Need advice to avoid SCL 5 spam with MSFT
I have an app, a social media app for education (College students), and for registration I've made it fully available for students who register using their University's email, and if that university is available on the app it will take them directly to a…
I have an app, a social media app for education (College students), and for registration I've made it fully available for students who register using their University's email, and if that university is available on the app it will take them directly to a timeline exclusively for their university. So registration by Organization/College email is mandatory. Problem I've been facing and trying to fix for some time now is that my transacional emails on personal Outlook Emails goes to Junk and for University's email / Tenant don't get the email at all since they don't have active Junk Mailbox. Some universities have "Quarantine". I have: - SPF checked / DKIM checked / DMARC = none; and using Resend for sending the messages. I need help and suggestions to fix this issue, or any other way to get OTPs sent to users. What would you do?
Collected discussion
Are you sending from a 365 tenant? Have you looked at MXToolbox to test deliverability https://mxtoolbox.com/deliverability Have you setup an inbox to receive DMARC reports, if so, is SPF and / or DKIM passing?
App hosted on GCP using Resend for sending transactional emails. Just tried it, SPF DKIM DMARC all passing, and IP is not on any blacklist.
Hmm, it not possible to just do MS / Google SSO and remove the need for OTP emails entirely? Most, it not all colleges would be either or?
It's annoying that my outlook mail get 100x more phishing emails than my Gmail, and yet my OTP reaches Gmail's inbox and not Microsoft's ! their system is messed up.
Checked everything passed, mail is minimal, using a subdomain for more than 3 months now and still the issue persists. Probably reputation and I don't really know how to fix this if users can't even see the email. I've allowed personal email registration just to maybe get better reputation.
Microsoft reputation is mostly tied to the sending IP and traffic pattern, so personal registrations won’t fix SCL 5 if the same IP is flagged. Pull X-Forefront-Antispam-Report from a junked message, then contact Microsoft sender support or ask your ESP about the shared IP pool.
I do not know if this is helpful, but these would absolutely get grabbed by most third party tools that do not particularly care that all checks pass with DKIM, SPF, etc. For example OTP from a domain registered in the last year would immediately be marked as suspicious and require review or require someone to submit for review from Outlook, even if it passed everything on the Microsoft side- at least in our org. Mimecast, FortiMail/PerceptionPoint, and others will all do something similar. Microsoft has also started doing similar analysis with their baseline spam filter, it could easily be the content of the email, timing of it, etc.
SPF/DKIM passing isn't enough. Make sure DKIM aligns with the visible From domain, keep OTP mail minimal, and send from a dedicated transactional subdomain with consistent volume. Try the Email Tester first to catch obvious reputation or content issues, then ask one university admin for the quarantine reason and message headers.
SCL 5 usually points to Microsoft’s filtering rather than just SPF, DKIM, or DMARC. You should change your DMARC policy from none to quarantine or reject once you’re confident everything is aligned, make sure your sending domain has built enough reputation, and check whether your sending IP or domain has a poor Microsoft reputation. Also verify every email at signup with a real time email verification tool like Invalid Bounce to block invalid, disposable, mistyped, role based, mailbox full, and catch all email addresses before sending OTPs, and run an Email Server Test to check your SPF, DKIM, DMARC, MX records, PTR, reverse DNS, ARC, and overall email server configuration so more of your emails reach the inbox.
Worth pinning down which side of SCL 5 you're on: inbound mail arriving stamped 5, or your own outbound being scored that way by someone else's tenant. The fixes have almost nothing in common, and the X-Forefront-Antispam-Report header (SFV, CAT, CIP) will tell you which one you've got before you touch a single policy. Tuning the wrong side for a fortnight is a very quiet way to lose two weeks.
Pull X-Forefront-Antispam-Report off a junked copy and look at CAT: specifically. If it says BULK rather than SPM you're chasing the wrong number — bulk is scored by BCL, not SCL, and the tenant's BCL threshold (default 7) is what's junking you. Nothing you do to SPF, DKIM or DMARC moves BCL at all, which would explain why everything passes and it still lands in junk. App OTP mail gets classed as bulk fairly often. Templated body, steady volume into one domain, almost no replies — it looks like bulk to a filter even though it isn't. Two things that actually shift it: ask Resend whether the pool you're on is enrolled in Microsoft's JMRP and SNDS, and get one friendly university admin to submit a junked message through the Defender submission portal as "should not have been blocked". Tenant-side submissions carry far more weight than anything you can do from the sending side. Worth separating the two failure modes too. Junk on personal Outlook and quarantine at the universities aren't the same problem — quarantine is that tenant's own policy.