Outlook Security Headers

[Kips106]

Hello,

I am wondering how to tell if an IP address has been effectively whitelisted so it is not passed through any spam filtering.

Emails received via our outlook server are reported to have been receiving automated opens and clicks when sent for a specific IP (Which is also used by our company but is external marketing tool) and we are wondering if it is caused by a spam filter.

I have read the header definitions in this doc -
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-message-header....

My question is what is the difference between IPV:CAL vs SFV:SKN? I am getting the below results

IPV:NLI;CTRY:US;EFV:NLI;SFV:SKN;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:BY5PR19MB3587.

Does IPV:NLI mean that it is still getting scanned at some point event though I also get SFV:SKN?

Any help would be appreciated.

Thank you

[#2]

Those refer to different policies/different scanning components.

IPV refers to the external IP reputation services (external spamlists), in this case IPV:NLI means that the IP was not found in any of the external lists. IPV:CAL would mean that the address was allowed because you explicitly added it to a safe sender policy in the connection filter, regardless of the reputation from external sources.

SFV refers to processing by the Content filters defined for your tenant. In this case, SFV:SKN means you have added an exception in your content filter.

And yes, IPV:NLI means it still gets scanned by all other components.