Message header Spam levels

%3CLINGO-SUB%20id%3D%22lingo-sub-42439%22%20slang%3D%22en-US%22%3EMessage%26nbsp%3Bheader%20Spam%26nbsp%3Blevels%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-42439%22%20slang%3D%22en-US%22%3EI%26nbsp%3Breceived%26nbsp%3Ban%20unusual%20message%20which%20I'm%20still%20working%20on%2C%20but%20noticed%20that%20the%26nbsp%3BSpam%20Output%20score%20was%201%3A5%26nbsp%3BI%20know%20that%201%20stands%20for%20clean%2C%26nbsp%3Bbut%26nbsp%3B5%20is%20spam%20and%20will%20be%20sent%26nbsp%3Bto%20junk%20file.%20%26nbsp%3BMy%20question%20is%20when%20I%20see%20this%20info%26nbsp%3Bdo%20I%20just%20look%20at%20the%20first%20number%20which%20would%20be%201%2C%20correct%3F%20%26nbsp%3B%20SpamDiagnosticOutput%3A%201%3A5%20SpamDiagnosticMetadata%3A%20Default%3A4%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-42439%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-210369%22%20slang%3D%22en-US%22%3ERe%3A%20Message%26nbsp%3Bheader%20Spam%26nbsp%3Blevels%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-210369%22%20slang%3D%22en-US%22%3E%3CP%3EThat%20link%20doesn't%20list%20SpamDiagnosticOutput.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20wasting%20my%20time.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-42738%22%20slang%3D%22en-US%22%3ERe%3A%20Message%26nbsp%3Bheader%20Spam%26nbsp%3Blevels%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-42738%22%20slang%3D%22en-US%22%3EThank%20you%20Victor%20for%26nbsp%3Bhelping%20out.%20I'm%20uploading%20the%20full%20file%2C%20because%20I'm%20not%20exactly%20sure%20what%20to%20give%20you..%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-42678%22%20slang%3D%22en-US%22%3ERe%3A%20Message%26nbsp%3Bheader%20Spam%26nbsp%3Blevels%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-42678%22%20slang%3D%22en-US%22%3ECan%20you%20paste%20here%20that%20part%20of%20the%20message%20header%20where%20you%20saw%20SCL%201%3A5%3F%20I%20don't%20think%20that's%20an%20MS%20header.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-42449%22%20slang%3D%22en-US%22%3ERe%3A%20Message%26nbsp%3Bheader%20Spam%26nbsp%3Blevels%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-42449%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20for%20your%20response%20Victor%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20online%20Exchange%20class%20MS%20is%20offering%20the%20instructor%20shared%20with%20us%20the%20SCL%20chart%26nbsp%3B(bellow).%20I'm%20guessing%20that%26nbsp%3B1%3A5%20means%20the%20message%26nbsp%3Bhad%20a%20SCL%20of%201%20out%20of%26nbsp%3B5%2C%20which%20meant%20that%20it%20ok%20to%20be%20delivered.%20%26nbsp%3B%3CSTRONG%3EAm%20I%20correct%20in%20my%20thinking%3C%2FSTRONG%3E%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESpam%20Confidence%20Levels%20(SCL)%20As%20incoming%20messages%20go%20through%20spam%20filtering%2C%20they%20are%20assigned%20a%20spam%20score.%20This%20score%20maps%20to%20an%20SCL%2C%20as%20recorded%20in%20the%20X-header.%20SCL%20Rating%20Interpretation%20Default%20Action%20-1%20Message%20comes%20from%20safe%20sender%2C%20safe%20recipient%2C%20or%20safe%20IP%20address%20Deliver%20to%20Inbox%200%2C%201%20Message%20scanned%20and%20found%20to%20be%20clean%20Deliver%20to%20Inbox%205%2C%206%20Spam%20Send%20to%20Junk%20Email%209%20High%20confidence%20spam%20Send%20to%20Junk%20Email%20Exchange%20Online%20Protection%20does%20not%20use%20SCL%20levels%202%2C%203%2C%204%2C%207%2C%20and%208.%20You%20can%20use%20spam%20filtering%20policies%20to%20specify%20what%20happens%20with%20high%20confidence%20spam%3B%20for%20example%2C%20deleting%20the%20message%20and%20not%20sending%20it%20to%20junk%20mail.%20You%20can%20also%20set%20SCL%20conditions%20in%20transport%20rules.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-42442%22%20slang%3D%22en-US%22%3ERe%3A%20Message%26nbsp%3Bheader%20Spam%26nbsp%3Blevels%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-42442%22%20slang%3D%22en-US%22%3ECheck%20this%20article%2C%20it%20contains%20info%20about%20how%20to%20read%20the%20anti-spam%20header%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdn205071(v%3Dexchg.150).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdn205071(v%3Dexchg.150).aspx%3C%2FA%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor
I received an unusual message which I'm still working on, but noticed that the Spam Output score was 1:5 I know that 1 stands for clean, but 5 is spam and will be sent to junk file.  My question is when I see this info do I just look at the first number which would be 1, correct?   SpamDiagnosticOutput: 1:5 SpamDiagnosticMetadata: Default:4
5 Replies
Highlighted
Check this article, it contains info about how to read the anti-spam header:

https://technet.microsoft.com/en-us/library/dn205071(v=exchg.150).aspx
Highlighted

Thank you for your response Victor:

 

In online Exchange class MS is offering the instructor shared with us the SCL chart (bellow). I'm guessing that 1:5 means the message had a SCL of 1 out of 5, which meant that it ok to be delivered.  Am I correct in my thinking?

 

Spam Confidence Levels (SCL) As incoming messages go through spam filtering, they are assigned a spam score. This score maps to an SCL, as recorded in the X-header. SCL Rating Interpretation Default Action -1 Message comes from safe sender, safe recipient, or safe IP address Deliver to Inbox 0, 1 Message scanned and found to be clean Deliver to Inbox 5, 6 Spam Send to Junk Email 9 High confidence spam Send to Junk Email Exchange Online Protection does not use SCL levels 2, 3, 4, 7, and 8. You can use spam filtering policies to specify what happens with high confidence spam; for example, deleting the message and not sending it to junk mail. You can also set SCL conditions in transport rules.

Highlighted
Can you paste here that part of the message header where you saw SCL 1:5? I don't think that's an MS header.
Highlighted
Thank you Victor for helping out. I'm uploading the full file, because I'm not exactly sure what to give you..
Highlighted

That link doesn't list SpamDiagnosticOutput.

 

Thanks for wasting my time.