How to Fix Microsoft 365 Outbound Emails Landing in Junk or Spam
📌 Important Note on PowerShell Cmdlets
This guide uses only live and active Exchange Online PowerShell cmdlets, including Get-MessageTraceV2 and Get-MessageTraceDetailV2 for message trace operations. Deprecated Get-MessageTrace examples have been removed.
The issue was resolved by reviewing Exchange Online outbound policies, validating DNS authentication records at the authoritative DNS provider, and correcting sender reputation issues such as domain blocklist status.
🔍 The Symptoms
⚠️ Observed Indicators
- Outbound emails were not delivered reliably
- Emails sent from Microsoft 365 landed in the recipient’s junk or spam folder
- Recipient mail systems classified legitimate emails as spam
- Sender authentication and reputation checks affected delivery
dkim=fail
dmarc=fail
compauth=fail
SCL: 5 or higher
🧠 Root Cause
Outbound email deliverability issues in Microsoft 365 usually occur when sender authentication, DNS records, outbound mail hygiene, or domain reputation signals are not aligned.
- SPF record is missing, incorrect, duplicated, or exceeds DNS lookup limits
- DKIM is not enabled, or required CNAME records are missing at the authoritative DNS provider
- DMARC is missing or not aligned with SPF and DKIM
- The sending domain has poor reputation
- Outbound spam policies are not configured to detect suspicious outbound sending
- DNS records are documented in Microsoft 365 but not correctly published at the authoritative DNS provider
- The sending domain appears on a domain blocklist such as Spamhaus DBL
⚠️ Important — Spamhaus DBL
Spamhaus DBL is a domain blocklist. Administrators typically do not allow-list a domain with Spamhaus DBL. The correct action is to check whether the domain is listed, fix the underlying cause, and request delisting through the official Spamhaus process if appropriate.
🛠️ Step-by-Step Resolution
Review Message Trace in Exchange Admin Center
Confirm whether emails were delivered, deferred, rejected, filtered, or accepted by the recipient system but later classified as junk.
GUI Method
- Go to the Exchange admin center
- Navigate to Mail flow → Message trace
- Search using sender address, recipient address, date range, and subject
- Review the delivery status
- Open the message trace details and check whether the message was delivered, failed, pending, expanded, filtered as spam, or rejected by the recipient system
PowerShell Method
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-MessageTraceV2 ` -SenderAddress sender@yourdomain.com ` -StartDate "2026-08-09" ` -EndDate "2026-08-10" | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, MessageTraceId
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com $Trace = Get-MessageTraceV2 ` -SenderAddress sender@yourdomain.com ` -RecipientAddress recipient@externaldomain.com ` -StartDate "2026-08-09" ` -EndDate "2026-08-10" $Trace | ForEach-Object { Get-MessageTraceDetailV2 ` -MessageTraceId $_.MessageTraceId ` -RecipientAddress $_.RecipientAddress }
Review the Outbound Spam Filter Policy
The outbound spam filter policy controls how Microsoft 365 handles suspicious outbound messages. Weak outbound controls can damage domain reputation over time.
GUI Method
- Go to the Microsoft Defender portal
- Navigate to Email & collaboration → Policies & rules
- Select Threat policies
- Open Anti-spam policies
- Review the Outbound spam filter policy
- Confirm that outbound recipient limits are configured appropriately
- Confirm that suspicious outbound sending triggers administrative alerts
PowerShell Method
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-HostedOutboundSpamFilterPolicy | Format-List Name, RecipientLimitExternalPerHour, RecipientLimitInternalPerHour, RecipientLimitPerDay, ActionWhenThresholdReached, NotifyOutboundSpam, NotifyOutboundSpamRecipients
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-HostedOutboundSpamFilterRule | Format-Table Name, State, Priority, HostedOutboundSpamFilterPolicy, SentTo, From, SenderDomainIs -AutoSize
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Set-HostedOutboundSpamFilterPolicy ` -Identity OutboundPolicyName ` -NotifyOutboundSpam $true ` -NotifyOutboundSpamRecipients securityteam@yourdomain.com
Validate the SPF Record
SPF confirms which mail servers are authorised to send email for your domain. For Microsoft 365, the SPF record must include Exchange Online Protection.
✅ Recommended SPF Record
v=spf1 include:spf.protection.outlook.com -all
💡 Third-Party Senders
If CRM, ERP, marketing tools, ticketing systems, website applications, or notification platforms send email as your domain, they must be included in the SPF design. Do not create multiple SPF TXT records for the same domain.
Resolve-DnsName -Name yourdomain.com -Type TXT | Where-Object { $_.Strings -match "v=spf1" } | Select-Object Name, Type, Strings
| SPF Check | Expected Result |
|---|---|
| SPF record exists | One SPF TXT record only |
| Microsoft 365 is included | include:spf.protection.outlook.com |
| Multiple SPF records | Not present |
| DNS lookup count | Within the SPF lookup limit (max 10) |
| Alignment | Envelope sender domain aligns with the sending domain strategy |
Enable and Validate DKIM
DKIM digitally signs outbound messages so receiving systems can verify that messages were authorised by your domain and were not altered in transit.
GUI Method
- Go to the Microsoft Defender portal
- Navigate to Email & collaboration → Policies & rules
- Select Threat policies
- Open Email authentication settings
- Select DKIM
- Choose the accepted domain
- Enable DKIM signing
- If prompted, create the required CNAME records at the authoritative DNS provider
PowerShell Method
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-DkimSigningConfig -Identity yourdomain.com | Format-List Domain, Enabled, Status, Selector1CNAME, Selector2CNAME
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com # Create DKIM config to obtain the CNAME records to publish at DNS New-DkimSigningConfig -DomainName yourdomain.com -Enabled $false Get-DkimSigningConfig -Identity yourdomain.com | Format-List Domain, Enabled, Selector1CNAME, Selector2CNAME
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Set-DkimSigningConfig -Identity yourdomain.com -Enabled $true Get-DkimSigningConfig -Identity yourdomain.com | Format-List Domain, Enabled, Status
Configure DMARC
DMARC helps recipient systems decide what to do when SPF or DKIM authentication fails. It also improves domain reputation and provides visibility into spoofing activity.
✅ Recommended DMARC Records
_dmarc.yourdomain.com TXT “v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100”
_dmarc.yourdomain.com TXT “v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100”
_dmarc.yourdomain.com TXT “v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100”
Resolve-DnsName -Name _dmarc.yourdomain.com -Type TXT | Select-Object Name, Type, Strings
| Stage | Policy | Purpose |
|---|---|---|
| Monitor | p=none |
Collect reports and identify legitimate senders |
| Enforce partially | p=quarantine |
Send failing messages to spam or quarantine |
| Enforce fully | p=reject |
Reject unauthenticated messages |
Align DNS Records with the Authoritative DNS Provider
DNS records must be correctly published at the authoritative DNS provider — not just documented in Microsoft 365 — so they are consistently resolvable by external recipient systems.
| Record | Type | Purpose | Example |
|---|---|---|---|
| MX | MX | Routes inbound mail to Microsoft 365 | <tenant>.mail.protection.outlook.com |
| SPF | TXT | Authorises outbound senders | v=spf1 include:spf.protection.outlook.com -all |
| DKIM | CNAME | Enables outbound message signing | selector1._domainkey and selector2._domainkey |
| DMARC | TXT | Defines authentication policy | _dmarc.<yourdomain.com> |
# Verify MX record Resolve-DnsName -Name yourdomain.com -Type MX # Verify SPF record Resolve-DnsName -Name yourdomain.com -Type TXT # Verify DKIM CNAME records Resolve-DnsName -Name selector1._domainkey.yourdomain.com -Type CNAME Resolve-DnsName -Name selector2._domainkey.yourdomain.com -Type CNAME # Verify DMARC record Resolve-DnsName -Name _dmarc.yourdomain.com -Type TXT
Check Domain Reputation and Spamhaus DBL Status
Spamhaus DBL is used by many receiving systems to evaluate domain reputation. If the sending domain appears in DBL, recipient systems may place messages in junk or reject them.
- Check whether the sending domain is listed in Spamhaus DBL at check.spamhaus.org
- If listed, review the reason for the listing
- Correct the underlying issue — compromised mailbox activity, suspicious links, abusive campaign behaviour, or poor third-party sender hygiene
- Submit a delisting request through the official Spamhaus process if appropriate
- Re-test outbound delivery after DNS and reputation changes are applied
⚠️ Do Not Rely on Delisting Alone
If SPF, DKIM, DMARC, sending behaviour, or compromised accounts are not corrected, the domain may be listed again after delisting.
Review Compromised or High-Risk Sending Patterns
Before concluding that the issue is only DNS-related, check whether any mailbox, application, connector, or third-party sender is generating suspicious outbound mail.
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-MessageTraceV2 ` -SenderAddress sender@yourdomain.com ` -StartDate "2026-08-09" ` -EndDate "2026-08-10" | Group-Object RecipientAddress | Sort-Object Count -Descending | Select-Object Count, Name
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-TransportRule | Select-Object Name, State, Mode, Priority | Format-Table -AutoSize
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-OutboundConnector | Format-List Name, Enabled, ConnectorType, SmartHosts, RecipientDomains, RouteAllMessagesViaOnPremises
Validate Final Mail Flow
After DNS propagation and policy updates are completed, send test messages to external recipients and validate the message headers.
| Validation Item | Expected Result |
|---|---|
| Message delivery | ✅ Recipient receives the message |
| Inbox placement | ✅ Message lands in inbox, not junk |
| SPF | ✅ Pass |
| DKIM | ✅ Pass |
| DMARC | ✅ Pass or aligned |
| SCL | ✅ Low spam confidence level |
| Domain reputation | ✅ Not blocklisted |
| Message trace | ✅ Delivered without suspicious filtering events |
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com Get-MessageTraceV2 ` -SenderAddress sender@yourdomain.com ` -RecipientAddress recipient@externaldomain.com ` -StartDate "2026-08-10" ` -EndDate "2026-08-11" | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, MessageTraceId
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com $Trace = Get-MessageTraceV2 ` -SenderAddress sender@yourdomain.com ` -RecipientAddress recipient@externaldomain.com ` -StartDate "2026-08-10" ` -EndDate "2026-08-11" $Trace | ForEach-Object { Get-MessageTraceDetailV2 ` -MessageTraceId $_.MessageTraceId ` -RecipientAddress $_.RecipientAddress }
✅ Current Status
✅ Resolution Outcome
After reviewing the outbound spam filter policy, aligning DNS configuration, validating SPF, DKIM, and DMARC, and addressing sender reputation issues, outbound email delivery normalised.
- Outbound emails were delivered successfully
- Messages started landing in recipients’ inboxes
- Legitimate messages were no longer incorrectly classified as junk
- Sender reputation improved after DNS and domain reputation issues were addressed
💡 Best Practices & Recommendations
- Use SPF, DKIM, and DMARC together. SPF alone is not enough for strong email authentication
- Manage DNS records at the authoritative DNS provider, not only in the Microsoft 365 admin center
- Monitor outbound sending behaviour to detect compromised accounts, risky applications, or abnormal sending patterns
- Use least-privilege admin roles such as Exchange Administrator or Security Administrator instead of Global Administrator for routine mail flow changes
- Review third-party senders regularly. CRM, ERP, ticketing, marketing, and website platforms must be included in the SPF, DKIM, and DMARC strategy if they send as your domain
- Do not rely on blocklist delisting alone. Always fix the technical cause before requesting delisting from any reputation provider
📝 Conclusion
💡 Key Takeaway
The Microsoft 365 outbound email delivery issue was resolved through a combination of Exchange Online outbound policy review, DNS authentication alignment, and sender reputation remediation.
The key fix was ensuring that SPF, DKIM, and DMARC were correctly configured at the authoritative DNS provider and that domain reputation issues were addressed. After DNS propagation and validation were completed, outbound emails began landing successfully in recipients’ inboxes instead of being incorrectly marked as junk.
📚 References & Further Reading
- 🔗 Set up SPF to help prevent spoofing in Microsoft 365 — Microsoft Learn
- 🔗 Set up DKIM to sign mail from your Microsoft 365 domain — Microsoft Learn
- 🔗 Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn
- 🔗 Configure outbound spam filtering in Microsoft 365 — Microsoft Learn
- 🔗 Message trace in the modern Exchange admin center — Microsoft Learn
- 🔗 Connect to Exchange Online PowerShell — Microsoft Learn
- 🔗 Check Spamhaus reputation status — Spamhaus
Explore More Exchange Online Resources
Continue learning with our complete Exchange Online administration guide, course modules, and interview preparation resources.