Schooling A Sea of Phish Part 2: Enhanced Anti-spoofing technology in Office 365

Hi Ivan54. The 20 limit for spoofing protection is not who you apply the list to, but the names you want to especially check for in a possible spoof email. For example you could add John.smith@domain.com, who is your CEO to the list and apply that list to everyone in the company. Then emails from John.smith@isp.com could be considered attempted spoof emails and so alerted as such (the rules will be more involved than that example, but as I understand it, that is the idea of the list)