SOLVED: What an Email Message Header Tells You About Spam

Every email has a mail header which contains routing, source, destination and validation information. If you are trying to troubleshoot an email message you need to understand the message header.

To see the mail header:

1. DOUBLE click on a message in Outlook so that it opens in a separate window
2. Click FILE
3. Click the PROPERTIES button
4. Scroll through the INTERNET HEADERS section

Here are some tips relating the why your email message may have been rejected:

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
Your server authenticated properly and was authorized to send email for that domain according to SPF

---

X-EOPAttributedMessage: 0
The means Exchange Online Protection did not flag your message as containing viruses or malware

---

X-EOPTenantAttributedMessage: c68580d1-3bcc-4440-af53-6cc644eec768:0
This means you are sending from a Microsoft Exchange 365 mail server and so they know you are likely legitimate

---

X-MS-Exchange-Organization-SCL: 1
This means your message has a spam confidence level (SCL) of 1 which is not spam

SCL	Definition	Default action
-1	The message skipped spam filtering. For example, the message is from a safe sender, was sent to a safe recipient, or is from an email source server on the IP Allow List. For more information, see Create safe sender lists in EOP.	Deliver the message to the recipients’ inbox.
0, 1	Spam filtering determined the message was not spam.	Deliver the message to the recipients’ inbox.
5, 6	Spam filtering marked the message as Spam	Deliver the message to the recipients’ Junk Email folder.
9	Spam filtering marked the message as High confidence spam	Deliver the message to the recipients’ Junk Email folder.

SOURCE

---

X-Microsoft-Antispam: BCL:0;
This means your message has a bulk confidence level (BCL) of 0 which is not bulk email

BCL	Description
0	The message isn’t from a bulk sender.
1, 2, 3	The message is from a bulk sender that generates few complaints.
4, 5, 6, 7*	The message is from a bulk sender that generates a mixed number of complaints.
8, 9	The message is from a bulk sender that generates a high number of complaints.

SOURCE

---

DKIM-Signature: v=1

This means your email is digitally signed

---

ARC-Authentication-Results i=2

Authenticated Received Chain (ARC) is a method of allowing mail servers between your sending and the receiving mail server to ‘sign’ the message

---

dmarc=none

Domain-based Message Authentication, Reporting and Conformance (DMARC) tells mail servers if your message is protected by DKIM or SPF what to do if those fail. If the example here DMARC=NONE means that there is no DMARC instructions

---