This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 41%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
I have noticed that some time analyzing the header of a spammed email is not sufficient to find out which spam rule has been used to causing the spam detection What more tool can I do to find out?
As AndyDavid said, we can only check from the message header.
If you want to know which policy applied on this email, you could try to edit the "Actions" for exist anti-spam policy from "Move message to Junk Email folder" to "Add X-header"(Set different x-header for different policies).
It depends:
You can use this link to look at the headers to determine why it was marked as SPAM:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-message-headers?view=o365-worldwide#x-forefront-antispam-report-message-header-fields
However, it may not reveal anything specific if it was marked as SPAM simply because ATP determined it was for another reason.
ie:
SFV:SPM The message was marked as spam by spam filtering.
The problem here is that there are certain emails blocked as spam. The analizer doesn't give clear evidence. The "submission" give as a rescan result: blocked due to a policy. I can't find the policy in Spam settings that block the email.
In this case what will be the right approach?
There is no "policy" in the SPAM settings that blocks it. The anti-spam headers referenced in that link are the only information you are really going to get.
If 365 deems it SPAM simply for its content, then you wont be able to see what specifically the reason .
Your option at that point is to have the users report as not junk, add to their safe sender lists or you allow at the gateway
I didn't explain it well.
Once found by analyzer that a Bulk email threshold was flagged to 6 (EOP settled at 7) and after a completed submission didn't resolve the issue with the outcome : "blocked due to a policy" ....
I thought if I found witch is the spam setting (for example: Backscatter , SPF (DKIM, DMARC), specific words, HTML hyperlink, etc.... ) that could couse the issue I could resolve the problem withching it OFF.
At this point the only solution will be add the email to the Spam whitelist?
Yes, you do not want to modify the policy or lessen its capabilities .
Work-around the issue with safelisting:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365?view=o365-worldwide
Thats the recommended and best solution
Open a service request from Microsoft 365 admin center, check whether they could help you check the blocked reason. Before that, the white list may be the most suitable way.