Emails to Outlook delivered to Junk Email folder with SCL 1

Brass Contributor

Emails sent from on-premises Exchange 2007 to any Microsoft related email address (outlook.com for example) is being delivered to the users Junk Email folder despite the header information showing SCL value of 1 which is suppose to deliver the email to the Inbox folder.

I've included some header values below if that helps. 

X-Forefront-Antispam-Report:  
EFV:NLI;SFV:NSPM;SFS:(98901004);DIR:INB;SFP:;SCL:1;SRVR:HE1EUR02HT107;H:<our domain>;FPR:;SPF:None;LANG:; 

X-Microsoft-Antispam:  BCL:0;PCL:0;RULEID:(5000109)(4604075)(4605076)(610169)(650170)(8291501071);SRVR:HE1EUR02HT107; 

X-Microsoft-Antispam-Mailbox-Delivery:  abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ex:0;auth:1;dest:J;ENG:(400001000128)(400125000095)(5062000261)(5061607266)(5061608174)(4900095)(4920089)(6375004)(4950112)(4990090)(9140004);RF:JunkEmail;OFR:SpamFilterAuthJ; 

I can see from the above value that it is directed to the junk Email folder. 

X-MS-Exchange-Organization-SCL: 1

Interestingly, the X-Forefront-Antispam-Report shows SPF:None but the Received-SPF value shows Pass which doesn't seem to match up. That said, I've seen other emails with the same pattern that are delivered to the Inbox so I doubt this is the cause. 

We have a SPF record that is correct, and if we email Office 365 customers the same email is delivered to the Inbox. This issue only affects Outlook.com customers. If there is a better community/category for this thread, then I can move/re-post if needed.

Any help much appreciated. 

11 Replies

The move to Junk folder might be performed by Outlook's antispam engine, not EOP. A quick way to verify this is to check the "info bar" - it will tell you who marked the message as Junk. Or run a message trace - if It was marked by EOP, it will be reflected there.

 

Here's an easy to follow article on that: https://www.slipstick.com/outlook/rules/moved-message-junk-email-folder/

 

It can also be due to custom Junk threshold, as detailed for example here: https://support.microsoft.com/en-za/help/3019725/how-to-troubleshoot-unexpected-junk-email-behavior-...

The "info bar" shows 'This message was identified as spam. We'll delete it after 10 days'

 

Would this suggest that it was EOP? I didn't think that Outlook.com had it's own Anti-Spam engine - I thought that EOP served that purpose.

 

Your second link refers to Office 365 which is a slightly different platform that Outlook.com so am I to assume the content of that KB doesn't apply?

 

 

I've seen your situation mentioned in the Answers forums and see that some recommend filling out this form: https://support.microsoft.com/en-us/getsupport?oaspworkflow=start_1.0.0.0&wfname=capsub&productkey=e...

 

 

I found that too but I'm afraid to say, I have completed that form on two occasions and they have checked the reputation of our external IP address and not found any issues.

 

When I replied and asked them about why emails with an SCL of 1 are being delivered to the Junk Email folders for recipients, they ignored my questions and repeated their previously response.

I have submitted that again and they have now come back and said that our external IP address was listed on the Spamhaus PBL list - this wasn't the case last week when I first submitted the Outlook Deliverability Report however so I am waiting for that to propagate before I test sending to Microsoft's free email platform again to confirm the issue is resolved.

 

We are no longer listed on the PBL, but the issue remains - as I suspected.

 

I can't be the only one seeing this issue?

No further updates on this one? We're still seeing this issue.

I am investigating the same problem.

In my mail the following issue existed which probably caused the mail to be placed in JunkMail:

  • The Envelope From (i.e., Return Path or Mail-From)
    was different from 
  • The “Friendly” From (i.e., “Header” From)

We are having the same issue. Emails to Outlook / Hotmail are being randomly sent to junk - I say randomly, because I can send the same email twice to the same outlook account - 1 will get junked the other will go to inbox.

 

We are on no blacklists, have a good sending reputation with no issues across any of the blacklists. All relevant headers, security etc is configured correctly.

 

A postal service that makes random decisions about whether to deliver mail or not, is no use to anyone. Can we please get some feedback on this Microsoft.

Le support est très limité sur le sujet.
Plusieurs échanges et les réponses reviennent systématiquement identiques (pas de problème particulier relevé avec l'adresse IP d'envoi, à côté de la question initiale qui est "quel(le)s sont les règles/critères précis qui placent un mail totalement légitime en spam alors que tout est bien configuré (SPF, DKIM, DMARC, alignement FROM/RETURN-PATH, ...).
En fournissant un email concret avec le mail complet (entête + contenu) le support ne peut ou ne veut pas donner les critères de leur anti-spam (vu dans la doc que c'était pour éviter de divulguer aux spammer le mode d'emploi pour le contourner). Mais comment fait-on pour aider les honnêtes gens ?

Avez-vous eu une réponse ou des infos complémentaires ? Est-ce que vous avez toujours le problème ?
Merci