Outlook displays a safety tip warning “This message is suspicious” when it detects a potential phishing or spoofing attempt. This security feature scans incoming emails for signs of forgery or malicious links. The warning can sometimes appear on legitimate emails from known senders. This article explains why the warning triggers and provides steps to safely override it when you are certain the message is safe.
Key Takeaways: Overriding Suspicious Message Warnings
- Junk > Never Block Sender: Adds the sender to your Safe Senders list, preventing future warnings for their emails.
- Clicking “It’s safe” in the safety tip: Overrides the warning for the current message only and reports it as a false positive to Microsoft.
- File > Options > Trust Center > Trust Center Settings > Email Security: Contains advanced settings for encryption and digital IDs, but does not disable spoofing warnings.
Why Outlook Flags Messages as Suspicious
Outlook uses built-in security checks from Microsoft 365 to protect you. The “This message is suspicious” warning appears primarily due to spoofing detection. Spoofing is when an email’s “From” address is forged to look like it came from a trusted source. Outlook compares the sender’s domain with authentication records published by that domain’s administrators. If the records are missing or do not match, Outlook assumes the message is spoofed and shows the warning.
Other triggers include messages containing links to known malicious websites or emails that mimic the format of common phishing attempts. The system is designed to err on the side of caution. Therefore, a legitimate email from a company with misconfigured email security settings can trigger the alert. The warning is a protective barrier, not a definitive judgment that the email is harmful.
Understanding the Safety Tip Bar
The yellow safety tip bar appears at the top of the reading pane or opened message. It contains the warning text and an option to mark the message as safe. This bar is part of the Microsoft 365 Advanced Threat Protection service for business accounts. For personal Outlook.com accounts, a similar warning system is in place. The tip is your direct interface with the security filter, allowing you to provide feedback and proceed if you choose.
Steps to Override the Warning for a Single Message
When you are confident an email is not a threat, you can dismiss the warning. The safest method is to use the option provided in the safety tip itself. This action tells Microsoft’s systems the warning was incorrect, helping improve the filter.
- Open the suspicious email
Click on the message in your inbox to open it in the reading pane or double-click to open it in a new window. Ensure the yellow safety tip bar is visible. - Click “It’s safe” in the warning bar
Within the yellow safety tip, you will see a clickable link that says “It’s safe”. Click this link. The warning bar will disappear immediately, and the message will be treated as safe. - Report the message if prompted
Some versions of Outlook may ask if you want to report the message to Microsoft as a false positive. Selecting “Report” helps improve the security service’s accuracy for all users.
How to Allow Future Emails from the Sender
To prevent warnings for all future emails from a specific sender or domain, add them to your Safe Senders list. This tells Outlook to trust all mail from that source, bypassing most spam and spoofing filters.
- Select the suspicious message
Click once on the email in your message list. You do not need to open it fully. - Go to Junk > Never Block Sender
On the Outlook ribbon, find the “Junk” button in the “Delete” group on the “Home” tab. Click it and select “Never Block Sender” from the dropdown menu. - Confirm the action
A confirmation dialog will appear. Click “OK”. The sender’s email address is now added to your Safe Senders list, and future messages will not be flagged as suspicious.
Manually Managing the Safe Senders List
For more control, you can view and edit the list directly. Go to File > Options > Mail. Under the “Junk Email” section, click “Junk Email Settings”. In the dialog box, select the “Safe Senders” tab. Here you can add, edit, or remove email addresses and domains. You can also check the box at the bottom to “Also trust email from my Contacts”.
Common Mistakes When Handling Suspicious Messages
Disabling All Security Warnings via Registry or Policy
Some users search for ways to disable the suspicious message warning entirely through registry edits or group policy. This is not recommended. It removes a critical layer of protection against sophisticated phishing attacks. The warning system is a core security feature of Microsoft 365 and cannot be fully disabled through standard Outlook options without compromising your security.
Assuming All Flagged Messages Are Safe
The most significant risk is overriding the warning without careful inspection. Before clicking “It’s safe”, check the sender’s email address carefully for subtle misspellings, verify any links by hovering your mouse over them to see the true destination URL, and be cautious of urgent requests for personal information or payments. Legitimate businesses rarely ask for sensitive data via email.
The Warning Persists After Adding to Safe Senders
If a message is still flagged after adding the sender to your Safe Senders list, the issue may be with a link or image inside the email body that points to a blacklisted server. The Safe Senders list only affects filtering based on the sender’s address. It does not disable scanning of the message content. In this case, you must still use the “It’s safe” link on the individual message.
Safety Tip Actions and Their Outcomes
| Action | Immediate Effect | Long-Term Effect |
|---|---|---|
| Click “It’s safe” in the tip | Warning removed from that email | Feedback sent to Microsoft; no change for future emails from same sender |
| Use Junk > Never Block Sender | Current warning may remain | Sender added to Safe Senders list; future emails bypass junk and spoofing filters |
| Ignore the warning and reply | You can send a reply | No change to filtering; the warning stays on the received message |
| Delete the message | Message moved to Deleted Items | No feedback is provided; the filter does not learn from this action |
You can now safely override the suspicious message warning when you trust the sender. Use the “It’s safe” link for individual emails and the Safe Senders list for ongoing correspondence. For advanced security, consider enabling the “Report as Junk” option in the Junk Email settings to help Microsoft improve its filters. Remember that pressing Alt+J, S is a keyboard shortcut to quickly open the Junk menu options.