accepted, and cap a sender at 500 simultaneous connections to Outlook.com inbound servers without prior arrangement.

Microsoft's troubleshooting page shows how these checks surface. 421 RP-001 through RP-003 are rate and connection limits applied on IP or domain reputation, 550 DY-001 rejects dynamic IP space, 550 SC-002 flags namespace mining (probing for valid addresses, which careless mailing to dead addresses resembles), and 550 OU-001 ties a rejection to Spamhaus data. For senders on an established platform this layer is mostly invisible. It matters when you run your own infrastructure.

Layer two: authentication

Next comes identity. For Outlook.com, the postmaster policies state that domains sending more than 5,000 emails a day to Outlook.com accounts must be compliant with SPF, DKIM and DMARC, with DMARC at least p=none (Microsoft recommends p=reject) and aligned with SPF or DKIM. Since 5 May 2025, per the same page, non-compliant mail from high-volume senders goes to junk, and if issues remain unresolved it may be rejected with 550 5.7.515. The full rulebook is on our Outlook sender requirements page.

Microsoft 365 tenants evaluate authentication through what Microsoft calls composite authentication, recorded as compauth in the Authentication-Results header. Microsoft's DMARC documentation says that when a tenant's anti-phishing policy is set to honor the sender's DMARC policy, failing mail from a domain at p=quarantine goes to the Junk Email folder and mail from a domain at p=reject is rejected during SMTP with 550 5.7.1. A domain with no authentication records, or only weak ones such as SPF ~all or DMARC p=none, can still fail implicitly: reason code 001 in Microsoft's table. Weak records don't earn a pass by default. Check all three at once with the email authentication checker.

Layer three: reputation and complaints

Authenticated identity is what Microsoft's reputation systems attach history to, and complaints are the heaviest input they expose to senders. Microsoft's Defender documentation says its spam filtering learns from known spam and phishing threats and from user feedback on Outlook.com, its consumer platform. Junk clicks from consumer recipients are part of what trains the filtering business tenants rely on.

Microsoft gives IP owners two free instruments: SNDS, which shows daily filter verdicts, complaint levels and trap hits per IP, and JMRP, its feedback loop, which returns copies of messages users mark as junk. Both are covered in Microsoft SNDS. Unlike Google, Microsoft publishes no numeric complaint rate ceiling; its troubleshooting page lists 550 SC-004 as a block placed because of complaints and points senders to JMRP.

Two statements on that page set expectations. Outlook.com says it does not operate an allow list that gives senders a pass around junk filters, and it says submitting information through its sender support process does not guarantee delivery. Reputation is earned through the mail, not requested.

Layer four: verdicts inside Microsoft 365

In a business tenant, EOP assigns every inbound message a verdict: spam, high confidence spam, phishing, high confidence phishing, or bulk. Microsoft's documented defaults move spam, high confidence spam and bulk to the Junk Email folder, quarantine phishing, and always quarantine high confidence phishing.

Bulk is the verdict marketing senders meet most. Microsoft assigns a bulk complaint level (BCL) to mail from bulk senders using internal and external sources:

| BCL | Microsoft's description | |---|---| | 0 | Not from a bulk sender | | 1–3 | Bulk sender that generates few complaints | | 4–7 | Bulk sender that generates a mixed number of complaints | | 8–9 | Bulk sender that generates a high number of complaints |

The default threshold is 7 in the default anti-spam policy, 6 in the Standard preset and 5 in the Strict preset, which quarantines rather than junking. So the same newsletter can reach the inbox at one company and be quarantined at another because its administrators chose Strict. Microsoft also documents, as of July 2026, a Promotions tag applied to all bulk-identified mail, with an optional setting that delivers bulk mail below the threshold to a Promotions folder, a close cousin of Gmail's Promotions tab.

Administrators can also add allowed senders, but Microsoft warns that such entries bypass most protection and should be temporary. Asking a customer's IT team to allow-list you is a stopgap, not a strategy.

Layer five: the recipient's own lists

Last, the individual. Microsoft Support says addresses and domains on a user's Safe Senders List are never treated as junk, whatever the content, and Blocked Senders go straight to Junk. The classic Outlook client adds a Junk Email Filter with four levels: No Automatic Filtering (the default), Low, High, and Safe Lists Only, where anything not from a safe sender is junk.

For senders this layer cuts both ways. A recipient who adds you as a safe sender, which is a reasonable request for receipts and account mail, removes the filter from that relationship. A recipient on Safe Lists Only will junk you regardless of anything in this guide.

Reading the verdict from a header

Microsoft 365 writes its reasoning into every delivered message, so a colleague or customer at a business tenant can show you which layer acted. Paste the headers into the email header analyzer and look for:

  • X-Forefront-Antispam-Report: CAT names what filtered the message (BULK, SPM for spam, HSPM, PHSH, SPOOF), and SFV records the decision (SPM marked spam, NSPM not spam, SFE allowed by a user's Safe Senders, BLK blocked by a user).
  • X-Microsoft-Antispam: the BCL value.
  • Authentication-Results: dmarc= and compauth= with its reason code.

One field to ignore: Microsoft now says the SCL value no longer determines a cloud verdict or action, and points to CAT and DIR instead. Plenty of older troubleshooting advice still reads SCL as the answer.

What a sender controls

Laid against the layers, the levers sort themselves:

  1. Pass the pass/fail layers outright. Reverse DNS, static sending IPs, aligned SPF and DKIM, and a DMARC record Microsoft can honor.
  2. Enroll in SNDS and JMRP if you own your IPs, and make sure your platform acts on junk reports by suppressing complainers.
  3. Keep your BCL low by mailing people who want the mail, with an unsubscribe route easier to find than the junk button.
  4. Stop mailing dead addresses on the first hard bounce, before it reads as namespace mining.

For the repair order when mail is already in junk, see Outlook emails going to spam; for how Microsoft's approach compares with Google's, see how the Gmail spam filter works.

Related guides

About this guide

Written by InboxRatio Editorial. Microsoft does not publish its filters' internals; this guide describes them as far as Microsoft's Outlook.com postmaster policies and troubleshooting pages, its Microsoft Defender for Office 365 documentation on anti-spam protection, bulk complaint level, spam confidence level, message headers and DMARC, and Microsoft Support's junk email pages define them. Documentation was checked in September 2026 and governs if details change. No filter-evasion techniques are offered. No vendor sponsorship influences it.

Methodology

InboxRatio's benchmark sends real campaigns through the platforms we review to a controlled seed list and records where each message lands. This guide draws on Microsoft's documentation rather than our measurements; the protocol is in how we test and our source rules in sources.

Last updated

16 October 2026. Microsoft sender and Defender documentation reviewed quarterly.

Frequently asked questions

How does the Outlook spam filter decide what goes to junk? In layers: connection checks such as reverse DNS and dynamic IPs, authentication with SPF, DKIM and DMARC, reputation built largely from user junk reports, and in business tenants a verdict of spam, phishing or bulk with admin-configured actions. Recipients' Safe and Blocked Senders lists apply last.

Is Outlook.com filtering the same as Microsoft 365 filtering? No. Outlook.com consumer mail follows Microsoft's postmaster policies. Microsoft 365 business mail passes through Exchange Online Protection, where each organization's administrators set policies such as the bulk threshold. Microsoft says its filtering learns from Outlook.com user feedback, so the two are related but not identical.

What is a bulk complaint level in Outlook? A 0–9 score Microsoft 365 assigns to mail from bulk senders, based on how many complaints that kind of mail generates. At or above the tenant's threshold (7 by default, 5 in the Strict preset) the mail is junked or, under Strict, quarantined.

Can I get whitelisted by Outlook? Not by Outlook.com: Microsoft's troubleshooting page says it does not operate an allow list for bypassing junk filters. Individual recipients can add you to Safe Senders, and a company's administrators can create allow entries, which Microsoft advises using only temporarily.

Why does my email go to spam in Outlook but not Gmail? Each provider filters on its own users' reactions and its own policies, and in Microsoft 365 each company adds its own thresholds. Check whether the affected recipients are consumer or business addresses, then read a delivered header for the verdict.

What does SCL mean in an Outlook email header? Spam confidence level. Microsoft now says SCL no longer determines whether cloud filtering marks a message as spam or what action it takes; read the CAT and SFV fields in X-Forefront-Antispam-Report for the actual verdict.

The Outlook filter is several judges, and each leaves notes. Find out which one ruled, fix the layer it cited, and start with the part you fully own by running your domain through the email authentication checker.