How do I troubleshoot email deliverability issues with Microsoft Exchange Online Protection?
Michael Ko
Co-founder & CEO, Suped
Published 3 Aug 2025
Updated 17 Aug 2025
7 min read
Dealing with email deliverability issues, especially when messages are landing in the spam folder, can be incredibly frustrating. It’s even more puzzling when it specifically affects Outlook.com but not Microsoft 365, despite all other authentication and scoring checks appearing perfectly fine. This scenario often points towards a content or specific email structure problem that Microsoft Exchange Online Protection (EOP) is flagging. It's not always about your sender reputation, but sometimes the message itself.
When an email receives an X-MS-Exchange-Organization-SCL (Spam Confidence Level) of 5.0, it indicates that EOP has determined it to be spam. While Office 365 and Outlook.com share some underlying infrastructure, their filtering policies and sensitivity can differ, leading to varied inbox placement. This means a message that passes through Office 365 filters might still be flagged by Outlook.com's more stringent personal mailbox filters.
My goal is to outline a structured approach to pinpointing the root cause of these specific deliverability issues. It can feel like looking for a needle in a haystack, especially when the problem is isolated to a single, important email. However, by systematically reviewing potential culprits, we can increase our chances of getting that message into the inbox.
Microsoft Exchange Online Protection is a cloud-based email filtering service that helps protect organizations from spam and malware. It works as the first line of defense for emails sent to Microsoft 365 mailboxes. Understanding its multi-layered filtering process is key to troubleshooting.
EOP uses several mechanisms to evaluate incoming emails, including connection filtering, spam filtering, and anti-malware protection. Connection filtering checks the sender's IP reputation. Spam filtering assesses the message content, headers, and sender characteristics. Anti-malware protection scans for malicious attachments and links. A high SCL (Spam Confidence Level) score suggests the email triggered one or more of these content-based filters.
Even if your email authentication (SPF, DKIM, DMARC) is perfectly configured, EOP can still classify an email as spam if its content or sender behavior raises red flags. This is particularly true for transactional or marketing emails that might contain certain keywords, image-to-text ratios, or links that are perceived as suspicious. It's a complex system, and a single element can sometimes trip a filter.
EOP's email filtering layers
Connection filtering: Evaluates sender IP reputation. If your sending IP is on a blocklist (or blacklist), EOP might reject the email at this stage. It is crucial to monitor IP reputation constantly to prevent this. To learn more, check out our guide, What happens when your IP gets blocklisted.
Spam filtering: Examines message content, headers, and sender characteristics against a vast database of spam patterns. This is often where content-related issues trigger SCL scores. Learn about Why Your Emails Are Going to Spam.
Anti-malware protection: Scans for malicious attachments and links. Compromised links or suspicious file types can easily lead to blocking.
Mail flow rules: Custom rules configured by administrators can further affect how emails are handled, potentially overriding or enhancing EOP's default filtering.
First steps in troubleshooting
When facing a specific deliverability issue with Microsoft Exchange Online Protection (EOP), my first instinct is always to leverage the built-in diagnostic tools that Microsoft provides for email delivery issues. The message trace tool in the Exchange Admin Center (EAC) is incredibly powerful for tracking the journey of an email and identifying where it was stopped or diverted. It can tell you if the email reached EOP, if it was filtered, and why.
I also always double-check the DNS records configured for the sending domain. Even if they were fine for other emails, a recent change or an overlooked detail could be impacting this specific send. This includes SPF, DKIM, and DMARC. These records are fundamental to email authentication and play a significant role in how EOP assesses the legitimacy of your emails. Misconfigurations here are common culprits for deliverability problems. I often use a deliverability tester to get a quick overview of these settings.
Moreover, I would examine any non-delivery reports (NDRs) or bounce messages for specific error codes or explanations. While the initial problem points to an SCL of 5.0, an NDR could provide more granular detail, such as whether it was due to a bad sender, content, or policy. Microsoft provides extensive documentation on interpreting NDRs in Exchange Online.
DNS record
Purpose
Troubleshooting check
MX record
Directs incoming mail to your mail server.
Verify it points correctly to Microsoft 365.
SPF record
Authorizes mail servers to send emails on your domain's behalf. We have a helpful guide on the full form of SPF
Ensure all legitimate sending IP addresses are included and that you haven't exceeded the 10-lookup limit. For more details, consult how to troubleshoot SPF and DMARC settings.
DKIM record
Adds a digital signature to emails, verifying the sender and message integrity. For an in-depth look, see our guide to common DKIM selectors.
Aligns SPF and DKIM and tells receiving servers what to do with emails that fail authentication. For a deeper dive into the benefits, read The benefits of implementing DMARC.
If basic checks and DNS configurations don't reveal the problem, I focus on the email's content. This is particularly relevant when only one specific email is affected, suggesting its unique design, text, or embedded elements might be triggering EOP's spam filters. I'd begin by examining the URLs present in the email. Are any linked domains known for poor reputations or on public blacklists (blocklists)? A single suspicious link can significantly impact an email's SCL.
Content evaluation
URLs and domains: Check all links within the email for suspicious domains or URLs that might be on a blacklist. Even redirects can cause issues if the final destination is problematic.
Text-to-image ratio: Emails with too many images and too little text can trigger spam filters, as this is a common tactic for spammers trying to bypass content scans.
Spam trigger words: While less impactful than in the past, certain phrases or excessive use of capital letters and exclamation marks can still contribute to a higher spam score.
HTML/CSS structure: Poorly coded HTML, excessive inline styles, or hidden text can also be flagged by filters.
Another critical area is sender reputation, even if it seems fine for other sends. EOP, like other major email providers, uses a sender's reputation to inform its filtering decisions. This reputation isn't just about your domain, but also the IP address you send from and your sending behavior over time. While your overall reputation might be good, if the specific content of this email mimics known spam, it can be treated as an anomaly. Staying off email blocklists is a continuous effort.
To isolate the issue, I would recommend creating stripped-down versions of the problematic email. Start with a plain text version, then gradually add back elements (images, specific links, sections of copy) one by one, retesting with each addition. This iterative process, though time-consuming, helps pinpoint the exact element that's causing the SCL score to spike. It's a methodical approach, but effective for unique problematic sends. For more troubleshooting techniques, see our guide on how email experts troubleshoot deliverability issues.
Advanced techniques and ongoing deliverability
Beyond content, examine your EOP and Microsoft 365 Defender portal settings. Look for any custom mail flow rules or anti-spam policies that might be affecting this specific email type. Sometimes, an overly aggressive rule or a misconfigured allow/block list entry can inadvertently flag legitimate mail. It's worth reviewing these configurations, especially if they've been recently modified. This is one of the ways to solve Office 365 SCL varying issues.
Lastly, remember that filter algorithms are constantly evolving. What works today might not work tomorrow, and isolating a single spam trigger can be challenging. Focusing on overall email sending best practices—such as maintaining a clean list, sending wanted mail, and ensuring clear calls to action—will always be your best defense against deliverability issues with EOP or any other provider.
Best practices for EOP deliverability
Maintain high sender reputation: Ensure consistent sending volume and positive engagement metrics.
Regularly clean your email lists: Remove inactive or invalid addresses to reduce bounces and spam trap hits.
Monitor your deliverability metrics: Track open rates, click-through rates, and complaint rates to spot issues early.
Comply with Google and Yahoo sender requirements: Implement DMARC and ensure low spam complaint rates.
Views from the trenches
Best practices
Actively use Microsoft's message trace tool to diagnose delivery paths and SCL scores.
Ensure DNS records (SPF, DKIM, DMARC) are always correctly configured and validated.
Regularly audit email content, especially URLs, for anything that could be flagged by filters.
Common pitfalls
Overlooking content issues when authentication and general reputation are good.
Failing to review specific mail flow rules or anti-spam policies in the Defender portal.
Assuming Outlook.com and Office 365 have identical filtering behaviors.
Expert tips
Always check all URLs in your email content, as one bad link can ruin deliverability.
If it's a unique, one-time send, evaluate if the troubleshooting effort outweighs the benefit.
Understand that email filters constantly change, so a fix today might not prevent future issues.
Marketer view
Marketer from Email Geeks says they have a specific email with an SCL 5.0 score for Microsoft Exchange Online Protection (EOP) that lands in the spam folder for Outlook.com, while Office 365 is unaffected and all other checks are green. They suspect a content or code-related issue.
2024-03-10 - Email Geeks
Expert view
Expert from Email Geeks says that for content filtering, it's best to start by checking URLs in messages for domains with poor reputations or by swapping out text to see what might allow the email to reach the inbox.
2024-03-10 - Email Geeks
Navigating EOP challenges
Troubleshooting email deliverability issues with Microsoft Exchange Online Protection (EOP), especially for isolated cases like an SCL 5.0 on Outlook.com, requires a systematic approach. While your sender reputation and authentication might be solid, the specifics of your email's content or structure can still trigger EOP's sophisticated filters. Focusing on tools like message trace, carefully reviewing DNS records (SPF, DKIM, DMARC), and iteratively testing content changes are crucial steps.
Remember that email filtering is dynamic, and what works today may not work tomorrow. The key is to be proactive, continuously monitor your email performance, and adhere to best practices. By doing so, you can significantly improve your chances of consistently landing in the inbox, even with the stringent requirements of EOP.
Outlook.com but not 
Microsoft 365, despite all other authentication and scoring checks appearing perfectly fine. This scenario often points towards a content or specific email structure problem that Microsoft Exchange Online Protection (EOP) is flagging. It's not always about your sender reputation, but sometimes the message itself.
Google and 
Yahoo sender requirements: Implement DMARC and ensure low spam complaint rates.
