====== example headers ======

<code>
x-forefront-antispam-report:
 CIP:77.55.0.0;CTRY:PL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.example.com;PTR:mail.example.com;CAT:SPM;SFS:(13230025)(4636009)(451199018)(19627405001)(36756003)(2616005)(5660300002)(1096003)(7636003)(15650500001)(86362001)(42186006)(83380400001)(356005)(7596003)(6266002)(6916009)(8676002)(26005)(9686003)(33964004)(166002)(336012)(211493008);DIR:INB;

x-microsoft-antispam: BCL:0;

X-Microsoft-Antispam-Mailbox-Delivery:
 ucf:0;jmr:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(910001)(944506478)(944626604)(920097)(930097)(3100021);RF:JunkEmail;
</code>

Interesting fields:
  * CIP:77.55.0.0;
  * CTRY:PL;
  * LANG:en;
  * **SCL:5;**    
    * 5,6 Spam filtering marked the message as Spam. Deliver the message to the recipients' Junk Email folder.
  * SRV:;
  * **IPV:NLI;**    
    * The IP address was not found on any IP reputation list.
  * **SFV:SPM;**    
    * The message was marked as spam by spam filtering.
  * H:mail.example.com;
  * PTR:mail.example.com;
  * **CAT:SPM;**     
    * Spam
  * SFS:(13230025)(4636009)(451199018)(19627405001)(36756003)(2616005)(5660300002)(1096003)(7636003)(15650500001)(86362001)(42186006)(83380400001)(356005)(7596003)(6266002)(6916009)(8676002)(26005)(9686003)(33964004)(166002)(336012)(211493008);
  * DIR:INB;


===== Magic keywords =====

[[https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/message-headers-eop-mdo?view=o365-worldwide#x-microsoft-antispam-message-header-fields]]

  * ''BCL:0'' - Bulk Complain Level
  * ''SCL:0'' - The spam confidence level (SCL) of the message. A higher value indicates the message is more likely to be spam. For more information, see [[https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-spam-confidence-level-scl-about?view=o365-worldwide|Spam confidence level (SCL)]]
  * ''S:SFA'' - [[https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/run-a-message-trace-and-view-results#spam-filter-agent-ssfa|Spam Filter Agent]]
  * ''X-MS-Exchange-Organization-AuthAs'' 

[[https://sender.office.com/Delist/]]