Fix: Legitimate Emails Going to Junk in Outlook

A small business kept missing important invoices from a key supplier because the emails were being silently sent to the Junk folder in Outlook. The user didn’t notice for weeks because they never checked the Junk folder. By the time they realised, several invoices were overdue. Adding the sender to the Safe Senders list and updating the company’s anti-spam policy in Microsoft 365 fixed the problem immediately, and no further emails were misrouted.

Symptoms

Emails from a known, legitimate sender are not arriving in your Inbox. Instead, they are being delivered to the Junk Email (Spam) folder in Outlook. You may not notice until you manually check the Junk folder or the sender contacts you to ask why you haven’t replied.

In some cases, you may see a banner at the top of the email when you find it in Junk:

We moved this message to your Junk Email folder because the content of this message looks like spam.

This sender failed our fraud detection checks.

Cause

There are several reasons why legitimate emails end up in the Junk folder:

• The sender has not emailed you before: Outlook treats unknown senders with more suspicion, especially if the email content matches common spam patterns
• Microsoft 365 anti-spam policies: Your organisation’s Exchange Online Protection (EOP) may be flagging certain senders or domains based on their reputation score
• Missing SPF, DKIM, or DMARC records on the sender’s domain: These are email authentication standards that prove an email genuinely came from the domain it claims to be from. If the sender’s domain is not properly configured, Microsoft is more likely to flag their emails
• Outlook junk email filter set too aggressively: The Outlook desktop client has its own junk email filter that can override server-side settings
• Previous “Mark as Junk” action: If you (or someone in your organisation) previously marked an email from this sender as junk, Outlook remembers that preference

What Are SPF, DKIM, and DMARC?

These are three email security standards that help receiving mail servers verify that an email is legitimate:

• SPF (Sender Policy Framework): A DNS record that lists which mail servers are allowed to send email on behalf of a domain. If an email comes from a server not on the list, it looks suspicious
• DKIM (DomainKeys Identified Mail): Adds a digital signature to outgoing emails that the receiving server can verify. It proves the email was not tampered with in transit
• DMARC (Domain-based Message Authentication, Reporting and Conformance): Tells receiving servers what to do if SPF or DKIM checks fail (for example, quarantine the message or reject it entirely)

If the sender’s domain is missing any of these records, their emails are more likely to be flagged as spam. This is not something you can fix on your end, but you can work around it using the methods below, and you can let the sender know they should talk to their IT team about setting up proper email authentication.

Resolution

For End Users

Option 1: Mark the Email as “Not Junk”

1. Open the Junk Email folder in Outlook
2. Find the email that should not be there
3. Right-click the email and select Not Junk (or click the Not Junk button in the ribbon)
4. In the dialog box, tick Always trust email from this sender and click OK

This moves the email to your Inbox and adds the sender to your Safe Senders list.

Option 2: Add the Sender to Your Safe Senders List

In Outlook Desktop (Windows):

1. Go to Home > Junk > Junk E-Mail Options
2. Click the Safe Senders tab
3. Click Add
4. Enter the sender’s email address or their entire domain (e.g., @supplierdomain.com.au)
5. Click OK

In Outlook on the Web (outlook.office.com):

1. Click the Settings gear icon in the top right
2. Go to Mail > Junk email
3. Under Safe senders and domains, click + Add
4. Enter the sender’s email address or domain
5. Press Enter and click Save

Option 3: Create an Inbox Rule

If Safe Senders is not working, create a rule to force emails from the sender into your Inbox:

1. In Outlook, go to Rules > Manage Rules & Alerts
2. Click New Rule
3. Select Apply rule on messages I receive and click Next
4. Tick from people or public group and add the sender’s email address
5. Click Next, then tick move it to the specified folder and select Inbox
6. Also tick stop processing more rules
7. Click Finish

For IT Administrators

Option 1: Add Allowed Senders in Anti-Spam Policy

1. Sign in to the Microsoft Defender portal
2. Navigate to Email & collaboration > Policies & rules > Threat policies > Anti-spam
3. Click on the Anti-spam inbound policy (Default)
4. Scroll to Allowed and blocked senders and domains and click Edit
5. Under Allowed, add the sender’s email address or domain
6. Click Save

Note: Only add trusted senders to the allowed list. Adding entire domains should be done with caution, as it bypasses spam filtering for all emails from that email or domain.

Option 2: Check the Connection Filter Policy

1. In the Defender portal, go to Anti-spam policies
2. Click Connection filter policy (Default)
3. If the sender’s mail server IP address is known, you can add it to the IP Allow list
4. Click Save

Option 3: Create a Transport Rule (Mail Flow Rule)

For more control, create a mail flow rule in the Exchange admin centre:

1. Go to the Exchange admin centre
2. Navigate to Mail flow > Rules
3. Click + Add a rule > Create a new rule
4. Name the rule (e.g., “Bypass spam filter for [sender domain]”)
5. Set the condition to The sender domain is and enter the domain
6. Set the action to Modify the message properties > Set the spam confidence level (SCL) > Bypass spam filtering
7. Click Save

Option 4: Notify the Sender About Their Email Authentication

If you suspect the sender’s domain is missing SPF, DKIM, or DMARC records, let them know. You can check their DNS records using tools like MXToolbox. Proper email authentication will improve their deliverability to all recipients, not just your organisation.

Important Notes

• Check the Junk folder regularly. Important emails can end up there at any time, especially from new senders
• Do not add unknown senders to your Safe Senders list. Only add senders you know and trust
• Anti-spam policy changes are organisation-wide. Adding a domain to the allowed senders list affects all users in your organisation, so only do this for verified, trusted domains
• Changes may take up to 30 minutes to take effect in Microsoft 365
• If a specific user keeps having issues after applying these fixes, check for Outlook client-side rules that may be overriding server settings

Related Resources

• Stop SendGrid emails from going to junk for your Office 365 users
• Fix: Outlook Search Not Finding All Emails
• How to set up a signature in Outlook
• Microsoft: Anti-spam protection in Exchange Online
• Microsoft: Create safe sender lists in EOP
• Microsoft: Email authentication in Microsoft 365
• MXToolbox – DNS and email authentication checker

If you need help with email filtering or spam issues, get in touch with our team.