SCL Thresholds: When Emails Land in Junk vs. Inbox

SCL Thresholds Explained in Plain English

Microsoft assigns every inbound email a Spam Confidence Level (SCL), a score ranging from -1 to 9. The higher the number, the more suspicious the message. These SCL values are mapped to default actions in your anti-spam policy, which determines if the email goes to the Inbox, Junk folder, or is quarantined. For more details, see the official documentation on how SCL works.

Here’s a quick overview:

• SCL -1: Bypasses spam filtering and goes straight to the Inbox.
• SCL 0–1: Considered safe and delivered to the Inbox.
• SCL 5–6: Likely spam. Default action is to move to Junk; Strict security presets may place these in quarantine instead.
• SCL 7–9: High confidence spam. Normally sent to Junk, but under Standard or Strict policies, these messages are sent to quarantine.

Microsoft notes that you won’t see spam filtering assign SCL values of 2, 3, or 4. However, other features in the system can sometimes set higher SCL values in special cases. (Learn more)

Inbox vs. Junk: What Actually Triggers Each Outcome

It’s helpful to imagine these SCL values as thresholds: Emails with SCL -1, 0, or 1 will be delivered to the Inbox. Messages scoring 5 or 6 are marked as spam and typically moved to Junk. Scores from 7 to 9 indicate high confidence spam and face stricter handling, often ending up in quarantine depending on your organization’s chosen security policy. These actions can be configured by administrators as needed.

Microsoft also writes verdicts into message headers using Spam Filtering Verdict (SFV) codes. For example, SFV: NSPM means “not spam,” while SFV: SPM indicates “spam.” Sometimes you may also see bulk mail indicators like SRV: BULK. These codes, along with the SCL, help explain why specific actions were taken.

Future Developments in How Microsoft Sets SCL

Today’s filtering considers mail content, sender reputation, authentication status, user engagement, and sending patterns. All these factors are calculated and reported as the SCL in the X-Forefront-Antispam-Report header. Policy actions are then applied based on whether an email meets spam or high confidence spam thresholds. Organizations can use preset policies to automatically quarantine messages deemed most dangerous.

In secure-by-default environments, any message identified as high confidence phishing will always be quarantined, bypassing both the Inbox and the Junk folder entirely.

Where to Find the SCL for a Message

In Outlook on the Web or Outlook Desktop

1. Open the relevant email message.
2. View the message headers, or select “View source.”
3. Look for the X-Forefront-Antispam-Report section.
4. Find SCL: and its nearby SFV: verdict for quick evaluation.

For an easier reading experience, you can paste email headers into Microsoft’s Message Header Analyzer. This tool will help interpret fields including SCL, SFV, BCL, and more.

What Pushes SCL Up or Down

• Authentication: Strong SPF, DKIM, and DMARC records lower suspicion.
• Reputation: Domain age, healthy DNS setup, and responsible past behavior are important.
• Sending Behavior: Large or sudden spikes in mail volume may raise your SCL.
• Complaints and Engagement: Frequent spam reports increase risk; consistent positive engagement helps lower SCL.
• Infrastructure: Reliable reverse DNS, TLS support, and a stable HELO/EHLO signal trust.
• Policy Conflicts: Custom admin rules can override automatic scoring and assign their own SCL or verdicts.

Bulk mail is tracked separately by the Bulk Complaint Level (BCL) header. High BCL scores can trigger Junk or quarantine even if the SCL is not high, so monitoring both values is key.

Warm Up and SCL: Building Trust the Safe Way

Brand-new or inactive senders often start with a weak reputation, which can result in a higher SCL and more emails being marked as spam. A careful warm up process helps establish a record of safe, consistent behavior and positive user interactions.

Mailwarm specializes in this type of technical warm up. By connecting your mailbox to a network of real inboxes, it sends low-volume messages and orchestrates realistic activity, opening emails, sending replies, rescuing stuck messages, and marking them accordingly. This tells mailbox providers your emails are wanted and trustworthy. Over time, your reputation improves and SCL remains low.

This process is not for marketing purposes; it strictly builds technical trust with mailbox providers. If you want a comprehensive guide through the warm up process with step-by-step instructions suited to current filtering requirements, see our 2025 guide to mastering email warm up.

Practical Thresholds for Admins

Not every organization needs to use the Strict preset. Evaluate your business risk tolerance and support resources. Many opt for the Standard preset, which quarantines high confidence spam but leaves regular spam in Junk. This keeps the most dangerous content away from users without creating excessive review work.

• For most users, leaving the “Spam” setting at Move to Junk is recommended because it ensures potential spam is automatically removed from their primary inbox.
• Quarantine all “High confidence spam” and “High confidence phish” messages.
• Set bulk thresholds sensibly, routing bulk mail to Junk as needed.
• Enable ZAP (Zero-hour Auto Purge) to clean up late-detected threats.

Troubleshooting: When Good Mail Lands in Junk

Check the Header First

• Confirm the SCL value and Spam Filtering Verdict (SFV) in the headers.
• Look for any bulk (BCL) or phishing categories present.
• Check DMARC, DKIM, and SPF authentication results for issues.

Fix Technical Gaps

• Ensure SPF, DKIM, and DMARC are correctly aligned between envelope and header domains.
• Set up reverse DNS and use a stable HELO/EHLO string.
• Ramp up sending volume predictably, avoid sudden spikes.
• Warm up any new domains or IPs before starting major campaigns.

Policy and Reputation Steps

• Remove risky mail flow rules that automatically assign SCL values of 5–9.
• Clear your domain from blocklists and resolve any abuse/complaint issues.
• Reduce outgoing mail to problematic or invalid addresses.
• Leverage Mailwarm or similar services to rebuild a record of steady, positive interaction.

If you’re seeing both bounces and Junk placement, check the newest delivery rules shaping mail flows in 2025. See our overview on why emails get bounced in 2025 for an explanation of common causes.

SCL vs. BCL, and Gmail vs. Microsoft

• SCL vs. BCL: SCL measures spam risk, while BCL evaluates bulk sending behavior. Either value can cause mail to be sent to Junk or quarantined.
• What about Gmail? Gmail uses its own distinct filtering methods rather than SCL, relying on different signals and headers. The practices of gradually increasing email volume (warming up) and domain authentication are also important in Gmail.
• Can admins override default actions? Yes, admins have full flexibility to route, quarantine, delete, or filter email based on verdict. Preset policies provide strong baseline protections.
• Are SCL values 2, 3, or 4 ever used? They are not assigned by spam filtering routines, but other features in the system may sometimes directly set certain SCLs.

A Simple Action Plan

1. Authenticate your sending domain with SPF, DKIM, and DMARC records.
2. Ensure DNS, reverse DNS, and TLS are properly configured.
3. Warm up new mail streams with gradual increases in volume and authentic engagement.
4. Monitor SCL, SFV, and BCL header values on a weekly basis.
5. Quarantine high confidence spam; deliver standard spam to Junk.
6. Keep any changes to sending volumes modest and predictable to avoid spikes.

Need help with reading your headers, adjusting your spam policies, or planning a safe warm up? Talk to a deliverability expert. A quick review can often clarify your next steps.

FAQ