Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Troubleshooting

Troubleshoot anti-spam policies in Microsoft Defender for Office 365

4 September 2026Doc update+97 / −115 lines

In brief

The article now uses “spam filtering” and “spam verdict” terminology instead of focusing on SCL overrides. Its guidance and table clarify the effects and limitations of mail flow rules, IP Allow List entries, and Outlook Safe Senders, including the on-premises SCL context.

What Defender admins need to know

Administrators can use the revised guidance to diagnose policy precedence and filtering-override issues more accurately. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Troubleshoot anti-spam policy issuespolicies in Microsoft Defender for Office 365 author: chrisda ms.author: chrisda ms.topic: troubleshooting ms.collection:

  • m365-security
  • tier2 ms.custom: msecd-doc-authoring-10121015 description: Diagnose and resolve anti-spam policy issues including policy precedence conflicts, SCLspam filtering override behavior, and false positives from ASF settings in Defender for Office 365. ms.service: defender-office-365 ms.date: 07/07/08/03/2026 ai-usage: ai-assisted

#customer intent: As an admin, I want to troubleshoot anti-spam policy issues so that I can resolve policy precedence conflicts, unexpected SCLspam verdict overrides, and ASF false positives. appliesto:

Policy precedence issues

Anti-spam policies are evaluated in a specific order. Only the first matching policy (highest priority) applies to a recipient. This order matters when multiple policies exist. Anti-spam policies are processed in the following order:

Priority Policy Notes

Problem: Custom policy settings aren't being applied

Symptom: You configured a custom anti-spam policy with specific settings (for example, a higher BCLBulk Complaint Level (BCL) threshold or a different spam action), but the settings aren't taking effect for some users.

Likely cause: The affected users are also included in a preset security policy (Standard or Strict), which takes precedence over custom policies.

  • The default anti-spam policy can't be scoped to specific users. It always applies last to all recipients not covered by other policies.
  • Consider creating a custom policy for the affected users instead of relying on the default.

SCLSpam verdict override behavior

The spam confidence level (SCL) determines how messages are classified and acted on. Certain mechanisms can override the SCL value that spam filtering assigns, which affectsverdict on a message, such as mail flow rules or connection filtering. These overrides can affect whether messages go to the Inbox, the Junk Email folder, or quarantine. For SCL valuesIn cloud organizations, spam filtering classifies messages and their default actions, see Spam confidence level (SCL).takes action using message categorization and other signals.

The following mechanisms can override the SCL value thatverdict assigned by spam filtering assigns.filtering. Their behavior and limitations affect troubleshooting:

Override mechanism SCL effectEffect Limitations Details
Mail flow rules (transport rules) Can set SCLSet the spam confidence level (SCL) to -1 (bypass) or 0-9 (for action in on-premises Exchange environments) Can't bypass malware or high confidence phishing filtering. SCL -1 overrides spam filtering only. Use mail flow rules to set the SCL
IP Allow List (connection filtering) Sets SCL to -1Bypass most filtering for messages from allowed IPs Doesn't bypass malware or high confidence phishing scanning. Doesn't override DMARC failures. Configure connection filtering
Allowed senders/domains (anti-spam policy) Bypasses spam filtering for specified senders or domains High risk: attackers can spoof allowed domains. Doesn't bypass malware or high confidence phishing. Create safe sender lists
Tenant Allow/Block List Allows or blocks specific senders, domains, URLs, or files Allow entries are temporary by default. Block entries override allow entries. Tenant Allow/Block List
Outlook Safe Senders (user-level) Sets SCL to -1Bypasses spam filtering for messages from senders in the user's Safe Senders list Doesn't bypass malware or high confidence phishing. Creates risk of targeted spoofing. Safelist aggregation
Advanced delivery policy Bypasses filtering for SecOps mailboxes and phishing simulation messages Purpose-built for specific scenarios. Don't use for general allow lists. Configure advanced delivery policy
Enhanced Filtering for Connectors (skip listing) Preserves original source IP for accurate SPF/authentication checks Doesn't directly set SCLbypass filtering, but affects how filtering evaluates the message source. Enhanced Filtering for Connectors
  • An SCL of -1 is an instruction to bypass spam filtering, not necessarily the SCL value that's stamped on the message. A message that skips spam filtering can still be scanned and stamped with an SCL of 0 or 1 to indicate it was evaluated and found not to be spam.
  • Even when a message bypasses spam filtering, the following protections are never bypassed:
    • Malware scanning: Messages containing malware are always quarantined.
    • High confidence phishing (HPHSH): Messages identified as high confidence phishing are always quarantined (unless the MX record doesn't point to Microsoft 365 and an SCL -1 rule is in place).

Problem: SCL -1 mail flow rule delivers spam to Inbox

Determine which component setfiltered the SCLmessage

When you troubleshoot unexpected spam filtering behavior, identify which component assignedfiltered the SCL value to the message.message or overrode filtering. Multiple components in the Exchange Online filtering pipeline can set or overrideaffect the SCL:outcome: spam filtering, mail flow rules, connection filtering, allowed/blocked sender lists, and Advanced Spam Filter (ASF) settings.

The following steps show how to use message X-headers to trace the SCL source.filtering decision.

Step 1: Get the message headers

To analyze how the SCLmessage was set,filtered, you need the full internet message headers of the affected message:

  • Outlook (desktop): Open the message > select File > Properties. The headers appear in the Internet headers box.
  • Outlook on the web: Open the message > select ... (More actions) > View > View message details.

Step 2: Locate the key X-headers

The following X-headers contain the information you need to trace the SCL source:filtering decision:

Header Purpose
X-Forefront-Antispam-Report Contains the SCL value, spam filtering verdict (SFV), IP verdict (IPV), threat category (CAT), and other filtering decisions.
X-Microsoft-Antispam Contains the bulk complaint level (BCL) and other diagnostic fields.
X-MS-Exchange-Organization-SCLContains the final SCL value stamped on the message.
X-CustomSpam Present only when an ASF setting flagged the message. Identifies which ASF rule triggered.
Authentication-Results Contains SPF, DKIM, DMARC, and composite authentication (compauth) results.

The SFV (Spam Filtering Verdict) field in the X-Forefront-Antispam-Report header is the primary indicator of which component determined the message's fate:

SFV value Component that set the SCL Meaning
SFV:SPMBLK Spam filtering (content filter)User Blocked Senders list Spam filtering markedThe message was blocked because the message as spam based on content analysis.sender is in the recipient's Outlook Blocked Senders list.
SFV:NSPM Spam filteringfilter (content filter) Spam filtering determined the message wasn't spam.
SFV:SKNSFE Mail flow rule (transport rule)User Safe Senders list The SCLFiltering was set to -1 (bypass spam filtering) before spam filtering processed the message.
SFV:SKSMail flow rule (transport rule)The SCL was set to 5–9 before spam filtering processed the message.
SFV:SKIIP Allow/Block List (connection filtering)The message skipped spam filtering because the source IP wassender is in the IP Allow List.recipient's Outlook Safe Senders list.
SFV:SKA Anti-spam policy allowed sender/domain list The message skipped spam filtering because the sender or domain is in the allowed senders/domains list.
SFV:SKB Anti-spam policy blocked sender/domain list The message was marked as spam because the sender or domain is in the blocked senders/domains list.
SFV:SFESKI User Safe Senders listIP Allow/Block List (connection filtering) Filtering wasThe message skipped spam filtering because the sender issource IP was in the recipient's Outlook Safe Senders list.IP Allow List.
SFV:BLKSKN User Blocked Senders listMail flow rule The message was blocked becausesystem honored the sender is inrequest to skip spam filtering from a rule with the recipient's Outlook Blocked Senders list.Set the spam confidence level (SCL) action set to Bypass spam filtering (-SetSCL -1).
SFV:SKQ Quarantine release The message was released from quarantine and delivered to the intended recipients.
SFV:SKSMail flow rule or on-premises ExchangeThe message was marked as spam before spam filtering processed it, and Secure by default honored the request. The source is either a mail flow rule that set the spam confidence level (SCL), or a spam decision passed from on-premises Exchange in a hybrid deployment. The request to mark the message as spam is an input to filtering, not a final decision, so SFV:SKS appears only when the request is honored.
SFV:SPMSpam filter (content filter)Spam filtering marked the message as spam based on content analysis.

Step 4: Check the IPV field for connection-level decisions

|IPV:CAL|The source IP address is in the IP Allow List in the connection filter policy. Spam filtering was skipped.| |IPV:NLI|The IP address wasn't found on any IP reputation list. No connection-level override occurred.|

If you see IPV:CAL with SCL:-1, the connection filter (IP Allow List) is the component that bypassed spam filtering.

Step 5: Check for ASF overrides

If an ASF setting flagged the message, a separate X-CustomSpam header is added that identifies which ASF rule triggered. For example: X-CustomSpam: Web bug 


For the complete list of ASF settings, `X-CustomSpam` values, and their SCLspam filtering effects, see [Advanced Spam Filter (ASF) settings in anti-spam policies](anti-spam-policies-asf-settings-about.md).

Step 6: Check for mail flow rule involvement

If SFV:SKN or SFV:SKS appears in the header, a mail flow rule affected the message before spam filtering processed it: SFV:SKN for a rule that bypasses spam filtering (SCL -1), or SFV:SKS for a rule that marks the message as spam (SCL 5-9). In a hybrid deployment, SFV:SKS can also come from an on-premises Exchange spam decision. These actions are inputs to filtering, not final decisions, and Secure by default might not honor them.

To identify which mail flow rule is responsible:

  1. On the Rules page in the Exchange admin center at https://admin.exchange.microsoft.com/#/transportrules, look for rules with the action Set the spam confidence level (SCL).
  2. Cross-reference the rule conditions with the affected message.

Alternatively, use Message trace in the EAC.Exchange admin center (EAC). The detailed message trace output shows an AGENTINFO event that identifies which rule fired.

PowerShell: Find all SCL-setting mail flow rules

# Connect to Exchange Online PowerShell
Connect-ExchangeOnline

# List
To list all mail flow rules that set the SCL
SCL, Connect to Exchange Online PowerShell and run the following command:
Get-TransportRule | Where-Object {$_.SetSCL -ne $null} | Format-Table Name, State, Priority, SetSCL,@{N='SetSCL';E={$_.SetSCL};Alignment='Right'}, @{N='Conditions';E={($_.Conditions | Out-String}-join ', ') -replace 'Microsoft\.Exchange\.MessagingPolicies\.Rules\.Tasks\.','' -replace 'Predicate',''}} -AutoSize -Wrap



Decision tree: Trace the SCL sourcefiltering decision


Use the following workflow to systematically identify which component setfiltered the SCL.message. Start by reading the X-Forefront-Antispam-Report header:

    

  1. Check the SFV value:

      

    • SFV:SKNBLK: Mail flow rule set SCL to -1 (bypassed filtering).User's Blocked Senders list.
      • 

    • SFV:SKSNSPM: Mail flow rule set SCL to 5-9 (pre-Spam filter (content filter) marked as spam).Not Spam.
      • 

    • SFV:SKISFE: Connection filter (IP Allow List) bypassed filtering. Confirm that IPV:CAL is also present.User's Safe Senders list.
      • 

    • SFV:SKA: Anti-spam policy allowed sender/domain list.
      • 

    • SFV:SKB: Anti-spam policy blocked sender/domain list.
      • 

    • SFV:SFESKI: User's Safe Senders list.Connection filter (IP Allow List) bypassed filtering. Confirm that IPV:CAL is also present.
      • 

    • SFV:BLKSKN: User's Blocked Senders list.Mail flow rule bypassed filtering.
    • SFV:SKS: A mail flow rule or on-premises Exchange (in hybrid) marked the message as spam before filtering (honored by Secure by default).
      • 

    • SFV:SPM: ContentSpam filter (content filter) marked as Spam. Check the CAT value for threat type and the X-CustomSpam header for ASF triggers.
    • SFV:NSPM: Content filter marked as Not Spam.
      • 

    

    2. 

  2. Check the X-CustomSpam header (if present): An ASF setting triggered. Identify which setting and disable it if the message is a false positive.

    3. 

  3. Check Authentication-Results (compauth):

      

    • compauth=fail reason=000: DMARC explicit failure (might set SCL 7+)(can result in a spam verdict).
      • 

    • compauth=fail reason=001: Implicit authentication failure (spoof intelligence).
  4. Check the SCL value:
    • SCL:-1: Filtering was bypassed (source identified in the SFV value).
    • SCL:0-1: Not spam (content filter or override).
    • SCL:5-6: Spam (content filter, ASF, or mail flow rule).
    • SCL:7-9: High confidence spam (content filter, ASF, DMARC, or analyst).
      • 

    

    5. 



Real-world header examples


The following examples show how to interpret message headers to identify which component setfiltered the SCL.message.

    

  • SCL setMessage filtered by spam filtering:

    X-Forefront-Antispam-Report: CIP:198.51.100.50;CTRY:US;LANG:en;
  SCL:5;SFV:SPM;IPV:NLI;SRV:;H:mail.example.adatum.com;PTR:mail.example.adatum.com;
  CAT:SPM;SFTY:;DIR:INB;
X-MS-Exchange-Organization-SCL: 5

    

    The content filterSpam filtering marked the message as Spam (SFV:SPM, CAT:SPM, SCL:5)SPM). No override occurred (IPV:NLI). The spam filtering engine assigned the SCL.

    • 

  • SCL setFiltering bypassed by a mail flow rule:

    X-Forefront-Antispam-Report: CIP:203.0.113.10;CTRY:GB;LANG:en;
  SCL:-1;SFV:SKN;IPV:NLI;SRV:;H:partner-mail.contoso.com;
  CAT:NONE;DIR:INB;
X-MS-Exchange-Organization-SCL: -1

    

    ASFV:SKN indicates a mail flow rule set SCL to -1 beforeskipped spam filtering (SFV:SKN). The message bypassed spam filtering entirely.for the message. Check your transportmail flow rules for the matching condition.

    • 

  • SCL setFiltering bypassed by the IP Allow List:

    X-Forefront-Antispam-Report: CIP:192.0.2.25;CTRY:DE;LANG:de;
  SCL:-1;SFV:SKI;IPV:CAL;SRV:;H:smtp.partner.fabrikam.de;
  CAT:NONE;DIR:INB;
X-MS-Exchange-Organization-SCL: -1

    

    The source IP (192.0.2.25) is in the IP Allow List (SFV:SKI, IPV:CAL). Connection filtering bypassed spam filtering and set SCL to -1.filtering.

    • 

  • SCL setMessage marked as spam by an ASF setting:

    X-Forefront-Antispam-Report: CIP:198.51.100.99;CTRY:US;LANG:en;
  SCL:9;SFV:SPM;IPV:NLI;SRV:;H:bulk.sender.adatum.com;
  CAT:HSPM;DIR:INB;
X-CustomSpam: Web bug
X-MS-Exchange-Organization-SCL: 9

    

    The message matched the Web bugs in HTML ASF setting (X-CustomSpam: Web bug), which set SCL to 9 (Highmarked it as High confidence spam)spam (CAT:HSPM). The message probably contains a 1×11x1 tracking pixel. If the message is a legitimate newsletter, disable the MarkAsSpamWebBugsInHtml ASF setting.

    • 

  • SCL setMessage marked as spam by a DMARC failure:

    X-Forefront-Antispam-Report: CIP:198.51.100.77;CTRY:US;LANG:en;
  SCL:7;SFV:SPM;IPV:NLI;SRV:;CAT:SPOOF;DIR:INB;
Authentication-Results: spf=fail (sender IP is 198.51.100.77)
  smtp.mailfrom=example.fabrikam.com; dkim=none;
  dmarc=fail action=quarantine header.from=example.fabrikam.com;
  compauth=fail reason=000
X-MS-Exchange-Organization-SCL: 7

    

    The message failed DMARC (compauth=fail reason=000), and the sender's DMARC policy specified quarantine, andquarantine. Anti-spoofing (DMARC) enforcement marked the SCL was elevated to 7message as spam (CAT:SPOOF). Anti-spoofing/DMARC enforcement set this value,, not the content filter.spam filter (content filter).

    • 

  • SCL overriddenFiltering bypassed by user Safe Senders:

    X-Forefront-Antispam-Report: CIP:203.0.113.55;CTRY:IN;LANG:en;
  SCL:-1;SFV:SFE;IPV:NLI;SRV:;CAT:NONE;DIR:INB;
X-MS-Exchange-Organization-SCL: -1

    

    The sender is in the recipient's Safe Senders list (SFV:SFE). Spam filtering was skipped and SCL was set to -1.skipped. To verify, Connect to Exchange Online PowerShell and check the user's junk email configuration:

    Get-MailboxJunkEmailConfiguration -Identity "[email protected]" | Select-Object TrustedSendersAndDomains

    

    • 



SCL source identificationFiltering decision quick reference






Header evidence
SCL source componentComponent
Admin action





SFV:SPM or SFV:NSPM, no X-CustomSpamCAT:HPHSH
Content filter (spam filtering engine)Review anti-spam policy actions; submit false positives.
SFV:SPM + X-CustomSpam: header presentASF settingHigh confidence phishing detection
Identify and disable the problematic ASF setting.
SFV:SKN (SCL -1) or SFV:SKS (SCL 5–9)Mail flow rule (transport rule)Review Get-TransportRule for SCL-setting rules.
SFV:SKI + IPV:CALConnection filter (IP Allow List)Review Get-HostedConnectionFilterPolicy.
SFV:SKAAnti-spam policy (allowed sender/domain list)Review allowed senders in anti-spam policy.
SFV:SKBAnti-spam policy (blocked sender/domain list)Review blocked senders in anti-spam policy.
SFV:SFEUser Safe Senders (Outlook)Check Get-MailboxJunkEmailConfiguration.
SFV:BLKUser Blocked Senders (Outlook)Check Get-MailboxJunkEmailConfiguration.lists can't override this verdict.




compauth=fail reason=000 + CAT:SPOOF
DMARC/anti-spoofing
Review sender's DMARC policy; check ARCAuthenticated Received Chain (ARC) configuration.




CAT:HPHSHSFV:BLK
High confidence phishing detectionUser Blocked Senders (Outlook)Check BlockedSendersAndDomains from Get-MailboxJunkEmailConfiguration.
SFV:SFEUser Safe Senders (Outlook)Check TrustedSendersAndDomains from Get-MailboxJunkEmailConfiguration.
SFV:SKAAnti-spam policy (allowed sender/domain list)Review allowed senders in the anti-spam policy.
SFV:SKBAnti-spam policy (blocked sender/domain list)Review blocked senders in the anti-spam policy.
SFV:SKI + IPV:CALConnection filter (IP Allow List)Check IPAllowList from Get-HostedConnectionFilterPolicy.
SFV:SKN (bypass spam filtering)Mail flow rule
Allow lists can't override this verdict.Find all SCL-setting mail flow rules
SFV:SKS (marked as spam before spam filtering)Mail flow rule or on-premises ExchangeFind all SCL-setting mail flow rules. In hybrid deployments, also check on-premises spam decisions.
SFV:SPM + X-CustomSpam: header presentASF settingIdentify and disable the problematic ASF setting.
SFV:SPM or SFV:NSPM, no X-CustomSpamSpam filter (content filter)Review anti-spam policy actions; submit false positives.




SRV:BULK + BCL value in X-Microsoft-Antispam
Bulk email detection (BCL threshold)
Adjust the BCL threshold in the anti-spam policy.





ASF settings that cause false positives


Increase spam score settings


These settings increase the SCLspam score of matching messages, giving themwhich increases the chance that the message receives a higher chance of beingSpam filter verdict and the corresponding action in anti-spam policies. Not every message that matches these conditions is marked as Spam (SCL 5 or 6):spam.





ASF setting
PowerShell parameter
Why it causes false positives
Recommendation





Image links to remote websites
IncreaseScoreWithImageLinks
Flags messages containing <Img> HTML tag links to remote sites. Some legitimate HTML emails include remote images.
Turn off if you receive legitimate emails with remote image links.




Numeric IP address in URL
MarkAsSpamNumericIpLinkIncreaseScoreWithNumericIps
Flags messages containing URLs with numeric IP addresses (for example, http://192.168.1.1/). Some legitimate internal systems or partner applications use IP-based URLs.
Turn off if you have legitimate senders that use IP-based URLs.




URL redirect to other port
MarkAsSpamUrlRedirectsToOtherPortIncreaseScoreWithRedirectToOtherPort
Flags messages containing URLs that redirect to TCP ports other than 80 (HTTP), 8080 (alternate HTTP), or 443 (HTTPS). Some legitimate web applications use nonstandard ports.
Turn off if legitimate messages contain links to nonstandard ports.




Links to .biz or .info websites
MarkAsSpamBizOrInfoUrlsIncreaseScoreWithBizOrInfoUrls
Flags messages containing .biz or .info URLs. Many legitimate businesses use these TLDs.
Turn off if you communicate with legitimate senders that use .biz or .info domains.





Mark as spam settings


TheseThe following Mark as spam settings setmark detected messages with a High confidence spam filter verdict and the SCL to 9 (High confidence spam), which is a more aggressive action:corresponding action in anti-spam policies:






ASF setting
PowerShell parameter
Why it causes false positives
Recommendation





Sensitive words
MarkAsSpamSensitiveWordList
Flags messages containing words from Microsoft's sensitive word list. Can flag legitimate HR, medical, or financial communications.
Turn off if you experience false positives in business communications involving medical, financial, or HR-related content.




SPF record: hard fail
MarkAsSpamSpfRecordHardFail
Flags messages where SPF returns a hard fail. Legitimate senders with misconfigured SPF records or forwarded messages trigger this setting. Test mode isn't available for this setting.
Turn off unless you verified all legitimate senders have correct SPF records. Use DMARC enforcement instead.





The following Mark as spam settings setmark detected messages with a Spam filter verdict and the SCL to 6 (Spam) instead of 9:corresponding action in anti-spam policies:






ASF setting
PowerShell parameter
Why it causes false positives
Recommendation






Use the following workflow to diagnose anti-spam policy issues:


    

  1. Identify which component setfiltered the SCLmessage: Use message headers to determine whether spam filtering, a mail flow rule, connection filtering, or another component assignedfiltered the SCL value.message. For detailed steps, see Determine which component set the SCLDetermine which component filtered the message.
    

    2. 

  2. Check for policy precedence issues:
    

      

    • Is the user included in a Strict/Standard preset? The preset wins.the Standard or Strict preset security policies? Strict is applied before Standard, which is applied before any custom policies.
      • 

    • Do multiple custom policies match? The lowesthighest priority numberpolicy (lowest priority number) wins.
      • 

    • No custom policy matches? The default policy applies.
      • 

    

    3. 

  3. Check for ASF false positives:
    

    4.