As soon as an email message hits Microsoft’s servers, their proprietary Exchange Online Protection (EOP) filtering service scans the message and then inserts an anti-spam report into the message headers. You can read more about all of the different fields and filters they use here, but the three fields that I’m going to focus on today that have helped us understand how messages are being processed are:

SCL = The Spam Confidence Level
PCL = The Phishing Confidence Level
BCL = The Bulk Complaint Level

When opening the message headers you can do a search for X-Forefront-Antispam-Report and find the SCL ratings underneath. BCL and PCL ratings can be found under the X-Microsoft-Antispam section. Here’s a screenshot of the message headers from a message I received in my Outlook account where I’ve highlighted these ratings.

SCL — Spam Confidence Level

After the email is received and goes through the EOP spam filtering it’s given an SCL score. Here’s a breakdown of what each means:

-1 = A special value that means the message is a safe sender and is not spam. This score tells Microsoft to put the message in the inbox.
0-1 = The content of the message was scanned and determined to not be spam. These two scores also tell Microsoft to deliver the message to the inbox.
5-9 = Starting with a score of 5 the message is suspected to be spam and is increasingly suspect to the highest score of 9 which indicates there’s a high confidence it’s spam. Any rating between 5 and 9 means the message should be sent to the Junk folder.

*Note: 2, 3, 4, 7, and 8 are ratings that are not assigned by Microsoft.

For more information, refer to Microsoft’s official documentation on SCL.

BCL — Bulk Complaint Level

BCL ratings range from 0-9 depending on how likely the message is to generate complaints based on historical data. Microsoft says they use both an internal and third-party tool to assign messages a rating — a message that receives a 2 is unlikely to generate many complaints versus a message that receives a score of 8, which is likely to generate a high number of complaints. Here’s the breakdown of BCL ratings:

0 = Indicates the message is not from a bulk sender.
1-3 = This bulk sender generates few complaints.
4-7 = This bulk sender generates a mixed number of complaints.
8-9 = This bulk sender generates a high number of complaints.

For more information, refer to Microsoft’s official documentation on BCL

PCL — Phishing Confidence Level

This rating simply determines how likely the message is a phishing message based on the content. These range from:

0-3 = Not likely to be phishing.
4-8 = Likely to be phishing and marked as suspicious content.

For more information, refer to Microsoft’s official documentation on PCL.