How to Stop Emails Going to Junk in Outlook (Senders and Recipients)

Introduction

Your emails reach Gmail inboxes, but anyone on Outlook, Hotmail or a Microsoft 365 company account finds them in Junk. Or you are on the receiving end, and invoices from a supplier keep ending up there.

Microsoft filters email differently from Google and Yahoo, and it leaves very specific clues in the message headers. This guide is about the Microsoft side only: how to read those clues, what Microsoft requires from senders, and how to get out of the Junk folder. The quick fixes for recipients are at the end.

For the general causes of spam placement across all providers, see Why Your Emails Are Going to Spam.

First, Which Microsoft?

"Outlook" covers two different filtering systems:

Recipient address	Filtered by	Who controls the filter
@outlook.com, @hotmail.com, @live.com	Outlook.com consumer service	Microsoft
@company.com on Microsoft 365	Exchange Online Protection (EOP) and Defender	Microsoft, plus the company's admin policies

The Outlook app is the same in both cases. The filter is not. A message junked at a Microsoft 365 company may be caused by that company's own anti-spam policy, which you as a sender cannot see.

Step 1: Read the Headers of a Junked Message

Ask a recipient to send you the headers of a message that landed in Junk (in Outlook on the web: open the message, then the three-dot menu, View and View message source). Or send a test to an Outlook.com mailbox of your own.

Look for these three headers:

Authentication-Results: spf=pass (sender IP is 203.0.113.10)
 smtp.mailfrom=bounce.example.com; dkim=pass (signature was verified)
 header.d=esp-provider.net; dmarc=fail action=none
 header.from=example.com; compauth=fail reason=001
X-Forefront-Antispam-Report: CIP:203.0.113.10;CTRY:US;LANG:en;SCL:5;
 SFV:SPM;CAT:SPM;...
X-Microsoft-Antispam: BCL:7;...

What they mean:

Field	Value here	Meaning
dmarc	fail	Neither SPF nor DKIM aligned with example.com
compauth	fail reason=001	Microsoft's composite authentication failed: the domain has no enforced DMARC and the message did not authenticate
SCL	5	Spam confidence level. 5 or higher is treated as spam
SFV	SPM	Spam filter verdict: spam
BCL	7	Bulk complaint level, from 0 to 9. Higher means more complaints about this kind of bulk mail

In this example, SPF passed for bounce.example.com and DKIM passed for esp-provider.net, but neither matches example.com in the From address. Everything technically passed and the message still failed DMARC.

The compauth reason codes worth knowing:

• reason=000: explicit failure. The message failed DMARC and the domain's policy is quarantine or reject.
• reason=001: implicit failure. The domain has no DMARC record, or only p=none, and the message did not pass authentication well enough for Microsoft to trust it.

Paste the full headers into the Email Header Analyzer to see the authentication results and the delivery path laid out.

Step 2: Meet Microsoft's Sender Requirements

In April 2025, Microsoft announced requirements for domains that send more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses, enforced from May 2025:

• SPF must pass for the sending domain
• DKIM must pass
• DMARC must be published with at least p=none, and the message must align with SPF or DKIM (ideally both)

Messages that do not comply can be sent to Junk or rejected with an error like:

550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.

Microsoft also lists good practice for these senders: a valid From and Reply-To address, a working unsubscribe link, and keeping lists clean of invalid addresses.

Even below 5,000 a day, the same checks feed the filter. Treat them as the baseline:

1. One valid SPF record that includes every service sending as your domain. See SPF Record Syntax Explained.
2. DKIM signed with your own domain (d=example.com), not the provider's. This is what fixes the alignment problem in the example above. See What Is a DKIM Record?.
3. A DMARC record with a rua address, so you can see what Microsoft and others actually receive. See DMARC Record Examples.

If you send from Microsoft 365 itself, remember that DKIM for your custom domain is not on by default: the Microsoft 365 DMARC setup guide covers the CNAMEs and the switch to enable signing.

Step 3: Check Your Reputation With Microsoft

Authentication proves who you are. Reputation decides whether Microsoft wants your mail. Microsoft offers two programs for senders that deliver to Outlook.com:

• Smart Network Data Services (SNDS): shows, per sending IP, how much mail Microsoft sees, the complaint rate and spam trap hits. You need to own or control the IPs, so this is for dedicated IPs.
• Junk Mail Reporting Program (JMRP): a feedback loop that sends you a copy of messages Outlook.com users marked as junk. Use it to remove complainers from your lists.

On a shared IP from an email platform, you cannot use SNDS. Reputation is the platform's job, and your part is keeping complaints low.

If Microsoft is blocking you, not junking you, the bounce usually names the problem. Rejections that mention Microsoft's block list (codes such as S3150) mean the sending IP is listed. For Microsoft 365 recipients, the IP can be submitted through the Office 365 delist portal; for Outlook.com, through the Outlook.com sender support form. Fix the cause first, or the listing comes back.

The Email Compliance Checker runs your domain against the common public blocklists, which is a quick first check.

Step 4: Lower Your Bulk Complaint Level

The BCL value is Microsoft's estimate of how many people complain about mail like yours. Microsoft 365 anti-spam policies junk bulk mail at or above a threshold that admins choose; the default is 7, and stricter policies use lower values.

You cannot see the threshold, but you can lower your BCL:

• Send only to people who asked for it. Purchased or scraped lists are the fastest way to a high BCL.
• Add one-click unsubscribe (List-Unsubscribe and List-Unsubscribe-Post headers) and a visible link. An easy unsubscribe is better than a junk click.
• Remove inactive recipients. Months of unopened mail tell the filter nobody wants it.
• Keep volume steady. Sudden spikes from a new domain or IP look like spam; warm up gradually.
• Use a separate subdomain for marketing (news.example.com), so complaints about campaigns do not affect invoices and password resets from example.com.

Step 5: Check Content and Links

Content matters less than authentication and reputation, but a few things reliably hurt at Microsoft:

• Links to domains with poor reputation, including public URL shorteners
• Link domains that have nothing to do with the From domain
• Image-only messages with almost no text
• Attachments that are often abused, such as macro-enabled documents or archives

Send a test with and without a suspicious element to isolate it.

Quick Fixes for Recipients

If you are the one receiving the mail, these fix your own mailbox. They do not fix delivery for anyone else.

Outlook.com, Hotmail and the new Outlook

1. Open the Junk Email folder, select the message and choose Not junk. Outlook moves it to the inbox.
2. Go to Settings, Mail, Junk email, and add the address or domain under Safe senders and domains.

Classic Outlook for Windows

1. In the Junk folder, right-click the message and choose Junk, then Not Junk.
2. To trust the sender permanently, right-click, Junk, Never Block Sender (or Never Block Sender's Domain).
3. The full list lives in Home, Junk, Junk E-mail Options, Safe Senders.

Outlook mobile

Open the message in Junk and use Move to Inbox from the message menu. Safe senders are managed from Outlook on the web.

Microsoft 365 administrators

• Report false positives through Submissions in the Microsoft Defender portal, so Microsoft can review the verdict.
• Use the Tenant Allow/Block List for a specific sender while the sender fixes their setup.
• Avoid broad mail flow rules that set SCL to -1 for a whole domain. If that domain is spoofed, the rule delivers the forged mail straight to the inbox.

Safe sender lists do not override Microsoft's malware or high-confidence phishing verdicts, and they should not.

Checklist

• Headers of a junked message checked: dmarc, compauth, SCL, BCL
• SPF passes for the envelope sender domain
• DKIM signs with your own domain
• DMARC published, with aligned SPF or DKIM on every source
• Sending IP not on a blocklist; SNDS and JMRP set up if you have dedicated IPs
• One-click unsubscribe and clean lists for bulk mail
• Marketing mail on a separate subdomain

Next Steps

1. Analyse a junked message: Email Header Analyzer →
2. Check SPF, DKIM and DMARC in one go: Domain Score →
3. Run blocklist and compliance checks: Email Compliance Checker →
4. Sending from Microsoft 365? Microsoft 365 setup records →
5. See how Microsoft treats your mail over time: Start free → — DMARC aggregate reports from Microsoft show which of your sources pass or fail authentication there, so you can fix alignment before it costs you the inbox.

---

Related Articles:

• Why Your Emails Are Going to Spam (And How to Fix It)
• How to Set Up DMARC for Microsoft 365
• DMARC Alignment Failed: How to Fix It