Apr 18 2022 03:17 PM
Apr 18 2022 03:17 PM
My company uses O365 and has a few companies/domains running under the same tenancy.
I'd like to pitch that we add an external email warning banner to the top of emails that are from external senders. It seems that there are a few good benefits in doing this.
Unfortunately our domains all don't have very strong SPF records (~all is used) and we don't use DKIM/DMARC records for various reasons.
We'd like to know more about how it distinguishes external emails, as if we get this wrong, users could trust a process which isn't a 100% correct/working. E.g. if someone spoofs our domain, it will be an accepted domain.
The " Outside the organization" value seems to be defined here, but it's not too clear to me. - https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mail-flow-rules/conditions-and-excep...
* I have full admin access (for O365) and the accepted domains (found here https://docs.microsoft.com/en-us/exchange/mail-flow/accepted-domains/accepted-domain-procedures?view...) doesn't seem to specify IPs. Just the domains, which means it may not catch spoofed emails if going by " Outside the organization" definition, which is one of my fears.
Does anyone have any thoughts, ideas, or links on how we can make sure that this banner apply to ALL emails from outside of our office 365 tenancy? I think that this would be safest way to target this.
* also aware we might have some complaints about users not being able to read the first few line of text on their phones etc.
Apr 18 2022 11:28 PM
Dec 14 2022 02:42 AM
@SecurityAnalyst I'm curious. Why can't you use DMARC? I find it hard to imagine any reason why it can't be implemented.
Fundamentally, it's going to increase the chances of your legitimate email being successfully delivered AND prevent illegitimate spoofed email from being delivered.
Dec 14 2022 04:43 PM
I did a quick search with the below URL mentioned and believed you did read some posts similar.
Btw, I thought the most important thing is how to manage 'inside the organization', and supposed the Email Domain managed under your tenant
Jun 28 2023 03:39 AM
We had a similar concern regarding the first few lines of text being hidden in the preview pane.
I've created a solution to solve this issue that seems to be working well for us: