Exchange Online Protection (EOP) Filtering Explained: SCL, BCL, and PCL Scores

Exchange Online Protection (EOP) is the mail-filtering layer sitting in front of every Microsoft 365 mailbox. It runs before any tenant-level Defender for Office 365 policies and decides three things in the first hundred milliseconds:

1. Should the message be rejected outright?
2. If accepted, what spam score should it carry?
3. If it's bulk, how aggressively should it be filtered?

The answers live in the message headers. If you can read them, you can debug Microsoft 365 deliverability without guessing.

Spam Confidence Level (SCL)

X-MS-Exchange-Organization-SCL: 1

SCL	Meaning	Default action
-1	Allowlisted / safe sender	Skip filtering
0	Not spam	Inbox
1	Not spam	Inbox
5	Spam	Junk folder
6	Spam	Junk folder
7	High-confidence spam	Junk or quarantine
8	High-confidence spam	Junk or quarantine
9	High-confidence spam	Quarantine or reject

EOP rarely produces SCL of 2, 3, or 4, so the scale is effectively quantised. SCL 5 or higher has historically meant spam, but Microsoft now says the SCL value no longer decides the verdict or the action in cloud mailboxes; the CAT and SFV values in X-Forefront-Antispam-Report tell you what actually happened.

Bulk Complaint Level (BCL)

X-Microsoft-Antispam: BCL:4

BCL grades the complaint history of the sender, not the content of the message. It's a 0–9 scale where 0 = not from a bulk sender and 8–9 = a bulk sender that draws a high number of complaints.

Tenant admins set a BCL threshold (default 7). Messages above the threshold get filtered to junk even if SCL is low.

If your transactional mail is fine but your marketing mail is junked at the same tenant, BCL is usually the reason: your IP / domain has a complaint history that EOP factors in.

Phishing Confidence Level (PCL)

PCL (0–8) only appears on messages EOP suspects of impersonation or phishing. A PCL ≥ 4 typically lands the message in quarantine regardless of SCL. You'll see this if you're sending mail that includes brand names, login prompts, or password-related copy.

Reading the Full Antispam Header

The compact header to study is X-Microsoft-Antispam:

X-Microsoft-Antispam: BCL:4;ARA:13230040|2092899012|26050799012;

The ARA value is internal, and you can mostly ignore it. The fields that matter:

• BCL: as above.
• Any SFV: (Spam Filter Verdict, written in the companion X-Forefront-Antispam-Report header), with these common values:
  • SFV:NSPM: not spam
  • SFV:SPM: spam
  • SFV:BLK: sender blocked
  • SFV:SKA: sender on an anti-spam policy allow list (skipped)
  • SFV:SKB: sender matched a blocked senders or domains list in an anti-spam policy
  • SRV:BULK: bulk message at or above the BCL threshold

If you see SRV:BULK and recipients complain about junking, lower your sending volume or improve engagement on the relevant lists.

Authentication-Results

EOP writes a standard Authentication-Results header. Look for:

Authentication-Results: spf=pass smtp.mailfrom=yourdomain.com;
  dkim=pass header.d=yourdomain.com; dmarc=pass action=none header.from=yourdomain.com;
  compauth=pass reason=100

The key fields:

• spf, dkim, dmarc: must all be pass to maximise reputation benefit.
• compauth: Microsoft's composite authentication verdict. Pass / fail / softpass / none.
• reason: three-digit code explaining compauth. 100 is best (full pass). 1xx codes are passes, 2xx are soft passes, and 0xx and 6xx are failures.

A common reputation killer: SPF passes for the ESP's bounce domain but nothing aligns with your From domain and no DKIM signature uses it → compauth fails or soft-passes instead of passing. Sign DKIM with your From domain and compauth returns to pass.

Inspect any message with our email header analyzer.

What Influences SCL

EOP doesn't publish weights but in practice, these inputs dominate:

• Sending IP reputation (Microsoft-internal).
• compauth verdict (pass/fail).
• DMARC policy enforced or not.
• URL reputation in the message body.
• Content patterns (image ratio, link density, suspicious keywords).
• Historical complaint rate for the domain.

What Influences BCL

• JMRP complaint rate (Outlook.com side, fed back to EOP).
• Reports from Microsoft 365 "Report message" add-in.
• Mailbox-level engagement (mass deletes without opens).

How to Lower Your SCL/BCL

1. Pass DMARC alignment, not just SPF or DKIM individually.
2. Maintain complaint rate below 0.1%. Use JMRP to spot-fix complainers.
3. Watch URL reputation. Don't link to free hosting domains or freshly-registered redirects.
4. Segment unengaged users out of bulk sends.
5. Don't mix transactional and marketing on the same subdomain.

FAQ

Where do I see SCL/BCL on a message I sent? Send a test message to a Microsoft 365 mailbox you control. View the full source and look for the X-Microsoft-Antispam and X-MS-Exchange-Organization-SCL headers.

Can I influence SCL with content tweaks alone? Marginally. Reputation and authentication dominate. Content tweaks (subject lines, link density) help if everything else is already clean.

Does EOP look at images? It scans images for known phishing visuals but doesn't OCR text. Image-heavy email mostly hurts you via the "no plain text, high image ratio" content signal.

Related

• Why Emails Land in Outlook Junk
• SNDS & JMRP Setup Guide

Sources

• Anti-spam message headers (Microsoft Learn), the X-Forefront-Antispam-Report and X-Microsoft-Antispam fields, every SFV value, and the compauth reason codes.
• Spam confidence level (SCL) in Microsoft 365 (Microsoft Learn), what the SCL values mean and why they no longer set the action in cloud mailboxes.
• Bulk complaint level (BCL) in cloud organizations (Microsoft Learn), the BCL scale and the default thresholds: 7 in the default policy, 6 Standard, 5 Strict.
• How email authentication works in Microsoft 365 (Microsoft Learn), how Microsoft 365 combines SPF, DKIM, DMARC and implicit signals into composite authentication.
• RFC 8601: Message Header Field for Indicating Message Authentication Status, the standard Authentication-Results header EOP writes.