Exchange Server 2019 Need Help Blocking Display Name Spoofing

Michael Adams 306 Reputation points
2022-11-13T00:23:39.33+00:00

I created a rule that I was hoping would block display name spoofing. These are emails that come from outside the organization, but have an internal user's display name. Unfortunately, my rule doesn't seem to work, and I wanted to see if anyone had an idea on why.

259866-exchange-rule-screen-capture.png

I also tried another rule, and it didn't work either.

259858-exchange-rule-screen-capture-2.png

Any help would be appreciated.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,357 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michael Adams 306 Reputation points
    2022-11-13T05:13:45.143+00:00

    I found the answer. Set the condition to "A message header matches" and then for the field enter "FROM" and then then person's name for the match.

    0 comments
  2. LilyLi2-MSFT 1,981 Reputation points
    2022-11-14T06:23:44.307+00:00

    Hi @Michael Adams ,

    I found the answer.
    Great to know that you've already thought of a solution and really appreciate it for your sharing!
    By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others." and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:

    [Exchange Server 2019 Need Help Blocking Display Name Spoofing]

    Issue Symptom:
    Create a rule to block Display Name Spoofing: These emails come from outside the organization but have an internal user's display name.

    The Solution:
    Set the conditions for the rule to:” A message header matches” and then for the field enter "FROM" and then person's name for the match.
    260002-1.png
    You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community members to see the useful information when reading this thread.

    Thanks!

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.