Microsoft 365 Emails Going to Spam: What to Check First

Inspect the actual message headers

Do not diagnose Microsoft 365 deliverability from DNS alone. Send a representative message to an external mailbox and inspect SPF, DKIM, DMARC and routing results.

Headers can show whether the message left through Microsoft infrastructure, a connector, a third-party gateway or another unexpected path.

Confirm DKIM is enabled for the custom domain

Microsoft 365 can send mail before custom-domain DKIM is fully enabled. Make sure the selector records exist and that signing is active for the domain.

Check the d= value in the DKIM signature to confirm the message is using the expected domain.

Review SPF and DMARC alignment

SPF must authorize the systems that actually send mail. If a connector routes messages through another platform, the resulting Return-Path and alignment may differ from what you expect.

DMARC requires aligned SPF or DKIM, not simply a green SPF result for an unrelated domain.

Check connectors and forwarding

Mail-flow connectors, third-party security gateways and automatic forwarding can change routing and authentication behavior. Document each hop in the message path.

If only a subset of users has the problem, compare their rules, connectors, sending applications and mailbox configuration with an unaffected user.

Reputation and content still matter

Even correctly authenticated Microsoft 365 mail can be filtered based on domain reputation, user complaints, sending patterns and message content.

Avoid sudden volume spikes from normal staff mailboxes and separate bulk outreach from everyday business communication.