Microsoft 365 email going to junk: how to find the cause

Start with the direction of the message

Email that is “in junk” can describe two different incidents. An inbound message to Microsoft 365 was classified by Exchange Online Protection or Defender for Office 365; an outbound message was accepted by Gmail, Outlook.com, or another provider and then classified by that recipient. The evidence and corrective controls differ.

First determine whether the problem affects received or sent mail. Preserve an original sample with full headers, sender, recipient, UTC timestamp, and Message-ID. A Junk folder screenshot cannot establish the cause.

Collect a usable sample before changing configuration

Do not immediately allow an entire domain. A broad exception hides evidence, can bypass authentication controls, and increases spoofing risk.

• Download the original .eml or copy all Internet headers; do not merely forward the message.
• Record exact addresses, UTC time, subject, Message-ID, and whether the source is Exchange Online, a CRM, ERP, copier, or marketing platform.
• Define the scope: one message, campaign, sender, mailbox, recipient domain, or every recipient.
• Distinguish Junk, quarantine, an NDR rejection, and a missing message; they do not share the same cause.
• Keep one successful and one failed sample so you can compare one variable at a time.

1. Trace the message in Exchange Online

In the Exchange admin center, Mail flow > Message trace follows messages through the organization. The modern search covers up to 90 days, with detail limitations based on age. Get-MessageTraceV2 is replacing the older Get-MessageTrace cmdlet.

For inbound mail, review the final action, rules, redirects, and delivery to a mailbox or quarantine. For outbound mail, Delivered generally means the remote system accepted the message; it does not guarantee inbox placement. Obtain the recipient-side headers next.

$Start = (Get-Date).AddHours(-24)
$End = Get-Date
Connect-ExchangeOnline -ShowBanner:$false

$trace = Get-MessageTraceV2 -StartDate $Start -EndDate $End `
  -SenderAddress 'billing@contoso.com' `
  -RecipientAddress 'customer@example.net' -ResultSize 5000

$trace | Select Received,SenderAddress,RecipientAddress,Subject,Status,MessageTraceId
$trace | ForEach-Object {
  Get-MessageTraceDetailV2 -MessageTraceId $_.MessageTraceId `
    -RecipientAddress $_.RecipientAddress
} | Select Date,Event,Action,Detail

• Microsoft — Message trace in the modern Exchange admin center ↗
• Microsoft — Get-MessageTraceV2 ↗

2. Read the headers that explain the verdict

For mail received by Microsoft 365, inspect Authentication-Results, X-Forefront-Antispam-Report, X-Microsoft-Antispam, and ARC headers. Microsoft's Message Header Analyzer makes them easier to read, but preserve the raw copy too.

SCL represents spam confidence; BCL measures resemblance to unwanted bulk mail. SFV describes the filtering verdict and CAT the category, such as bulk, spam, spoof, or phishing. Read the verdict, applied policy, overrides, and resulting action together.

• Microsoft — Troubleshoot anti-spam policies ↗
• Microsoft — Spam Confidence Level ↗
• Microsoft — Bulk Complaint Level ↗

3. Validate SPF, DKIM, DMARC, and alignment

SPF validates the 5321.MailFrom envelope address; DKIM validates a signature and its d= domain; DMARC requires SPF or DKIM to pass with a domain aligned to the visible 5322.From address. An spf=pass can therefore coexist with dmarc=fail when domains are not aligned.

Inventory every source using your domain: Microsoft 365, SaaS, campaigns, ERP systems, websites, and devices. Prefer aligned DKIM for third-party services. Forwarding can break SPF; DKIM can survive if content is unchanged, and ARC can preserve results through a trusted intermediary.

Do not publish a second SPF record or exceed its ten-DNS-lookup limit. An unprepared DMARC p=reject policy can block legitimate sources; phased deployment and report analysis remain essential.

$Domain = 'contoso.com'
Resolve-DnsName -Type TXT $Domain
Resolve-DnsName -Type TXT "_dmarc.$Domain"
Resolve-DnsName -Type CNAME "selector1._domainkey.$Domain"
Resolve-DnsName -Type CNAME "selector2._domainkey.$Domain"

Connect-ExchangeOnline -ShowBanner:$false
Get-DkimSigningConfig -Identity $Domain |
  Format-List Domain,Enabled,Status,Selector1CNAME,Selector2CNAME

• Article — Configure DMARC, SPF, and DKIM without blocking mail →
• Microsoft — Email authentication SecOps guide ↗

4. When inbound mail goes to Junk or quarantine

Secure by default prevents some bypasses for serious threats. An SCL -1 rule or allowed IP should not become a general fix because it reduces visibility and can bypass authentication.

• Identify the anti-spam, anti-phishing, Safe Attachments, or Safe Links policy that acted, its priority, and recipients.
• Look for a mail flow rule that sets SCL, redirects mail, changes headers, or bypasses filtering.
• Review spoof intelligence, impersonation protection, and accepted domains.
• Compare mailbox settings and blocked senders when only one user is affected.
• Review connectors and Enhanced Filtering when a third-party gateway precedes Microsoft 365.
• In Explorer, correlate detection technology, action, overrides, and applied policy.

$Mailbox = 'user@contoso.com'
Get-MailboxJunkEmailConfiguration -Identity $Mailbox |
  Format-List Enabled,TrustedSendersAndDomains,BlockedSendersAndDomains
Get-HostedContentFilterPolicy |
  Select Name,SpamAction,HighConfidenceSpamAction,BulkSpamAction,BulkThreshold
Get-HostedContentFilterRule |
  Select Name,State,Priority,HostedContentFilterPolicy,SentTo,SentToMemberOf
Get-TransportRule | Select Name,State,Mode,Priority,SetSCL,FromScope,SentTo

• Microsoft — Order and precedence of email protection ↗
• Microsoft — Secure by default ↗

5. When outbound mail lands in external junk folders

After confirming that Microsoft 365 handed off the message, ask the recipient for the original or full headers. The remote provider decides placement using its own signals: authentication, domain and IP reputation, complaints, volume, consistency, content, links, and recipient behaviour.

Separate transactional, human, and marketing traffic when volumes differ. A bulk platform should use a managed domain or subdomain, aligned DKIM, appropriate unsubscribe handling, and maintained lists. Devices should not send directly to the Internet without PTR, consistent HELO, authentication, and monitoring.

Changing a few words or repeatedly resending does not repair reputation. Test across providers, one variable at a time. No Microsoft 365 configuration can guarantee third-party inbox placement.

6. Control third-party sources and connectors

CRMs, ERP systems, web forms, copiers, and notification platforms are often the real source. For each, document the envelope domain, From domain, DKIM signature, IP or connector, owner, and expected volume.

When a third-party gateway precedes Microsoft 365, the last hop can hide the original IP. Configure Enhanced Filtering for Connectors for the supported architecture instead of broadly allowing the gateway IP.

• Microsoft — Enhanced Filtering for Connectors ↗
• Microsoft — Configure trusted ARC sealers ↗

7. Correct a false positive without creating a lasting gap

For legitimate mail misclassified by Microsoft, use Submissions in Defender and provide the original sample. Depending on the verdict, Microsoft can create a temporary allow and reassess detection. Record an owner, reason, scope, and expiry for every exception.

The Tenant Allow/Block List is not a universal safe list. An allow does not correct SPF, DKIM, DMARC, reputation, or a compromised application. Fix the source and keep the exception narrow and temporary.

• Microsoft — Submit messages for analysis ↗
• Microsoft — Tenant Allow/Block List ↗

8. Review abnormal sending and restricted accounts

A compromised account or misconfigured application can trigger outbound spam policies. Review Restricted entities, alerts, inbox rules, forwarding, OAuth consent, and application sources.

Do not remove a user from Restricted entities until the account is contained and the sending source is identified. Otherwise, the activity and restriction can return.

• Article — What to do when a Microsoft 365 account is compromised →
• Microsoft — Outbound spam policies ↗

Reusable diagnostic plan

When to request a complete Microsoft 365 assessment

Escalate when several domains are affected, the source remains unknown, an account might be compromised, connectors alter the path, or available logs limit the investigation. A structured review connects DNS, Exchange Online, Defender, applications, and recipient-side evidence without replacing the problem with a fragile safe list.

A Microsoft 365 assessment can also uncover overlapping policies, unlisted sources, and legacy exceptions, then produce a prioritized plan with owners, tests, and rollback.

• Service — Microsoft 365 and Entra ID security assessment →