How do I troubleshoot email deliverability issues with Microsoft Exchange Online Protection?
Updated on 3 Aug 2026: We expanded the EOP troubleshooting workflow with current message trace, SCL, policy, and restricted-sender guidance.
Troubleshooting Microsoft Exchange Online Protection deliverability starts by proving exactly what happened to the message: rejected, delayed, quarantined, junked, or delivered with a spam verdict. Next, read the Microsoft headers, check SPF, DKIM, and DMARC domain matching, review the sending IP and domain reputation, and run controlled content tests that isolate links, HTML, images, subject line, and copy.
An SCL 5 result means Microsoft classified the message as spam, but it does not prove that one word or one line of HTML caused the verdict. The fastest route is usually a narrow test plan: confirm the verdict, remove tracking and destination links first, reduce the template to plain text, then add elements back one at a time.
Suped fits this workflow when the problem might be tied to authentication, domain health, SPF lookup pressure, DKIM signing, DMARC reporting, or blocklist (blacklist) visibility. Suped's product gives teams one place to monitor DMARC, SPF, DKIM, hosted controls, and reputation signals, so EOP troubleshooting does not depend on scattered checks.
Start with the exact failure mode
A common EOP troubleshooting mistake is rewriting copy before proving the failure mode. A message that bounces with an SMTP error needs a different investigation than a message that lands in Junk Email with SCL 5. A delayed message points toward routing, throttling, recipient systems, or Microsoft service health. A quarantined message points toward tenant policy, malware scanning, phishing verdicts, or admin configuration.
|
|
|
|---|---|---|
Junk folder | SCL 5 | Headers |
Bounce | 5xx | NDR |
Delay | 4xx | Trace |
Quarantine | Policy | Defender |
Common EOP symptoms and the first place to look.
For Microsoft 365 tenants, the admin path usually starts with message trace. Search by sender, recipient, and time window, then open the event details. A Delivered trace status does not prove inbox placement because spam-filtered mail sent to Junk Email or quarantine can still appear as Delivered. If there is a bounce, read the enhanced status code and compare it with Microsoft's NDR codes. If there is no bounce and the message reached the mailbox, headers and placement are more useful than guessing.
Microsoft Defender portal message investigation screen
Keep the first evidence set small
- Original message: Save the full original message with complete headers, not a forwarded copy.
- Recipient context: Record whether the mailbox is Outlook.com, Exchange Online, or another hosted tenant.
- Send time: Use the exact timestamp so trace results and headers line up cleanly.
- Verdict: Write down the delivery action, folder placement, SCL, BCL, and authentication verdict.
Read the Microsoft headers
When a message is delivered but placed in spam, the headers are the main diagnostic record. Capture the final SCL, BCL, SFV, IPV, CAT, composite authentication result, DKIM signing domain, SPF return-path domain, connecting IP, and any tenant-specific policy markers. A short reference on Microsoft headers helps when the header names look similar but carry different verdicts.
Header fields worth capturingtext
X-Forefront-Antispam-Report: CIP:198.51.100.50; SCL:5; SFV:SPM; IPV:NLI; CAT:SPM; DIR:INB X-MS-Exchange-Organization-SCL: 5 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(...) Authentication-Results: spf=pass; dkim=pass; dmarc=pass; compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of example.com)
Default SCL handling in Microsoft 365
SCL is one signal, and the active anti-spam or preset security policy can change the default action.
Bypass
SCL -1
Spam filtering was skipped; the default action is inbox delivery.
Not spam
SCL 0 or 1
The default action is inbox delivery.
Spam
SCL 5 or 6
The default is Junk Email; Strict preset policy uses quarantine.
High confidence spam
SCL 7 to 9
Default policies use Junk Email; Standard and Strict preset policies use quarantine.
Use the SFV value in X-Forefront-Antispam-Report to find the component behind the SCL. For example, SFV:SPM points to spam filtering, SFV:SKN or SFV:SKS points to a mail flow rule, and SFV:SKA, SFV:SKB, or SFV:BLK points to a list-based decision. X-CustomSpam identifies an Advanced Spam Filter trigger when that header is present.
Do not stop at spf=pass or dkim=pass. Passing authentication helps, but Microsoft can still score content, sending patterns, link domains, user engagement, and tenant policy. Spam filtering does not stamp SCL 2, 3, or 4, and other components can set or override an SCL. If the score varies across Microsoft destinations, compare the same message across accounts before treating content as the only variable.
Verify authentication and domain health
Before rewriting an email, verify the sending identity. For DMARC, the visible From domain must share its organizational domain with either an SPF-authenticated return-path domain or a valid DKIM signing domain under relaxed matching. Strict DMARC matching requires an exact domain match.
- SPF domain match: Confirm that the authenticated envelope sender satisfies the active DMARC matching mode for the From domain.
- DKIM domain match: Check that at least one valid DKIM signature satisfies the active DMARC matching mode.
- DMARC policy: Use DMARC monitoring to find unapproved senders, domain-match gaps, and policy changes.
- DNS health: Run a domain health check before blaming copy or design.
Example DMARC record for monitoring firsttext
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1; adkim=r; aspf=r
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Suped's hosted SPF and SPF flattening help when the SPF record is close to the 10 DNS lookup limit or when teams keep adding senders through DNS tickets. Suped's hosted DMARC also supports staged policy changes without a DNS edit for every adjustment.
Test content without chasing myths
If authentication is clean and the issue is isolated to one email, test the content. Do not search for banned words. Modern filtering is not that simple, and a change that moves one test to the inbox does not prove that one removed phrase was the cause. It proves the message changed enough for a different verdict at that moment.
Poor content testing
- Many changes: Changing subject, copy, links, and design in one test hides the cause.
- Spam words: Deleting random phrases creates false confidence and weak future lessons.
- One inbox: Testing only one mailbox can confuse mailbox history with message quality.
Useful content testing
- Links first: Remove all URLs, then add destination and tracking domains back one by one.
- Plain text: Send a text-only version to separate message body risk from template risk.
- Stable seed set: Use the same test recipients and compare headers, not only folder placement.
A useful sequence is direct: test a plain-text version, test the HTML without images, test images without tracking links, test each destination domain, then test the final version. If the problem only appears when one URL is present, inspect the landing page, redirects, certificate, page size, and whether the linked domain has blocklist (blacklist) history.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
A real-send email tester is useful here because it captures the message as delivered. That matters more than a static checklist because the delivered message includes final tracking domains, MIME structure, authentication results, and headers.
Check links, size, and reputation
For a one-off campaign that suddenly gets an EOP spam verdict while normal sends are fine, URLs are often the first content variable to check. That includes visible links, tracking links, image hosts, unsubscribe domains, redirect chains, and any domain mentioned in the copy. A clean sender can still hurt placement by linking to a risky or compromised destination.
- HTTPS only: Use secure links and avoid mixed redirect chains that downgrade to plain HTTP.
- Landing pages: Check that pages load, are not compromised, and do not trigger browser warnings.
- Image weight: Keep images reasonable and avoid a message that is mostly linked image content.
- HTML quality: Remove broken markup, hidden text, malformed tables, and bloated conditional code.
- Reputation: Use blocklist monitoring for IPs, sending domains, and linked domains.
Five-part EOP troubleshooting workflow: headers, auth, URLs, HTML, reputation
Message size belongs in the investigation when a trace or NDR reports a limit, delay, or unresponsive destination. Large image weight or a long HTML body alone does not diagnose an SCL 5 verdict. For placement tests, create a reduced version that keeps the same offer and audience but removes design weight, then compare the final headers and folder placement.
Resolve a restricted outbound sender
If one Microsoft 365 user can receive mail but every outbound message fails with 550 5.1.8 Access denied, bad outbound sender, treat it as an account restriction rather than an inbox-placement problem. Microsoft adds restricted users or connectors to Restricted entities when outbound limits or suspicious sending indicate possible compromise.
- Confirm the NDR: Capture the full 550 5.1.8 response and verify which mailbox or connector is named.
- Investigate compromise: Review recent sign-ins, Sent Items, mailbox rules, forwarding, and connector activity for changes the user did not make.
- Secure the account: Regain control of the identity, reset compromised credentials, revoke active sessions, and verify MFA before removing the restriction.
- Unblock the entity: An authorized admin can review and unblock the mailbox under Email & collaboration, Review, Restricted entities in the Microsoft Defender portal.
- Retest after release: Restrictions usually clear within one hour, but Microsoft says a transient issue can extend the wait to 24 hours. Trace the new test message instead of resending the original campaign at volume.
Secure first, unblock second
Unblocking an account before the compromise is contained can restart suspicious sending and trigger another restriction. Treat the NDR as a security signal, not a routine delivery retry.
Understand Microsoft destination differences
Outlook.com and Exchange Online are both Microsoft destinations, but they do not always use the same filtering path, policy context, or recipient signals. A message can reach a corporate Microsoft 365 inbox and still land in junk at Outlook.com. That does not automatically mean authentication failed. The consumer filtering model can score the message differently.
For broader context, compare the result against SCL and BCL ratings. SCL is the spam confidence level. BCL is the bulk complaint level. A campaign can have acceptable authentication and still look like bulk or low-engagement mail to Microsoft.
Do not overfit one test
Microsoft filters change, mailbox engagement changes, and each test send can affect later results. If one edit moves a seed mailbox to the inbox, treat that as a clue, not proof. The stronger evidence is a pattern across multiple controlled sends.
If you send bulk or campaign mail through Microsoft 365, read Microsoft's outbound spam protection guidance. Microsoft treats bulk sending through Microsoft 365 as best effort and enforces undisclosed outbound limits. Use separately authenticated subdomains for bulk mail so regular business mail does not share the same domain identity.
Use Suped for ongoing monitoring
EOP troubleshooting is easier when the baseline is already known. Suped's product turns DMARC authentication data and reputation signals into issues, alerts, and remediation steps. That helps a team test whether a Microsoft spam verdict followed a message change, a sending-source change, or a DNS problem.
Issues page showing top issues, verified sources, unverified sources, and authentication pass rates
The practical workflow is simple: monitor the domain continuously, verify new senders before launch, watch for sudden authentication drops, and compare blocklist (blacklist) alerts with campaign activity. If Microsoft starts junking a message, the team can separate known domain posture from content or URL testing.
Where Suped helps during EOP troubleshooting
- Issue detection: Suped flags authentication failures, unverified sources, and likely fixes.
- Real-time alerts: Teams can act when failures spike instead of waiting for a campaign review.
- Hosted controls: Hosted SPF, hosted DMARC, and hosted MTA-STS reduce DNS change friction.
- Multi-tenant work: MSPs and agencies can manage many client domains from one dashboard.
A practical troubleshooting sequence
Use a fixed order when time is tight. The goal is to avoid spending hours changing copy when the issue is a bad link, a failing DKIM signature, a tenant policy, a restricted sender, or a sending domain with weak reputation.
- Confirm placement: Check whether the message bounced, delayed, quarantined, or landed in junk.
- Read trace events: Open the details even when the message trace status is Delivered.
- Collect headers: Capture SCL, BCL, SFV, IPV, CAT, authentication results, policy markers, and connecting IP.
- Verify DNS: Check SPF includes, DKIM selectors, DMARC domain matching, and lookup limits.
- Review policy: Check preset security policies, custom anti-spam policies, mail flow rules, and Tenant Allow/Block List entries.
- Check URLs: Test the message without URLs, then add each link domain back.
- Reduce HTML: Compare plain text, lean HTML, and the final designed version.
- Compare audiences: Estimate the share of Microsoft recipients before deciding how much time to spend.
That last step is not a shortcut. If Outlook.com is two percent of the list and the campaign is one-time, a rewrite can cost more than the expected gain. If Microsoft recipients are a major segment, the structured test is worth it because the fix can protect the current send and reduce risk on future sends.
Views from the trenches
Best practices
Start with URLs and landing pages before rewriting copy or redesigning the template.
Compare headers across stable seed accounts and avoid relying on folder placement alone.
Use smaller controlled edits so each test has one clear variable to review later.
Common pitfalls
Treating one inbox result as proof that a single word caused Microsoft filtering.
Ignoring Outlook audience size before spending hours on a one-time campaign review.
Testing forwarded messages instead of the final email received by the mailbox itself.
Expert tips
Filters change during testing, so treat every positive result as a clue, not a fact.
A broken or risky link can explain a content issue even when authentication passes.
Check HTTPS, image weight, malware warnings, and landing page behavior together.
Expert from Email Geeks says content testing has limits because filter behavior changes while testing continues.
2024-10-02 - Email Geeks
Marketer from Email Geeks says URLs are the first content variable to isolate when one campaign has trouble.
2024-10-02 - Email Geeks
Turn evidence into a deliverability fix
Troubleshoot EOP deliverability by working outward through trace or NDR evidence, headers, authentication, policy, sender reputation, links, HTML, and copy. For an SCL 5 junk placement on one campaign, remove URLs, test plain text, add domains back, then restore design elements while comparing Microsoft headers.
A clean baseline makes the process repeatable. Suped's DMARC reporting, hosted SPF, hosted DMARC, hosted MTA-STS, real-time alerts, and blocklist (blacklist) monitoring help distinguish a message-level verdict from a domain, DNS, or sending-source problem.
