External Sender Warnings SHALL Be Implemented
Description
Mail flow rules allow the modification of incoming mail such that mail from external users can be easily identified, for example, by prepending the subject line with “[External].” Seeing this message can help users identify email messages that might be spoofed and mark them as malicious.
Policy
External sender warnings SHALL be implemented.
Licensing Considerations
This setting can be configured in any Microsoft tenant with Exchange Online.
Set Up Instructions
Mail flow rules (transport rules) in Exchange Online | Microsoft Learn
To enable external sender warnings:
Sign in to the Exchange admin center.
Under Mail flow, select Rules.
Click the plus (+) button to create a new rule.
Select Modify messages….
Give the rule an appropriate name.
Under Apply this rule if…, select The sender is located….
Under select sender location, select Outside the organization, then click OK.
Under Do the following…, select Prepend the subject of the message with….
Under specify subject prefix, enter a message such as “[External]” (without the quotation marks), then click OK.
Under Choose a mode for this rule, select Enforce.
Click Save
End-User Impact
Level: Low
With this setting in place, users will see a prepended message with each email they get originating outside the organization. Users should be trained to spot these messages in a combination of the from address to identify if the from address is being spoofed.
Tips
None Currently
PowerShell Scripts
https://adamtheautomator.com/external-email-warning/
https://lazyadmin.nl/it/add-external-email-warning-to-office-365-and-outlook/
https://learn.microsoft.com/en-us/powershell/module/exchange/set-externalinoutlook?view=exchange-ps
Videos
Last updated
