When a message lands in Junk, in quarantine or in an Inbox it should never have reached, Microsoft 365 records why in three message headers. This quick reference covers every value Microsoft documents for X-Forefront-Antispam-Report, X-Microsoft-Antispam and Authentication-Results: the meaning (from Microsoft's reference), the usual cause and where to act.
Codes in this quick reference
CAT:AMP: the anti-malware policy acted on the messageMessage header (X-Forefront-Antispam-Report)CAT:BIMP: brand impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)CAT:DIMP: domain impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)CAT:FTBP: blocked by the anti-malware common attachments filterMessage header (X-Forefront-Antispam-Report)CAT:GIMP: mailbox intelligence impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)CAT:INTOS: intra-organization phishingMessage header (X-Forefront-Antispam-Report)CAT:MALW: malwareMessage header (X-Forefront-Antispam-Report)CAT:OSPM: outbound spam sent by a user in your organizationMessage header (X-Forefront-Antispam-Report)
+ 51 more codes in the tables below.
How to read these codes#
Exchange Online Protection and Microsoft Defender for Office 365 stamp these headers on inbound messages. In classic Outlook, open the message and select File › Properties (the Internet headers box); in Outlook on the web and the new Outlook, select More actions (…) › View › View message details. Microsoft's Message Header Analyzer makes the result readable. Each header holds field:value pairs separated by semicolons:
Text
X-Forefront-Antispam-Report: CIP:203.0.113.25;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.fabrikam.com;PTR:mail.fabrikam.com;CAT:SPM;DIR:INB;
X-Microsoft-Antispam: BCL:0;
Authentication-Results: spf=softfail (sender IP is 203.0.113.25) smtp.mailfrom=fabrikam.com; dkim=none (message not signed) header.d=none;dmarc=fail action=none header.from=fabrikam.com;compauth=fail reason=001- Read CAT, SFV and DIR first. CAT names the policy that acted (when several protections flag a message, the highest-priority policy wins), SFV says how spam filtering decided or why it skipped the message, and DIR gives the direction.
- Don't judge by SCL. In cloud organizations it doesn't decide the verdict or the action; it mainly serves on-premises Exchange and hybrid delivery.
- Then read compauth. Composite authentication combines SPF, DKIM, DMARC and other signals to decide whether the From domain is genuine; the reason code explains why.
- Fields not listed here are for Microsoft's own diagnostics.
Note: For the most common verdicts (spam, phishing, spoofing and bulk), Legitimate email landing in Junk walks through the fixes.
X-Forefront-Antispam-Report: the verdict#
CAT: which policy acted#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
CAT:AMP | Anti-malware | Malware in the message or an attachment | Review the email entity page before any release |
CAT:BIMP | Brand impersonation* | Sender imitates a well-known brand | Treat as phishing |
CAT:BULK | Bulk | BCL at or above the policy threshold | Read BCL (below) |
CAT:DIMP | Domain impersonation* | Domain imitates a protected domain | Anti-phishing policy: protected and trusted domains |
CAT:FTBP | Anti-malware common attachments filter | Blocked file type | File types in the anti-malware policy |
CAT:GIMP | Mailbox intelligence impersonation* | Sender imitates a frequent contact | Mailbox intelligence settings in the anti-phishing policy |
CAT:HPHSH, CAT:HPHISH | High confidence phishing | Strong phishing signals | Don't allow it; submit only if you're sure it's clean |
CAT:HSPM | High confidence spam | Strong spam signals | Submit false positives to Microsoft |
CAT:INTOS | Intra-organization phishing | Phishing sent from inside your organization | Check the sending account for compromise |
CAT:MALW | Malware | Malicious content | Review before any release |
CAT:OSPM | Outbound spam | One of your users sent spam | Restricted entities and the outbound spam policy |
CAT:PHSH | Phishing | Sender, link or content signals | Submit false positives; never allow a whole domain |
CAT:SAP | Safe Attachments* | Detonation found malware | Check the verdict before any release |
CAT:SPM | Spam | Spam filtering verdict | Read SFV |
CAT:SPOOF | Spoofing | The From domain didn't authenticate | Read compauth; check the spoof intelligence insight |
CAT:UIMP | User impersonation* | Sender imitates a protected user | Protected users in the anti-phishing policy |
* Defender for Office 365 only.
SFV: how spam filtering reached the verdict#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
SFV:BLK | Skipped; blocked by the user's Blocked Senders list | The user blocked the sender | The user's junk email settings |
SFV:NSPM | Marked as not spam and delivered | Clean mail | Report it to Microsoft if it's junk |
SFV:SFE | Skipped; allowed by the user's Safe Senders list | The user trusted the sender | Check the list if phishing got through |
SFV:SKA | Skipped: sender on an anti-spam policy's allowed senders or domains | Admin allow entry | It skips filtering for everyone in the policy |
SFV:SKB | Spam: sender on an anti-spam policy's blocked senders or domains | Admin block entry | Remove it if it's wrong |
SFV:SKI | Skipped: source IP on the connection filter's IP Allow List | Admin IP allow entry | Review the connection filter policy |
SFV:SKN | Spam filtering bypassed by a mail flow rule | A rule that sets SCL -1 | Narrow or remove the rule |
SFV:SKQ | Released from quarantine to the recipients | Admin or user release | Confirm the release was intended |
SFV:SKS | Marked as spam before filtering by a rule that set the SCL, or by on-premises Exchange (hybrid); stamped only if honored | Rule or hybrid verdict | Mail flow rules and on-premises spam settings |
SFV:SPM | Marked as spam by spam filtering | Content or reputation | Submit to Microsoft if it's legitimate |
SFTY, SRV and X-CustomSpam#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
SFTY:9.19 | Phishing: domain impersonation (safety tip added if enabled) | Domain imitates a protected domain | Anti-phishing domain settings |
SFTY:9.20 | Phishing: user impersonation (safety tip added if enabled) | Sender imitates one of your users or a protected user | Anti-phishing protected users |
SFTY:9.25 | First contact safety tip | Can indicate a suspicious message | Is the sender really new to the recipient? |
SRV:BULK | Bulk, based on spam filtering and the BCL threshold | MarkAsSpamBulkMail is On by default | Read BCL |
X-CustomSpam: | An Advanced Spam Filter (ASF) setting matched; the value names it | ASF option turned on | ASF stamps after mail flow rules run, so rules can't act on it |
Connection and origin fields#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
CIP: | Connecting IP address | The last hop into Microsoft 365 | Your own gateway? Configure Enhanced Filtering for Connectors |
CTRY: | Country/region of the connecting IP | Can differ from the original sender's | Is it where the sender should be? |
DIR:INB, DIR:OUT, DIR:INT | Inbound, outbound or internal | How the message entered | Read it with CAT |
H: | HELO/EHLO string of the connecting server | Sending server setting | Compare with PTR |
IPV:CAL | Spam filtering skipped: source IP is on the IP Allow List | Admin IP allow entry | Review the connection filter policy |
IPV:NLI | IP not found on any IP reputation list | Normal for most senders | None |
LANG: | Language of the message | Detected from the content | Matters if you filter by language |
PTR: | Reverse DNS of the source IP | Published by the IP owner | Compare with H: and the From domain |
ARC (AAR, AMS, AS) | Authenticated Received Chain; AS carries cv= (none, pass or fail) | An intermediary handled the message | Known forwarder failing? Consider a trusted ARC sealer |
SCL and BCL: the two scales#
SCL (X-Forefront-Antispam-Report, -1 to 9) mostly matters in the cloud for mail flow rules that request a bypass (-1), spam (5 or 6) or high confidence spam (9). BCL (X-Microsoft-Antispam) rates complaints about a bulk sender.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
SCL:-1 | Spam filtering bypass requested | Mail flow rule | Find the rule; a bypass can also show as 0 or 1 |
SCL:0, SCL:1 | Evaluated, not spam | Clean mail | None |
SCL:5, SCL:6 | Spam on the legacy scale (5 or higher generally means bad) | Verdict or rule | Read CAT; in hybrid, on-premises Junk thresholds act on SCL |
SCL:9 | High confidence spam on the legacy scale | Verdict or rule | Read CAT |
BCL:0 | Not from a bulk sender | Normal mail | None |
BCL:1 to 3 | Bulk sender, few complaints | Wanted newsletters | None |
BCL:4 to 7 | Bulk sender, mixed complaints | Marketing mail | Threshold: 7 by default, 6 Standard, 5 Strict |
BCL:8, BCL:9 | Bulk sender, many complaints | Unwanted bulk | Junk Email, or quarantine under Strict |
Check the bulk senders insight in the Defender portal before you change a threshold.
Authentication-Results: SPF, DKIM, DMARC and compauth#
SPF, DKIM and DMARC results#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
spf=fail | Hard fail: source isn't in SPF (-all) | Unlisted service, or your gateway in front | Sender fixes SPF; CIP is your gateway? Enhanced Filtering |
spf=softfail | Soft fail (~all) | As above | As above |
spf=neutral | Not listed, no instruction (?all) | Incomplete record | Sender fixes it |
spf=none | No SPF record, or no result | SPF not set up | Sender publishes SPF |
spf=temperror | Temporary error, such as DNS | Transient | Usually clears |
spf=permerror | Permanent error | Bad syntax or more than 10 DNS lookups | Sender simplifies the record |
dkim=fail (body hash did not verify) | Body changed after signing | Footer, disclaimer or gateway | Modify in Microsoft 365, or trust the hop as an ARC sealer |
dkim=fail (no key for signature) | Public key missing from DNS | Key not published | Sender publishes it |
dkim=none | Not signed | DKIM not set up | Sender signs with the From domain |
dmarc=fail action=oreject | Failed; the sender publishes p=reject | No aligned pass | Delivered anyway? Check the anti-phishing DMARC setting and allows |
dmarc=fail action=quarantine | Failed; the sender publishes p=quarantine | No aligned pass | Sender fixes alignment |
action=pct.quarantine, action=pct.reject | Policy with pct below 100, applied to part of failing mail | DMARC rollout | Message trace shows where it went |
dmarc=bestguesspass | No DMARC record, but it would have passed | No DMARC | Sender publishes DMARC |
dmarc=none | No DMARC TXT record | No DMARC | Sender publishes DMARC |
action=permerror, action=temperror | DMARC evaluation error | Bad record or DNS | Sender validates the _dmarc record |
compauth reason codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
000 | Explicit fail: DMARC fail with p=quarantine or p=reject | No alignment | Sender fixes alignment |
001 | Implicit fail: no records, or weak ones (~all, ?all, p=none) | Weak authentication | Sender strengthens it |
002 | Your organization prohibits this sender/domain pair from spoofing | Admin block | Spoofed sender entries in the Tenant Allow/Block List |
010 | DMARC fail (reject or quarantine) for one of your accepted domains | Self-to-self spoofing, or your own unauthenticated app | Authenticate or block the source |
100 | Pass: SPF or DKIM passed and aligns | Healthy | None |
101 | Pass: DKIM-signed by the From domain | Healthy | None |
102 | Pass: SPF passed, MAIL FROM aligns with From | Healthy | None |
103, 104 | Pass: From domain aligns with the source IP's PTR | PTR fallback | Sender adds SPF/DKIM |
108 | Pass: DKIM broken by body changes on earlier legitimate hops | For example, your on-premises servers | None |
109 | Pass: no DMARC record, but would pass | No DMARC | None |
111 | Pass: DMARC error, but the SPF or DKIM domain aligns | Faulty DMARC record | Sender fixes it |
112 | Pass: DNS timeout prevented retrieving the DMARC record | Transient DNS | None unless it repeats |
115 | Pass: sent from a Microsoft 365 organization where the From domain is accepted | Microsoft 365 to Microsoft 365 | None |
116 | Pass: the From domain's MX aligns with the connecting IP's PTR | PTR fallback | Sender adds SPF/DKIM |
130 | Pass: a trusted ARC sealer overrode the DMARC failure | Forwarding | None if expected |
201, 202 | Soft pass (compauth=softpass) on PTR alignment | Weak authentication | Sender adds SPF/DKIM |
3xx | Not checked (compauth=none) | Not evaluated | None |
4xx | Bypassed (compauth=none) | A bypass applied | Find out why |
501, 502 | DMARC not enforced: valid NDR | A bounce | None |
601 | Implicit fail: the sending domain is one of your accepted domains | Intra-org spoofing | Authenticate or block the source |
701 to 704 | Implicit pass: DMARC not enforced, history of legitimate mail from that infrastructure | Known sender, weak authentication | Sender fixes authentication |
905 | Bypassed: DMARC not enforced due to complex routing | On-premises Exchange or another service receives first | Enhanced Filtering for Connectors |
How to verify a fix#
- Send a new message after the change; headers are stamped at delivery, so old messages never change.
- Compare headers: CAT and SFV should show the intended path (say, SFV:NSPM instead of SFV:SPM); after an authentication fix, compauth should pass (1xx or 7xx).
- In the Defender portal, the email entity page (from Explorer or Real-time detections) should show a matching delivery location and detection technology; message trace confirms delivery.
- Check the policy side in Exchange Online PowerShell:
PowerShell
Get-AntiPhishPolicy | Format-List Name, HonorDmarcPolicy, DmarcQuarantineAction, DmarcRejectAction
Get-ArcConfig | Format-List ArcTrustedSealers
Get-MailboxJunkEmailConfiguration -Identity user@contoso.com |
Format-List TrustedSendersAndDomains, BlockedSendersAndDomains
Get-TransportRule | Where-Object { $_.SetSCL -eq -1 } | Format-Table Name, State, PriorityRelated guides: SPF, DKIM and DMARC setup and Enhanced Filtering for Connectors.
References#
- Anti-spam message headers in cloud organizations (source of the field and compauth tables)
- Bulk email detection and bulk complaint level (BCL)
- Set up DMARC to validate the From address domain (DMARC action values)
