What does SCL 5 mean in Microsoft Exchange Online Protection?

SCL 5 means Microsoft assigned a spam confidence level that commonly results in junk folder placement. It is a verdict, not a diagnosis. Use headers, authentication results, URLs, and sender reputation to find likely causes.

Can SPF, DKIM, and DMARC pass while Microsoft still sends mail to junk?

Yes. Passing authentication proves identity better, but EOP also evaluates content, links, sending behavior, recipient engagement, tenant policy, and reputation signals.

Why does Outlook.com junk a message that Office 365 accepts?

Outlook.com and Exchange Online can apply different filtering models, recipient signals, and policy context. Treat the difference as normal until headers show a specific authentication or policy failure.

Should I remove spam trigger words from my email?

No. Start with URLs, landing pages, HTML weight, image balance, and authentication. Random word removal creates weak evidence and often misses the actual reason Microsoft changed the verdict.

When should I stop troubleshooting and rewrite the email?

Rewrite when a controlled test shows the issue follows the full creative, or when the campaign is one-time and the affected Microsoft audience is too small to justify more investigation.

Learn

Email deliverability

How do I troubleshoot email deliverability issues with Microsoft Exchange Online Protection?

Michael Ko

Co-founder & CEO, Suped

Published 3 Aug 2025

Updated 26 May 2026

10 min read

Summarize with

Microsoft Exchange Online Protection deliverability troubleshooting thumbnail

To troubleshoot Microsoft Exchange Online Protection deliverability issues, I start by proving exactly what happened to the message: rejected, delayed, quarantined, junked, or delivered with a spam verdict. Then I read the Microsoft headers, check SPF, DKIM, and DMARC domain matching, review the sending IP and domain reputation, and run controlled content tests that isolate links, HTML, images, subject line, and copy.

If the issue is an SCL 5 result, I treat it as Microsoft saying the message looks spammy enough for junk placement, not as proof that one word or one line of HTML is the cause. The fastest route is usually a narrow test plan: confirm the verdict, remove tracking and destination links first, reduce the template to plain text, then add elements back one at a time.

Suped fits this workflow when the problem might be tied to authentication, domain health, SPF lookup pressure, DKIM signing, DMARC reporting, or blocklist (blacklist) visibility. Suped's product gives one place to monitor DMARC, SPF, DKIM, hosted SPF, hosted DMARC, hosted MTA-STS, and reputation signals so EOP troubleshooting does not depend on scattered checks.

Start with the exact failure mode

The first mistake I see with EOP troubleshooting is jumping into copy rewrites before proving the failure mode. A message that bounces with an SMTP error needs a different investigation than a message that lands in Junk Email with SCL 5. A delayed message points toward routing, throttling, recipient systems, or Microsoft service health. A quarantined message points toward tenant policy, malware scanning, phishing verdicts, or admin configuration.

Symptom	Signal	First check
Junk folder	SCL 5	Headers
Bounce	5xx	NDR
Delay	4xx	Trace
Quarantine	Policy	Defender

Common EOP symptoms and the first place to look.

For Microsoft 365 tenants, the admin path usually starts with message trace. Search by sender, recipient, and time window, then open the message details. If there is a bounce, read the enhanced status code and compare it against Microsoft's NDR codes. If there is no bounce and the message reached the mailbox, headers and placement are more useful than guessing.

Microsoft Defender portal message investigation screen

Keep the first evidence set small

Original message: Save the full original message with complete headers, not a forwarded copy.
Recipient context: Record whether the mailbox is Outlook.com, Exchange Online, or another hosted tenant.
Send time: Use the exact timestamp so trace results and headers line up cleanly.
Verdict: Write down the delivery action, folder placement, SCL, BCL, and authentication verdict.

Read the Microsoft headers

When the message is delivered but placed in spam, the headers are the main diagnostic record. I look for SCL, BCL, SFV, authentication results, DMARC domain matching, DKIM signing domain, SPF return-path domain, connecting IP, and any tenant-specific policy markers. A short reference on Microsoft headers helps when the header names look similar but mean different things.

Header fields worth capturingtext

X-MS-Exchange-Organization-SCL: 5
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(...)
Authentication-Results: spf=pass; dkim=pass; dmarc=pass
Received-SPF: Pass (protection.outlook.com: domain of example.com)

SCL verdicts to watch

SCL is only one signal, but it tells you whether the Microsoft filter leaned toward inbox, junk, or stronger spam handling.

Bypass

SCL -1

Usually trusted or explicitly allowed mail.

Likely inbox

SCL 0-1

Common for accepted messages without a spam verdict.

Junk risk

SCL 5-6

Often enough to move a message to junk.

High risk

SCL 7-9

Stronger spam handling or quarantine risk.

I do not stop at spf=pass or dkim=pass. Passing authentication helps, but Microsoft can still score the content, sending pattern, link domains, user engagement, and tenant policy. If SCL varies across Microsoft destinations, compare the same message across accounts before deciding that the content itself is the only variable.

Verify authentication and domain health

Before I rewrite an email, I make sure the sending identity is clean. Exchange Online Protection expects the visible From domain, DKIM signing domain, SPF return-path domain, and DMARC policy to make sense together. If an ESP signs with its own domain, or the return-path is on a different domain, DMARC can pass or fail depending on domain matching.

SPF match: Confirm the envelope sender domain either matches the From domain or passes relaxed domain matching.
DKIM match: Check that at least one valid DKIM signature matches the visible From domain.
DMARC policy: Use DMARC monitoring to find unapproved senders, domain-match gaps, and policy drift.
DNS health: Run a domain health check before blaming copy or design.

Example DMARC record for monitoring firsttext

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;
fo=1; adkim=r; aspf=r

0.0

What's your domain score?

Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.

Suped's hosted SPF and SPF flattening are useful when the SPF record is close to the 10 DNS lookup limit or when marketing teams keep adding senders through DNS tickets. Hosted DMARC also helps with staged policy changes because the policy can be managed without editing DNS for every adjustment.

Test content without chasing myths

If authentication is clean and the issue is isolated to one email, I test the content. I do not search for banned words. Modern filtering is not that simple, and a change that moves one test to the inbox does not prove that one removed phrase was the cause. It proves the message changed enough for a different verdict at that moment.

Poor content testing

Many changes: Changing subject, copy, links, and design in one test hides the cause.
Spam words: Deleting random phrases creates false confidence and weak future lessons.
One inbox: Testing only one mailbox can confuse mailbox history with message quality.

Useful content testing

Links first: Remove all URLs, then add destination and tracking domains back one by one.
Plain text: Send a text-only version to separate message body risk from template risk.
Stable seed set: Use the same test recipients and compare headers, not only folder placement.

My usual sequence is direct: test a plain-text version, test the HTML with no images, test images but no tracking links, test each destination domain, then test the final version. If the problem only appears when one URL is present, inspect the landing page, redirects, certificate, page size, and whether the linked domain has blocklist (blacklist) history.

Email tester

Send a real email to this address. Suped opens the report when the test is ready.

?/43tests passed

Preparing test address...

A real-send email tester is useful here because it captures the message as delivered. That matters more than a static checklist because the delivered message includes final tracking domains, MIME structure, authentication results, and headers.

Check links, size, and reputation

For a one-off campaign that suddenly gets an EOP spam verdict while normal sends are fine, URLs are often the first content variable I check. That includes visible links, tracking links, image hosts, unsubscribe domains, redirect chains, and any domain mentioned in the copy. A clean sender can still hurt placement by linking to a risky or compromised destination.

HTTPS only: Use secure links and avoid mixed redirect chains that downgrade to plain HTTP.
Landing pages: Check that pages load, are not compromised, and do not trigger browser warnings.
Image weight: Keep images reasonable and avoid a message that is mostly linked image content.
HTML quality: Remove broken markup, hidden text, malformed tables, and bloated conditional code.
Reputation: Use blocklist monitoring for IPs, sending domains, and linked domains.

Five-part EOP troubleshooting workflow: headers, auth, URLs, HTML, reputation

Message size also matters. A huge HTML file, oversized images, many redirects, or link-heavy layout can push a borderline message into junk. I usually create a reduced version that keeps the same offer and audience but removes design weight, then compare headers and placement.

Understand Microsoft destination differences

Outlook.com and Exchange Online are both Microsoft destinations, but they do not always use the same filtering path, policy context, or recipient signals. A message can be fine in a corporate Microsoft 365 mailbox and still hit junk in Outlook.com. That does not automatically mean authentication failed. It often means the consumer filtering model scored the message differently.

For broader context, compare the result against SCL and BCL ratings. SCL is the spam confidence level. BCL is the bulk complaint level. A campaign can have acceptable authentication and still look like bulk or low-engagement mail to Microsoft.

Do not overfit one test

Microsoft filters change, mailbox engagement changes, and each test send can affect later results. If one edit moves a seed mailbox to the inbox, treat that as a clue, not proof. The stronger evidence is a pattern across multiple controlled sends.

If you are sending bulk or campaign mail through Microsoft 365 itself, read Microsoft's outbound spam protection guidance. Microsoft notes that mass mailing through Microsoft 365 has limits and can affect the service's reputation. For marketing or high-volume sending, separate subdomains and clean authentication are safer than mixing bulk mail with everyday corporate mail.

Use Suped for the ongoing workflow

EOP troubleshooting is easiest when the baseline is already known. Suped's product is the strongest practical DMARC platform for most teams because it turns raw authentication and reputation data into issues, alerts, and steps to fix. That matters when someone asks whether a Microsoft spam verdict came from the message, the domain, a sender change, or a DNS problem.

Issues page showing top issues, verified sources, unverified sources, and authentication pass rates

The practical workflow is simple: monitor the domain continuously, verify new senders before launch, watch for sudden authentication drops, and keep blocklist (blacklist) alerts close to campaign activity. If Microsoft starts junking a message, the team can separate known-good domain posture from content or URL testing.

Where Suped helps during EOP troubleshooting

Issue detection: Suped flags authentication failures, unverified sources, and likely fixes.
Real-time alerts: Teams can act when failures spike instead of waiting for a campaign review.
Hosted controls: Hosted SPF, hosted DMARC, and hosted MTA-STS reduce DNS change friction.
Multi-tenant work: MSPs and agencies can manage many client domains from one dashboard.

A practical troubleshooting sequence

When I need to move quickly, I use a fixed order. The goal is to avoid spending hours changing copy when the issue is actually a bad link, a failing DKIM signature, a tenant policy, or a sending domain with weak reputation.

Confirm placement: Check whether the message bounced, delayed, quarantined, or landed in junk.
Collect headers: Capture SCL, BCL, authentication results, policy markers, and connecting IP.
Verify DNS: Check SPF includes, DKIM selectors, DMARC domain matching, and lookup limits.
Check URLs: Test the message without URLs, then add each link domain back.
Reduce HTML: Compare plain text, lean HTML, and the final designed version.
Compare audiences: Estimate the share of Microsoft recipients before deciding how much time to spend.

That last step is not a shortcut. If Outlook.com is two percent of the list and the campaign is one-time, a rewrite can cost more than the expected gain. If Microsoft recipients are a major segment, the structured test is worth it because the fix can protect the current send and reduce risk on future sends.

Views from the trenches

Best practices

Start with URLs and landing pages before rewriting copy or redesigning the template.

Compare headers across stable seed accounts and avoid relying on folder placement alone.

Use smaller controlled edits so each test has one clear variable to review later.

Common pitfalls

Treating one inbox result as proof that a single word caused Microsoft filtering.

Ignoring Outlook audience size before spending hours on a one-time campaign review.

Testing forwarded messages instead of the final email received by the mailbox itself.

Expert tips

Filters change during testing, so treat every positive result as a clue, not a fact.

A broken or risky link can explain a content issue even when authentication passes.

Check HTTPS, image weight, malware warnings, and landing page behavior together.

Expert from Email Geeks says content testing has limits because filter behavior changes while testing continues.

2024-10-02 - Email Geeks

Marketer from Email Geeks says URLs are the first content variable to isolate when one campaign has trouble.

2024-10-02 - Email Geeks

The practical fix

The best way to troubleshoot EOP deliverability is to work from evidence outward: headers, trace or NDR, authentication, sender reputation, links, HTML, and then copy. If the failure is an SCL 5 junk placement on one campaign, I would not rebuild everything first. I would remove URLs, test plain text, add back domains, then add design elements back while comparing Microsoft headers.

The long-term answer is a clean baseline. Suped's DMARC reporting, hosted SPF, hosted DMARC, hosted MTA-STS, real-time alerts, and blocklist monitoring make it easier to know when Microsoft is reacting to the message itself versus a domain or DNS issue. That turns EOP troubleshooting into a repeatable process instead of a last-minute guessing exercise.

Suped