Exchange Online Protection (EOP) Filtering Explained: SCL, BCL, and PCL Scores

Exchange Online Protection — EOP — is the mail-filtering layer sitting in front of every Microsoft 365 mailbox. It runs before any tenant-level Defender for Office 365 policies and decides three things in the first hundred milliseconds:

1. Should the message be rejected outright?
2. If accepted, what spam score should it carry?
3. If it's bulk, how aggressively should it be filtered?

The answers live in the message headers. If you can read them, you can debug Microsoft 365 deliverability without guessing.

Spam Confidence Level (SCL)

X-MS-Exchange-Organization-SCL: 1

SCL	Meaning	Default action
-1	Allowlisted / safe sender	Skip filtering
0	Not spam	Inbox
1	Not spam	Inbox
5	Spam	Junk folder
6	Spam	Junk folder
7	High-confidence spam	Junk or quarantine
8	High-confidence spam	Junk or quarantine
9	High-confidence spam	Quarantine or reject

EOP rarely produces SCL of 2, 3, or 4 — the scale is effectively quantised. If you see SCL: 5 or higher in your sent messages, EOP has decided you're spam. Anything 7+ usually means a content or URL trigger fired.

Bulk Complaint Level (BCL)

X-Microsoft-Antispam: BCL:4

BCL grades the complaint history of the sender, not the content of the message. It's a 0–9 scale where 0 = no complaint signal, 9 = consistently high complaint volume.

Tenant admins set a BCL threshold (default 7). Messages above the threshold get filtered to junk even if SCL is low.

If your transactional mail is fine but your marketing mail is junked at the same tenant, BCL is usually the reason — your IP / domain has a complaint history that EOP factors in.

Phishing Confidence Level (PCL)

PCL (0–8) only appears on messages EOP suspects of impersonation or phishing. A PCL ≥ 4 typically lands the message in quarantine regardless of SCL. You'll see this if you're sending mail that includes brand names, login prompts, or password-related copy.

Reading the Full Antispam Header

The compact header to study is X-Microsoft-Antispam:

X-Microsoft-Antispam: BCL:4;ARA:13230040|2092899012|26050799012;

The ARA value is internal — you can mostly ignore it. The fields that matter:

• BCL — as above.
• Any SFV: (Spam Filter Verdict) — common values:
  • SFV:NSPM — not spam
  • SFV:SPM — spam
  • SFV:BLK — sender blocked
  • SFV:SKB — sender on allow list (skipped)
  • SFV:BULK — bulk message above BCL threshold

If you see SFV:BULK and recipients complain about junking, lower your sending volume or improve engagement on the relevant lists.

Authentication-Results

EOP writes a standard Authentication-Results header. Look for:

Authentication-Results: spf=pass smtp.mailfrom=yourdomain.com;
  dkim=pass header.d=yourdomain.com; dmarc=pass action=none header.from=yourdomain.com;
  compauth=pass reason=100

The key fields:

• spf, dkim, dmarc — must all be pass to maximise reputation benefit.
• compauth — Microsoft's composite authentication verdict. Pass / fail / softpass / none.
• reason — three-digit code explaining compauth. 100 is best (full pass). 1xx codes are passes; 2xx and 5xx are failures.

A common reputation killer: SPF pass but DKIM not signing → compauth softpass with reason 230. Fix DKIM and compauth returns to 100.

Inspect any message with our Email Headers Analyzer.

What Influences SCL

EOP doesn't publish weights but in practice, these inputs dominate:

• Sending IP reputation (Microsoft-internal).
• compauth verdict (pass/fail).
• DMARC policy enforced or not.
• URL reputation in the message body.
• Content patterns (image ratio, link density, suspicious keywords).
• Historical complaint rate for the domain.

What Influences BCL

• JMRP complaint rate (Outlook.com side, fed back to EOP).
• Reports from Microsoft 365 "Report message" add-in.
• Mailbox-level engagement (mass deletes without opens).

How to Lower Your SCL/BCL

1. Pass DMARC alignment, not just SPF or DKIM individually.
2. Maintain complaint rate below 0.1%. Use JMRP to spot-fix complainers.
3. Watch URL reputation. Don't link to free hosting domains or freshly-registered redirects.
4. Segment unengaged users out of bulk sends.
5. Don't mix transactional and marketing on the same subdomain.

FAQ

Where do I see SCL/BCL on a message I sent? Send a test message to a Microsoft 365 mailbox you control. View the full source and look for the X-Microsoft-Antispam and X-MS-Exchange-Organization-SCL headers.

Can I influence SCL with content tweaks alone? Marginally. Reputation and authentication dominate. Content tweaks (subject lines, link density) help if everything else is already clean.

Does EOP look at images? It scans images for known phishing visuals but doesn't OCR text. Image-heavy email mostly hurts you via the "no plain text, high image ratio" content signal.

Related

• Why Emails Land in Outlook Junk
• SNDS & JMRP Setup Guide