Outlook safe senders list is ignored for messages created via Graph API

Dear @Alex,

Thank you for posting your question in the Microsoft Q&A forum.

Based on your description, adding a full sender email address to Safe senders and domains works correctly for messages created via Microsoft Graph, but adding only the sender domain works only for inbound mail. You want to confirm whether this behavior is expected, whether Graph‑created messages are evaluated differently, and whether a full sender address is required instead of a domain for this type of message.

What you’re seeing is expected. Emails delivered through normal inbound mail flow and emails injected directly into a mailbox via Microsoft Graph can be evaluated differently, so a domain-only entry in Safe senders and domains may not be applied consistently for Graph-created messages.  For Graph-injected messages, the most reliable approach is to safe listing the full sender email address, which matches your test results (address works; domain-only may not).  Microsoft also notes that whether domain entries are honored can vary depending on how the service handles the message (policy verdict/action path), while specific sender addresses are more consistently honored.  If you want to verify what’s actually stored for the mailbox and whether it’s in sync, Microsoft provides a Safe/Blocked Sender diagnostic tool:

Diagnose Safe/Blocked Senders Issues in Microsoft 365

I hope information above meet your expectations, if it does not, please leave the comment below so I can support you more effectively.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

I hope information above

Domain-level safe sender entries are not guaranteed to be honored for all scenarios, and behavior differs between Outlook’s client-side junk filter and Exchange Online/Exchange Online Protection.

From the documented behavior:

• Outlook’s Junk Email Safe Senders list can contain both email addresses and domains. Entries in this list are “never treated as junk email” by the Outlook junk filter itself, and the list is primarily designed to control spam classification, not image-download behavior.
• In Exchange Online/Exchange Online Protection, “safe domains are not recognized by default… Only blocked domains, blocked sender addresses, and safe sender addresses are recognized.” This means domain-level safelisting is not consistently applied at the service level; only full sender addresses are reliably honored.

Because of this design:

• Full email addresses in Safe Senders are consistently honored.
• Domain-only entries can behave differently depending on where and how the message is processed.
• Messages created via Graph and injected directly into the mailbox bypass normal inbound transport and anti-spam processing paths, so they are not evaluated the same way as SMTP-delivered mail. In that path, Outlook’s image-blocking logic can end up relying on per-address trust rather than domain-level entries.

So for the questions:

• Domain-level safe sender matching is not a general guarantee and is not recognized by default in Exchange Online/EOP.
• Messages created through Graph are evaluated differently from normal inbound SMTP mail.
• For consistent behavior (including automatic external image display) with Graph-created messages, a full sender email address in the Safe Senders list is required; a domain-only entry is not sufficient or supported as a reliable mechanism.

References:

• Overview of the Junk Email Filter in classic Outlook
• Create sender allowlists for cloud mailboxes
• Description of the policy for how e-mail is filtered by the junk e-mail filters in Outlook or in Exchange Server
• Options > Junk Email