Exchange Online Multiple From Email Addresses

[amcintosh]

Got a notice today that Microsoft Exchange Online will start to reject emails with multiple From addresses without a Sender Header - 

Starting October 15th, Exchange Online will reject emails with multiple From addresses without a Sender header, to comply with RFC 5322. Organizations should ensure a single address in the Sender header to avoid non-delivery reports (NDRs) with error code 550 5.1.20. Feedback on this change is welcomed.

Is there a way to run a report on Exchange Online to determine if somebody in our company sending emails that have Multiple From emails or if we are receiving any as such?

[#2]

I have same query; we want to check if there is any impact. We want to search who are using multiple email address and can inform them to correct it.

[#3]

I've been looking for a way to report on this traffic as well, with no results. However, it looks like MS has changed MC886603 a little. Now it implies that they will block this email if there are multiple entries in the from field AND there's no sender address. Additionally, now they say they will alert you if there's "significant" traffic that would be impacted.

Snip from MS' notice on this follows.

"Updated September 20, 2024: We have updated the content. Thank you for your patience.

Starting December 1st, we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being sent via Exchange Online.

If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs.

We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header."