How do Outlook's spam filters work (generally)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If you're sending email to anyone with an Outlook.com address or a company using Microsoft 365, you're dealing with Microsoft's filtering stack. And it's different from Gmail in ways that matter.
Outlook's spam filters are built around two core engines. The first is Microsoft SmartScreen, which looks at global patterns across billions of messages to spot spam signatures and suspicious content. The second is Exchange Online Protection (EOP), which handles filtering for business and enterprise accounts on Microsoft 365. That split is why B2B delivery to Microsoft-hosted domains often behaves differently from consumer Outlook traffic. Your marketing email might land fine at outlook.com addresses but get filtered heavily at corporate Microsoft 365 domains (or vice versa).
What Microsoft actually checks: authentication results (SPF, DKIM, DMARC), IP reputation, spam signatures from SmartScreen, content heuristics (like subject lines and body text patterns), and user-level feedback (spam reports, junked messages). Microsoft places heavy emphasis on something called Spam Confidence Levels (SCL), which is an internal score that determines where your email lands. High SCL score means spam folder. Low SCL score means inbox. You can't see your SCL score from the outside, but you can infer it from delivery behavior.
Bulk complaint rates matter more at Microsoft than almost anywhere else. If recipients are moving your emails to junk or marking them as spam, that signal feeds directly into SmartScreen and affects future delivery. Microsoft also watches for sudden volume spikes, which can trigger throttling or filtering even if your authentication is perfect.
The practical difference between Outlook and Gmail: Outlook favors predictable senders with clean infrastructure and solid authentication. Gmail is more willing to let borderline emails through if engagement is strong. At Outlook, if your IP reputation or domain reputation dips, you'll see filtering tighten immediately. Microsoft doesn't give as much second-chance leeway as Gmail does.
If you're sending B2B and hitting Microsoft 365 domains, make sure your DMARC record is set to p=quarantine or p=reject. Microsoft treats DMARC enforcement as a trust signal for enterprise mail. You can check your authentication setup with our free SPF checker and DMARC generator if you're not sure where you stand.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
