The email header provides detailed technical information about the message including the sender and recipient, server hops and other important information that pertains to the message. In Microsoft Exchange, it also includes important information on whether the receiving server has determined if the message is spam or not. In this post we are going to take a look at the spam confidence level attribute found within the message header properties.
If you are looking for a full breakdown of the mail message header, I have wrote a post on how to review and interpret message headers in Exchange Online.
What is the X-MS-Exchange-Organization-SCL attribute?
The X–MS–Exchange–Organization–SCL is an attribute added by the Exchange server once it has determined the level of confidence it deems the message to be spam. The range is from 0 to 9, with 9 being the highest level of confidence that the message is spam and 0 being the lowest. This attribute will also be surrounded by other important information within the message header.
What actions are taken based on the spam confidence level?
The spam confidence level determines if the message is likely spam or not, as such there are some default rules that determine if action will be taken based on the SCL number.
-1 – This means the message was skipped from processing, this could either be due to a transport rule or the message was on the safe senders list.
0>1 – The message was determined as not spam and the was delivered to the recipients inbox.
5>6 – The message was marked as spam as was delivered to the recipients Junk mail folder.
9 – The message was marked as high confidence spam and delivered to the recipients Junk mail folder.
As mentioned above, you can use transport rules to manipulate the SCL number to force messages to be marked as junk or to be skipped from the filter.
How to change the SCL with a transport rule
- Login to the Exchange admin center https://admin.exchange.microsoft.com/
- On the left-hand side, select Mail flow > Rules
- Click Add a rule, you should then see a drop-down list of rule templates. Select Bypass spam filtering
- Modify your rule appropriately, below I have specified a trusted IP range of which I do not want messages to be filtered
- You can leave the set rule settings page as default if you wish and click Next then Finish
Hello Daniel,
How exchange server determines SCL, how can we identify root cause of SCL marked as 6 for legit mails. I am sending email to myself from a printer but mails are moving to junk because of X-MS-Exchange-Organization-SCL: 6. For other users the SCL is marked as 1 for same kind of emails.
This would be picked up in the X-Forefront-Antispam-Report CAT header. I have more information in my post: https://ourcloudnetwork.com/review-and-interpret-message-headers-in-exchange-online/