You're rewriting your copy, A/B testing subject lines, and obsessing over your call-to-action. Meanwhile, nobody is reading your emails. They aren't even hitting the spam folder—they are being silently swallowed by Microsoft 365's Exchange Online Protection (EOP) Quarantine.
In B2B outbound, over 60% of your prospects are hosted on Microsoft infrastructure. If you don't understand how Microsoft evaluates, scores, and categorizes incoming mail, you are basically shouting into a void. Microsoft doesn't care about your clever personalization; they care about network reputation and structural compliance.
Microsoft uses a highly sophisticated, multi-layered filtering system to protect corporate inboxes. The core of this system revolves around assigning a Spam Confidence Level (SCL) to every incoming message. The SCL is a score from -1 to 9.
When an email hits Quarantine, the user never sees it. It doesn't appear in Junk. It requires a system administrator to manually release it, which never happens for cold outreach. The math is simple: if you trigger an SCL of 7+, your campaign is dead.
Microsoft looks at several critical vectors to calculate this score: IP reputation, domain age, authentication (SPF/DKIM/DMARC), text-to-HTML ratio, and the presence of tracking pixels. Standard marketing practices actively trigger high SCL scores.
To beat the quarantine, you have to strip away the marketing garbage and send emails that structurally mimic a genuine, one-to-one business communication.
If you are tracking open rates in 2026, you are voluntarily sacrificing your deliverability. Microsoft's EOP actively scans for the invisible 1x1 image pixels used by outreach platforms to track opens. Finding these pixels immediately raises your SCL score.
Worse, Microsoft often pre-fetches (opens) emails on the server side to scan for malicious links, resulting in phantom opens. Open rates are an inflated, useless metric. Turn off open tracking entirely in your sending platform.
Marketing teams love HTML templates with logos, stylized buttons, and complex formatting. EOP hates them. Heavy HTML in cold emails screams "bulk marketing."
Your cold emails should be sent in MIME type text/plain or bare-minimum HTML that visually looks like plain text. No embedded images, no complex CSS, no brand logos in the signature. Look at how founders email each other—it's raw text. Mimic that structure.
Microsoft aggressively quarantines emails coming from newly registered domains. If your domain WHOIS record shows it was registered 12 days ago, EOP will not let your mail through to high-security corporate tenants, regardless of your copy. You must age your domains for a minimum of 30 days while running a slow, steady warmup protocol before sending a single live prospect email.
If you must include a link (which you shouldn't in the first email, but that's a different topic), do not use your outreach platform's default link tracking.
When you use generic click tracking, the URL the prospect sees (e.g., acme.com) differs from the underlying redirect URL (tracking.smartlead.com/...). EOP flags this mismatch as a classic phishing technique. If you need to track clicks, you must configure a Custom Tracking Domain (CTD) using a CNAME record so the tracking URL matches your sending domain. Better yet, remove links entirely and ask for a reply.
| Action | Impact on SCL Score | Result |
|---|---|---|
| Open tracking pixel present | +2 Points | Pushes borderline mail to Junk |
| Domain age < 15 days | +4 Points | Instant Quarantine (SCL 7+) |
| HTML heavily formatted | +1 Point | Increases scrutiny |
| Mismatched URLs (Generic tracking) | +5 Points | Flagged as Phishing / Quarantine |
| No Links, Plain Text, Aged Domain | 0 Points | Clean Inbox Placement |
What you are probably doing (High Risk): John Doe | CEO at Acme Corp (555) 123-4567 | [Company Logo Image] Book a meeting: [Calendly Link with generic tracking]
What you should be doing (Zero Risk): John Doe Acme Corp
Getting past Microsoft 365 Quarantine isn't an art; it's a technical compliance test. Stop trying to outsmart the spam filter with clever wording when your infrastructure is waving massive red flags. Strip the tracking, simplify the formatting, and age your domains. Write emails that look like they came from a human's keyboard, not a marketing automation server.
Security Standard: To verify domain authentication and prevent spoofing, reference the DMARC.org Technical Overview & Specifications.
To succeed, prioritize signal-based triggers over mass unverified volume. Set up decoupled secondary domains, implement waterfall data enrichment, and write concise peer-to-peer copy under 75 words.
Building an in-house function costs between $140,000 and $180,000 annually. Partnering with a dedicated agency like Outboundish delivers full infrastructure, verified data pipelines, and omnichannel outreach for 50% lower cost.
Yes. Synchronizing cold email with LinkedIn touches generates over 3x higher reply rates because prospects recognize your executive profile across multiple touchpoints.