What do Apple X-Headers mean in email filtering?
Michael Ko
Co-founder & CEO, Suped
Published 30 May 2025
Updated 4 Jun 2026
9 min read
Summarize with
Apple X-Headers are private mail-processing headers that describe how Apple's filtering path handled a message. The useful answer is simple: X-Apple-MoveToFolder tells you the folder Apple selected, and X-Apple-Action tells you the action label Apple attached to that placement. When you see X-Apple-MoveToFolder: Junk and X-Apple-Action: CLXJUNK/Junk, Apple treated that message as junk for that mailbox or delivery path.
I read these headers as placement evidence, not as a public scoring API. Apple does not publish a complete dictionary for these fields, and X-Headers are not Internet standards. They are added by mail systems for internal diagnostics, filtering decisions, routing notes, or client behavior. That means they are useful, but only when you compare them with the full header set, authentication results, recipient behavior, and repeated test sends.
Observed Apple placement headers
X-Apple-MoveToFolder: Junk X-Apple-Action: CLXJUNK/Junk X-ICL-SCORE: 4.333034030041 x-spam-flag: yes x-suspected-spam: true X-Apple-MoveToFolder: INBOX X-Apple-Action: MOVE_TO_FOLDER/INBOX X-ICL-SCORE: 3.333033230041
Short answer
- Folder: X-Apple-MoveToFolder shows the destination Apple chose, commonly Junk or INBOX.
- Action: X-Apple-Action shows the internal action name attached to that destination.
- Score: X-ICL-SCORE is useful context, but it is not a published Apple threshold.
- Proof: A single header sample proves that message's handling, not every recipient's result.
What the Apple X-Headers say
The most important Apple X-Headers in this situation are placement headers. They answer the practical question, "Where did Apple put the message after filtering?" That matters because senders often receive a forwarded copy or a seed-mailbox sample and need to work out whether the message was accepted, routed to the Inbox, routed to Junk, or changed later by a client-side rule.
Use the headers together. X-Apple-MoveToFolder gives the folder name. X-Apple-Action gives a more specific action string. X-ICL-SCORE gives numeric context, but Apple has not documented a sender-facing scoring scale. Extra fields such as x-spam-flag and x-suspected-spam make the junk interpretation stronger when they appear with the folder and action values.
|
|
|
|---|---|---|
MoveToFolder | Junk | Junk placement |
MoveToFolder | INBOX | Inbox placement |
Action | CLXJUNK | Junk action |
Action | MOVE | Folder move |
ICL score | Number | Score context |
Compact interpretation of common Apple filtering fields.
If you need to inspect a message in iCloud Mail, Apple's own help page explains how to view all headers. That is the starting point because the visible folder alone is not enough. A user can move a message manually, a local rule can move it, and a forwarded message can lose the header chain that explains the original decision.
Infographic showing Apple header parts: folder, action, score, and flags.
The CLX part in CLXJUNK is the least useful part for senders. Treat it as an internal filtering label. It is not a DNS setting, a campaign setting, or a remediation instruction. The actionable part is the final decision: Junk. Once you know that, the next work is to determine whether the cause is authentication, reputation, content, engagement, recipient rules, or a one-off sample.
How I interpret Junk versus INBOX
When the folder header says Junk, I treat the sample as a confirmed Apple-side junk placement for that delivery. When it says INBOX, I treat it as a confirmed inbox placement for that delivery. The word "delivery" matters. Apple has many mailboxes, user-level training, client settings, and routing paths. One result gives evidence for that exact sample, then repeated samples tell you whether it is a pattern.
The following comparison is how I triage the two common outcomes before changing DNS, sender infrastructure, or content.
Junk path
- Signal: X-Apple-MoveToFolder: Junk is the strongest placement clue.
- Action: CLXJUNK/Junk confirms the action label matches the folder.
- Flags: x-spam-flag and x-suspected-spam make the result easier to trust.
- Next: Compare against authentication, source, campaign, and recipient history.
Inbox path
- Signal: X-Apple-MoveToFolder: INBOX points to a successful Inbox placement.
- Action: MOVE_TO_FOLDER/INBOX shows a folder move into Inbox.
- Score: A lower score has appeared with Inbox samples, but it is not a rule.
- Next: Keep a baseline so future Junk samples have a clean comparison.
I do not use X-ICL-SCORE as a standalone pass or fail value. In the samples above, a Junk message had a score around 4.33 and an Inbox message had a score around 3.33. That suggests the score tracks risk in some way, but it does not prove that 4.0, 4.3, or any other number is a boundary. The folder and action headers carry more practical weight.
Evidence weight for Apple header review
Use this to decide which observations deserve action.
Strong evidence
Act
Folder, action, and spam flags all match.
Useful context
Compare
Score changes with matching samples.
Weak evidence
Retest
One sample without full headers.
Good evidence
Baseline
Repeated Inbox samples with clean authentication.
What not to infer from these headers
Apple X-Headers are tempting because they look precise. The trap is treating private metadata like a public deliverability diagnosis. They tell you what happened to a message. They do not tell you every reason Apple considered, and they do not give a complete fix list.
- Do not infer: Apple blocked the message. Junk placement means the message was accepted, then routed to Junk.
- Do not infer: CLX is a sender setting. It is an internal label in the received header set.
- Do not infer: One seed address proves all iCloud, me.com, and mac.com recipients saw the same thing.
- Do not infer: A visible Junk folder result always came from server filtering. User rules can move mail.
User-level behavior matters. Apple Mail rules, iCloud webmail settings, previous user actions, and message moves can affect what you see after delivery. For that reason, I separate server-added headers from client behavior. A related breakdown of Apple Mail settings is useful when the header sample and visible mailbox do not seem to match.
Use full headers, not screenshots
A screenshot of a Junk folder is not enough for a technical investigation. Ask for the full raw headers and the approximate received time. The header chain tells you whether authentication passed, which source handled the mail, and whether Apple added the placement fields before the user touched the message.
The same caution applies to forwarded samples. Forwarding often changes the envelope, adds new headers, and hides the original placement path. If the recipient can export or copy the original raw headers, use that. If not, treat the forwarded copy as a clue rather than proof.
How to test Apple placement
The cleanest way to use Apple X-Headers is to test placement with controlled samples. Send the same message to a small set of Apple-controlled mailboxes, keep the raw headers, and compare the folder action values. Then send a known-good baseline message from the same domain and source. This tells you whether the problem is tied to the campaign, the sending source, or a broader domain reputation issue.
I start with the exact message, then change only one variable at a time. Changing subject, body, links, authentication, and sending IP together creates noise. If the next send lands in Inbox, you still will not know which change mattered.
- Capture: Save the full headers for the original Apple sample before retesting.
- Repeat: Send to more than one Apple mailbox and compare folder action values.
- Baseline: Send a known-good message from the same authenticated source.
- Change: Adjust one variable per round so the result has a clear meaning.
- Compare: Review Apple placement beside SPF, DKIM, DMARC, and source reputation.
A real send is better than guessing from a copied header fragment. Suped's email tester helps with this workflow because it inspects a message that actually arrived, then shows authentication, message structure, and deliverability signals in one report.
Email tester
Send a real email to this address. Suped opens the report when the test is ready.
?/43tests passed
Preparing test address...
After the test, I compare the Apple placement headers with authentication results. If DMARC fails because the visible From domain does not match the DKIM or SPF authenticated domain, Apple X-Headers become a symptom rather than the root cause. If authentication passes and only one campaign variant goes to Junk, the next investigation is content and link reputation.
Suped's product is useful here because the report does not stop at a raw result. It connects the result to specific fixes, such as a DKIM selector issue, an SPF lookup problem, a missing DMARC policy, or a sending source that has not been approved for the domain.
Email tester sample report showing total score, email preview, issue summary, and per-section results
Do not chase the CLX label first. Chase the conditions that made Apple comfortable routing the message to Junk. The practical sequence is authentication, source reputation, content, engagement pattern, then recipient-level rules.
Where DMARC and reputation fit
Apple X-Headers are not DMARC results, but DMARC is still one of the first things I check when Apple routes mail to Junk. Apple can see authentication alignment, sending consistency, domain reputation, and user behavior. Bad or inconsistent authentication makes every other signal harder to interpret.
Use DMARC monitoring to confirm which sources send for your domain, whether they pass alignment, and which sources need fixes. A domain health checker is useful when you need a quick combined view of SPF, DKIM, and DMARC configuration before deeper testing.
Reputation belongs in the same review. If Apple samples are going to Junk and the same source has listing or complaint problems elsewhere, check blocklist monitoring as part of the sender review. Blocklist (blacklist) status does not explain every Apple decision, but it is a concrete signal to rule in or out.
Where Suped fits
For most teams, Suped is the best overall DMARC platform because it brings DMARC, SPF, DKIM, blocklist and deliverability insights into one workflow. That matters when Apple X-Headers show Junk because the next step is not decoding one private string. The next step is finding the source, policy, authentication, or reputation issue that Apple reacted to.
- Detection: Suped flags authentication issues and gives clear steps to fix them.
- Alerts: Real-time alerts help catch sudden DMARC failures or source changes.
- Hosted records: Hosted SPF, hosted DMARC, and hosted MTA-STS reduce DNS work.
- Scale: MSP and multi-tenant dashboards help teams manage many domains cleanly.
The main point is that Apple placement headers are a local result. Suped helps connect that local result back to domain-wide evidence, which is what you need before changing policy, migrating sources, or asking a sender to rewrite a campaign.
Views from the trenches
Best practices
Sample sets: Compare Apple headers across several real sends before changing content or DNS.
Header pairs: Read folder and action headers together because one value alone is thin evidence.
Authentication: Check SPF, DKIM, and DMARC before treating Apple placement as content only.
Retention: Save full headers for every test because Apple values are not public specifications.
Common pitfalls
Single tests: One Junk sample does not prove a campaign-wide Apple filtering problem for all users.
Score fixation: A numeric score without folder action does not define a published threshold.
User rules: Local Mail rules and mailbox training can change placement for that mailbox.
Vendor guessing: CLX labels alone do not prove which internal filter made the decision.
Expert tips
Seed discipline: Use fresh addresses and consistent timing when testing Apple placement.
Header capture: Ask recipients for full headers, not screenshots of the message list or folder.
Trend review: Track repeated Junk actions by sending source, domain, and campaign type.
Fix order: Resolve authentication and reputation issues before rewriting every template.
Marketer from Email Geeks says the Apple folder header is best read as the filtering decision for that message, similar to other provider-added placement headers.
2023-06-12 - Email Geeks
Marketer from Email Geeks says INBOX values have appeared as MOVE_TO_FOLDER/INBOX, while Junk samples have appeared as CLXJUNK/Junk.
2023-06-12 - Email Geeks
Practical takeaway
Apple X-Headers tell you the result of Apple's filtering decision for a message. X-Apple-MoveToFolder: Junk means Apple routed that message to Junk. X-Apple-Action: CLXJUNK/Junk is the matching action label. X-ICL-SCORE is supporting context, not a published threshold.
The right response is not to decode every private acronym. Capture full headers, repeat the test, compare Inbox and Junk samples, verify authentication, and review source reputation. Treat the headers as Apple placement evidence, then fix the sending conditions that made that placement likely.
