Why are emails to O365 recipients getting quarantined and how to fix?
Matthew Whittaker
Co-founder & CTO, Suped
Published 31 May 2025
Updated 17 Aug 2025
6 min read
Dealing with emails consistently landing in the quarantine folders of Microsoft Office 365 recipients can be incredibly frustrating. It's a common challenge for many senders, especially those managing email for multiple clients, like an Email Service Provider (ESP). When legitimate messages are flagged, it impacts communication, deliverability, and ultimately, user trust. It can feel like you are constantly battling against an invisible wall, trying to understand why your emails, which appear perfectly legitimate to you, are being deemed suspicious by a recipient's system.
The immediate thought might be that the recipient's IT team needs to whitelist your domain or IP address. While this can provide a temporary fix for specific recipients, it's not a scalable solution, especially when the issue affects numerous clients or a large audience. We've found that this approach becomes a significant operational burden, constantly chasing down individual IT departments to adjust their filters.
The core of the problem often lies deeper than a simple filter adjustment. Microsoft 365 (O365) employs sophisticated security measures to protect its users from spam, malware, and phishing attempts. This means that even well-intentioned emails can sometimes trigger these defenses if certain criteria aren't met, or if they exhibit characteristics that O365 interprets as risky.
Understanding O365 quarantine mechanisms
Understanding why O365 quarantines emails is the first step toward a lasting solution. O365's Exchange Online Protection (EOP) and Microsoft Defender for Office 365 (MDO) utilize a multi-layered approach to filter incoming mail. They assess various factors, from sender reputation and authentication to content analysis and potential threats. If an email triggers enough red flags, it's placed in quarantine rather than delivered to the inbox.
Common reasons for O365 quarantine
Sender reputation: Low reputation, often due to high complaint rates or spam trap hits.
Authentication failures: Missing or misconfigured SPF, DKIM, or DMARC records.
Content analysis: Suspicious links, attachments, or spammy keywords in the email body or subject line. Office 365 also uses advanced algorithms to detect phishing attempts based on content characteristics.
Blacklists (or blocklists): The sending IP address or domain appearing on a public or private blacklist (blocklist).
Recipient policies: Specific anti-spam or anti-malware policies configured by the recipient's IT administrator.
One often overlooked aspect is the DMARC policy. If your domain lacks proper DMARC alignment, O365 may assume a policy for your domain, which can lead to non-aligned emails being bulked or quarantined. This is particularly relevant when sending through third-party ESPs, where the 'From' address may not align with the actual sending domain unless DMARC is correctly implemented. Understanding these nuances is key to diagnosing why your emails are facing issues.
It's also worth noting that Microsoft's filters are known to be quite aggressive. Sometimes, issues with Office 365 spam folders can be an early indicator of broader deliverability challenges that might soon affect other mail providers. Keeping a close eye on your reputation and technical configurations is paramount.
Diagnosing the problem
When emails are quarantined, the first step is to trace the message within the Office 365 environment. This provides valuable insights into why the email was flagged. Administrators can access the Microsoft 365 Defender portal quarantine area to view quarantined messages, their original intended recipients, and the reason for quarantine, such as spam, phishing, or malware. This portal also allows for releasing messages or reporting them as not junk.
Pay close attention to the Bounce Confidence Level (BCL) and Spam Confidence Level (SCL) numbers assigned by O365. These scores indicate how confident O365 is that a message is legitimate or spam. If these scores are below 5, it suggests that the issue might stem from individual recipient filters rather than a widespread O365 block. This distinction is crucial, as global issues can be addressed by the ESP (or sender), whereas individual filters require direct engagement with the recipient's IT department. For transactional emails sent via third-party providers like Postmark, checking these scores can help determine why they are being blocked despite correct authentication.
Example Message Header Showing SCL and BCL
X-Forefront-Antispam-Report: ...; SCL:5; BCL:0;
Another area to investigate is your IP strategy. If you're using a mixture of dedicated and shared IPs, a sudden quarantine problem could indicate that an IP within your pool has been compromised or is in a bad neighborhood on a blocklist (or blacklist). Proximity of problematic IPs within your infrastructure can lead to wider deliverability issues. Utilize blocklist monitoring tools to check the status of your sending IPs and domains regularly. It's also important to confirm if any emails are being blocked by Office 365 due to specific content patterns.
Implementing solutions and best practices
To prevent O365 quarantines, a proactive approach focusing on strong email authentication and responsible sending practices is essential. Ensuring your SPF, DKIM, and DMARC records are correctly configured and aligned is paramount. O365 heavily relies on these protocols to verify sender legitimacy. A failed DMARC verification, for instance, can lead directly to messages being quarantined.
Content optimization: Avoid spammy keywords, excessive links, or suspicious attachments. Ensure your email content is clear and relevant.
Reactive steps & troubleshooting
Communicate with recipients: Advise them to check their Microsoft 365 quarantine and, if appropriate, add your sending domain to their Safe Senders List. This is particularly important for test emails.
Review O365 security policies: Recipients' IT admins should review their anti-spam and anti-malware policies to ensure they aren't overly aggressive for legitimate mail.
Test systematically: Set up your own O365-hosted domain to send test messages. This helps differentiate between global deliverability issues and specific recipient-side filtering problems. Consider using an email deliverability tester.
It is also crucial to be vigilant about your IP and domain reputation through blocklist monitoring. If you're on a shared IP, the sending practices of others can affect your deliverability to O365 recipients. This is why it's important to choose ESPs that maintain high standards for their shared IP pools.
Views from the trenches
Best practices
Maintain pristine email lists, regularly cleaning out inactive or invalid addresses to reduce bounces and spam trap hits.
Ensure all email authentication protocols (SPF, DKIM, DMARC) are correctly configured and pass validation checks consistently.
Segment your email sends to different IP pools or domains based on content type and recipient engagement to manage reputation effectively.
Educate clients on permission-based sending practices, emphasizing explicit consent to avoid complaints and negative feedback.
Collaborate with recipient IT teams to understand their specific filtering policies and establish whitelisting protocols for critical communications.
Common pitfalls
Ignoring DMARC aggregate reports, which provide crucial insights into authentication failures and potential spoofing attempts.
Over-reliance on shared IP addresses without understanding the sending habits of other users on the same IP.
Failing to monitor Bounce Confidence Level (BCL) and Spam Confidence Level (SCL) scores from O365 to pinpoint specific issues.
Sending emails with excessive links, suspicious attachments, or overly promotional content that triggers O365's phishing filters.
Neglecting to remove recipients who consistently mark emails as spam, leading to degraded sender reputation over time.
Expert tips
Set up your own O365-hosted domain for testing to differentiate between global O365 filtering issues and individual recipient-specific configurations.
Analyze email headers for O365's BCL and SCL scores, as scores below 5 often indicate recipient-specific filtering rather than a global block.
If using mixed IP strategies (dedicated/shared), routinely audit IP reputation and investigate any proximity of issues among clients.
Proactively communicate with recipients and their IT teams, guiding them on how to release messages from quarantine and whitelist your domain.
Ensure your DMARC policy is robust and aligned, as O365 may impose a stricter policy if it detects misalignment, leading to increased quarantines.
Expert view
Expert from Email Geeks says to look at the proximity of IPs with clients experiencing issues, as a bad neighborhood might be contributing to blocklists.
2023-06-28 - Email Geeks
Expert view
Expert from Email Geeks says SNDS (Sender Network Data Services) only provides reports for free domains and is not useful for O365 issues.
2023-06-28 - Email Geeks
Moving forward
Resolving email quarantine issues with O365 recipients requires a comprehensive approach that goes beyond simple whitelisting. By focusing on strong email authentication, maintaining a stellar sender reputation, and diligently analyzing O365's diagnostic reports, you can significantly improve deliverability. Consistent monitoring and adherence to email best practices are key to ensuring your messages reach the inbox, not the quarantine.
Microsoft Office 365 recipients can be incredibly frustrating. It's a common challenge for many senders, especially those managing email for multiple clients, like an Email Service Provider (ESP). When legitimate messages are flagged, it impacts communication, deliverability, and ultimately, user trust. It can feel like you are constantly battling against an invisible wall, trying to understand why your emails, which appear perfectly legitimate to you, are being deemed suspicious by a recipient's system.
