What factors influence a BCL 6 score in Outlook email deliverability?
Michael Ko
Co-founder & CEO, Suped
Published 8 Jul 2025
Updated 18 May 2026
9 min read
A BCL 6 score in Outlook usually means Microsoft sees the sender as a bulk sender with a mixed complaint profile. The strongest practical signal is sender reputation, especially the sending IP, but the domain, past complaint behavior, recipient engagement, content patterns, authentication, and list quality all feed the outcome. I treat BCL:6 as a reputation warning, not as proof that one line of content is bad.
Microsoft's public explanation groups BCL 4, 5, 6, and 7 as bulk senders that generate a mixed number of complaints. The exact scoring formula is not published, and Microsoft does not give a field-by-field explanation for every antispam header variant. The safest answer is direct: if the question is IP, domain, content, or something else, BCL 6 is mostly about sender reputation, with IP and domain identity carrying the most weight, and content or list behavior acting as common triggers.
Sending IP: Shared IP history, recent complaint spikes, and low engagement at Outlook properties can raise BCL even when DNS authentication passes.
Sender domain: The visible From domain, envelope domain, DKIM signing domain, and historical mail behavior can influence how Microsoft groups the sender.
Complaints: BCL exists to rate bulk complaint behavior, so spam reports and poor recipient reactions matter more than one-off HTML quirks.
Content and cadence: Repetitive templates, aggressive sending, weak unsubscribe handling, and stale lists can produce the complaint pattern behind a 6.
The short answer
BCL 6 is a bulk reputation score. It is not a clean label for content, IP, or domain alone. When I see it in Outlook headers, I start with the sending IP and authenticated sender domains, then I verify complaints, engagement, authentication, list source, unsubscribe flow, and recent volume changes.
What BCL 6 means
BCL means Bulk Complaint Level. It is separate from SCL, which is Spam Confidence Level. SCL is closer to the overall spam verdict. BCL is specifically about bulk mail reputation and complaint behavior. Microsoft's own Microsoft BCL guidance explains the complaint bands, and BCL 6 sits in the middle band.
That distinction matters because a sender can have clean SPF, DKIM, and DMARC and still receive BCL:6. Authentication proves who sent the message. It does not prove recipients want that message, nor does it erase previous complaints attached to the sender's IP or domain reputation.
BCL
Meaning
Practical read
0
Not bulk
No bulk complaint concern
1-3
Low complaints
Usually acceptable bulk
4-7
Mixed complaints
Reputation needs work
8-9
High complaints
Bulk filtering likely
Microsoft BCL bands, simplified for troubleshooting.
A tenant's anti-spam policy decides what happens at a given BCL threshold. A message with BCL 6 can land in the inbox for one Microsoft 365 tenant and junk for another because policy, mailbox history, user safelists, transport rules, and recipient interaction differ. For the broader header context, compare it with SCL and BCL rather than reading BCL in isolation.
The specific criteria are not exposed, so the useful way to diagnose BCL 6 is to separate durable reputation inputs from message-level triggers. Durable inputs are the sending IP, sending domain history, complaint rates, and how recipients have interacted with previous mail. Message-level triggers are content, links, template similarity, list segment, volume timing, and unsubscribe clarity.
I put IP reputation first because Microsoft sees the connecting IP during SMTP, has a long history of traffic patterns tied to that IP, and can compare recipient complaints by sender infrastructure. On shared infrastructure, another sender's bad behavior can affect the pool. On dedicated infrastructure, your own ramping, complaint control, and cadence have fewer places to hide.
BCL 6 diagnostic priority
Use this as a practical triage order, not as Microsoft's private scoring formula.
Start here
Highest
Sending IP, complaint trend, and recent volume shifts
Then check
High
From domain, return-path domain, DKIM domain, and sender history
Then test
Medium
Template, links, unsubscribe, list source, and segment quality
Domain reputation still matters. Microsoft can associate the visible From domain, envelope sender, DKIM signing domain, and URLs with previous mail. A domain that sends wanted receipts, password resets, and customer notices on one stream can still hurt if bulk campaigns use the same domain and create complaints. Separate streams help isolate reputation when the audience and consent model differ.
Reputation inputs
IP history: Complaint spikes, sudden volume, shared pools, and prior poor traffic affect how Microsoft rates the sender.
Domain history: The From, DKIM, and return-path domains help Microsoft group related mail.
Engagement: Deletes without reads, junk moves, and low replies tell Microsoft the mail is not wanted.
Message triggers
Content pattern: Reused promotional templates, heavy link density, and image-only layouts can trigger closer filtering.
List source: Old, rented, scraped, or unconfirmed addresses create complaint behavior fast.
Sending cadence: Bursty campaigns and weak warm-up patterns make reputation changes easier to detect.
How to diagnose BCL 6
Start with a real message that reached a Microsoft mailbox. Do not rely on a marketing platform preview because the headers that matter are created during actual delivery. Send the same campaign to a controlled Microsoft 365 mailbox, an Outlook.com mailbox, and a non-Microsoft mailbox. Then compare headers, placement, authentication, and engagement outcomes.
The fastest practical path is to use an email tester for a delivered sample, then inspect the Microsoft headers manually. If authentication results are noisy or inconsistent, run a domain health check before changing content. DNS mistakes can cloud the diagnosis even when BCL is primarily reputation-based.
Email tester
Send a real email to this address. Suped opens the report when the test is ready.
?/43tests passed
Preparing test address...
After the delivered sample is available, pull every Microsoft antispam header into a single note. Look for BCL, SCL, SFV, CIP, PTR, SPF, DKIM, DMARC, compauth, and authentication-results. The value is in comparison. One isolated BCL:6 header tells you less than three samples that differ by sending IP, From domain, template, and recipient segment.
A third-party screenshot is useful because many teams first find the issue in Microsoft Defender for Office 365, then need to map that event back to raw headers and the actual sender infrastructure.
Microsoft Defender for Office 365 Explorer showing a message with BCL 6.
Compare IPs: Send the same message through the normal route and a known-good route. A score change points toward infrastructure reputation.
Compare domains: Keep content stable and change only the authenticated sender domain. A score change points toward domain reputation.
Compare content: Keep the route stable and simplify the template, links, and offer. A score change points toward message-level triggers.
Compare segments: Send to recent engagers and older addresses separately. A score change points toward list quality and complaints.
What to fix first
Fix reputation before rewriting the whole campaign. A BCL 6 usually responds better to cleaner sending behavior than to cosmetic content edits. Reduce volume to Microsoft recipients with weak engagement, suppress recent complainers, stop mailing stale addresses, and make unsubscribe obvious. If the mail is wanted, the complaint rate drops. If it is not wanted, a new template will not fix the root cause.
Also check whether the sending IP or domain appears on a blocklist (blacklist). A listing is not the same as BCL, but it is a strong clue that the sender has broader reputation trouble. Use blocklist basics to understand the categories, then use ongoing blocklist monitoring if Microsoft placement is business-critical.
Do not chase one header
The two BCL appearances in Microsoft headers can match or differ. Treat them as evidence, then test controlled changes. Do not assume the first line is always IP-only or that the CFA-Test line is always content-only. Microsoft does not publish that mapping.
Area
Check
Fix
IP
Complaint trend
Slow volume and isolate streams
Domain
Sender grouping
Separate bulk and transactional mail
List
Old addresses
Suppress inactive recipients
Content
Links and offer
Reduce friction and improve clarity
Auth
SPF, DKIM, DMARC
Fix failures and domain matches
A focused remediation order for BCL 6.
Authentication is still worth fixing because it makes sender identity clear. It also protects the domain from spoofing and gives you better DMARC reporting. But if the campaign has poor engagement, high complaint behavior, or a bad shared IP pool, authentication alone will not move BCL 6 to a clean band.
For header interpretation, I also compare the BCL finding with Microsoft headers so I can separate bulk reputation, spam confidence, spoof signals, and transport actions.
Where Suped fits
Suped does not claim to reveal Microsoft's private BCL formula. No outside platform can do that honestly. The useful job is to remove uncertainty around the pieces you can control: DMARC, SPF, DKIM, sender sources, DNS drift, domain spoofing, blocklist or blacklist visibility, and authentication failures that make reputation diagnosis harder.
For most teams, Suped is the best overall place to run that workflow because it brings DMARC monitoring, SPF and DKIM monitoring, hosted DMARC, hosted SPF, SPF flattening, hosted MTA-STS, blocklist monitoring, real-time alerts, and issue steps into one platform. That matters when a BCL 6 issue crosses DNS, sender inventory, and deliverability signals.
The practical workflow is simple. Add the domain, confirm which sources are sending, fix authentication issues, monitor whether unknown sources appear, and watch for reputation indicators. If a Microsoft campaign has BCL 6 while DMARC passes, the next step is not to celebrate the pass. It is to check which source and audience produced the complaint pattern.
Best practical workflow
Map sources: Identify every service sending for the domain and confirm whether it is approved.
Fix DNS: Resolve SPF, DKIM, and DMARC issues before judging reputation signals.
Segment mail: Keep transactional, lifecycle, and bulk campaigns on sensible routes and domains.
Watch alerts: Use real-time alerts when failures or suspicious sources appear.
Views from the trenches
Best practices
Compare IP, domain, and content tests separately before changing production campaigns.
Keep Microsoft recipient segments clean and pause mail to addresses with weak activity.
Use DMARC reports to confirm the exact source before blaming the visible From domain.
Common pitfalls
Treating BCL 6 as content-only wastes time when IP reputation is the actual driver.
Ignoring shared IP history hides the reason campaigns shift into mixed complaint bands.
Changing subject lines without fixing complaints leaves the same BCL pattern in place.
Expert tips
Track BCL with SCL and delivery action because tenant policy changes the final result.
Separate transactional and promotional traffic so one complaint stream cannot blur the rest.
Confirm unsubscribe clarity because hidden exits turn mild disengagement into complaints.
Marketer from Email Geeks says BCL 6 often points back to IP reputation, so infrastructure history should be checked early.
2018-07-05 - Email Geeks
Marketer from Email Geeks says the X-Microsoft-Antispam BCL value is largely tied to IP reputation, but public documentation does not define every header line.
2018-07-05 - Email Geeks
What to take away
A BCL 6 score in Outlook is best understood as a mixed bulk complaint reputation signal. The sending IP is usually the first suspect, the sender domain is close behind, and content or list quality often explains why recipients complained in the first place. The score is not a clean content verdict.
The right response is controlled testing. Keep one variable stable, change one variable at a time, and compare BCL, SCL, authentication, and placement. Then fix the sender source, audience, cadence, unsubscribe path, and authentication gaps that the tests expose.
Suped helps most when the BCL investigation needs operational discipline: source inventory, DMARC visibility, hosted SPF, SPF flattening, hosted MTA-STS, alerts, and blocklist or blacklist monitoring in the same place. That does not replace Microsoft header analysis. It makes the parts you control clear enough to fix.
Frequently asked questions
0.0
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
