Fake Email

Question

Fake Email

Handian Sudianto 6,621

Hi..

We often receive email from fake sender, example my domain is @mydomain.com then our user get email from @mydomain.com but if we look more details the actual sender is example info@X .com <@mydomain.com)

Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-28T06:38:41.567+00:00

Hi @Handian Sudianto ，

Just circling back to check how things are going on with this thread. If the earlier replies were helpful, do you mind accepting it as answer so that it can be beneficial to others who read this thread as well? If you still have further concern on this, just feel free to post back.

Answer accepted by question author

0 additional answers

Your answer

Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-28T06:38:41.567+00:00

Hi @Handian Sudianto ，

Just circling back to check how things are going on with this thread. If the earlier replies were helpful, do you mind accepting it as answer so that it can be beneficial to others who read this thread as well? If you still have further concern on this, just feel free to post back.

Answer 1

Yuki Sun-MSFT 41,451 Moderator

Hi @Handian Sudianto ，

You could create a mail flow rule as follows which can help block this kind of domain spoof messages:

More details, hopefully you can find the article below helpful:
Domain Spoof Prevention in Exchange 2013/2016 & Microsoft 365
(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Handian Sudianto 6,621 Reputation points

2022-12-20T02:01:57.04+00:00

Hi @Yuki Sun-MSFT

since we using exchange online, what should we fill in sender ip address?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-20T02:12:58.453+00:00

Hi @Handian Sudianto ，

The exception part of the rule is intended to exclude any other external organizations that may need to send an email as if it is coming from your domain to your users, which is actually not related to your side. So you don't need to add the exception if you don't have this kind of external organizations. Fill this part would be enough:
Handian Sudianto 6,621 Reputation points

2022-12-20T02:19:13.297+00:00

hi @Yuki Sun-MSFT

what exactly mean of 'outside the organization'?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-20T02:44:25.923+00:00
Hi @Handian Sudianto ,

"A sender is considered to be outside the organization if either of the following conditions is true:

The sender's email address isn't in an accepted domain.

The sender's email address is in an accepted domain that's configured as an external relay domain."
See this link.

By the way, sorry for forgetting mentioning that when creating the rule, be sure to select "Header or envelope" under Match sender address in message so that it will examine senders in both the message header and the message envelope:
Handian Sudianto 6,621 Reputation points

2022-12-20T07:42:30.69+00:00

Hi @Yuki Sun-MSFT

if my domain is mydomain.com and you say 'outside the organization' is sender email address isn't in an accepted domain.
With this situation i already add mydomain.com in accepted domain, so this rule will never fired i think, am i right?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-20T08:40:11.767+00:00

Hi @Handian Sudianto ,

Adding mydomain.com as an accepted domain is right and necessary. Regarding the rule, as mentioned in my last reply, the rule will examine senders in both the message header and the message envelope, so per my understanding, the condition "the sender is located outside the organization" is meant to detect the real sender which is the fake one (info@X .com).
Handian Sudianto 6,621 Reputation points

2022-12-21T08:35:19.93+00:00

hi @Yuki Sun-MSFT

You say with this condition the rule will examine sender in both the message header end message envelope, are you sure about this since the filter is Header OR envelope?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-21T08:42:14.14+00:00

Hi @Handian Sudianto ,

Yes. See the explanation in this document.
Handian Sudianto 6,621 Reputation points

2022-12-21T08:47:42.037+00:00

Hi @bunniesfield

Lets say from is ******@mydomain.com and return path is info@X .com.
In the documentation say
Header will Only examine senders in the message headers (for example, the From, Sender, or Reply-To fields). This is the default value.
Envelope will Only examine senders from the message envelope (the MAIL FROM value that was used in the SMTP transmission, which is typically stored in the Return-Path field).

can you help me how to read this rule by word?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-21T08:57:11.42+00:00

Hi @Handian Sudianto ,

Since in the rule you created, "Header or Envelope" is selected, which means both header and envelope would be checked.

From the envelope, info@X .com matches the first condition, that is, the sender is located outside the organization.
From the header, ******@mydomain.com matches the second condition, the sender's domain is your domain.

Therefore, this mail matches both the rule condition and will be applied the rule action.
Handian Sudianto 6,621 Reputation points

2022-12-21T09:08:16.673+00:00

Hi @Yuki Sun-MSFT

Still confuse, Lets say from is ******@mydomain.com and return path is info@X .com.
1st rule is The sender is located outside the organization, which parameter will be checked on header and envelope? ******@mydomain.com or info@X .com?
ley say when do checking Header or envelope mydomain will be compare to header and envelope
sender in header is ******@mydomain.com since header will looking From, am i right?
sender in envelope is info@X .com since envelope will looking return path, am i right?

so this rule using AND operator and comparation between header and envelope will return true only in header and false in envelope so this rule will not work. Am i right?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-22T08:54:05.693+00:00

Hi @Handian Sudianto ,

Based on my understanding, both header and envelope would be examined when the rule does the comparation, and as long as either header or envelope is true, it will pass the check and returns true.

Lets say from is ******@mydomain.com and return path is info@X .com.

For the 1st rule condition, the sender is located outside the organization, both header(******@mydomain.com) and envelope(info@X .com) would be checked, and since envelop returns true which is already enough, the 1st condition returns true.

For the 2nd condition, the header (******@mydomain.com) is your domain, so this condition can return true as well. Thus the rule can work in this scenario.
Handian Sudianto 6,621 Reputation points

2022-12-22T09:04:03.853+00:00

hi @Yuki Sun-MSFT

So header checking will compare with 'from' and envelope will compare with 'return-path', am i right?
if from is ******@mydomain.com and return-path is info@X .com i agree the result of 1st condition is 'true'.
if the legitimate user ley say from is ******@mydomain.com and return-path is ******@mydomain.com, what about result of 1st condition, will be true or false?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-23T01:35:34.977+00:00

Hi @Handian Sudianto ,

So header checking will compare with 'from' and envelope will compare with 'return-path', am i right?

Yes.

if the legitimate user ley say from is ******@mydomain.com and return-path is ******@mydomain.com, what about result of 1st condition, will be true or false?

It will be false as ******@mydomain.com is inside the organization.
Handian Sudianto 6,621 Reputation points

2022-12-23T01:43:16.587+00:00

Hi @Yuki Sun-MSFT

1st condition say 'the sender is located outside the organization', so 'the sender' mean is 'Return-Path' and not 'From', am i rigth?

previously i give 2 example
from : ******@mydomain.com and return-path : info@X .com and 1st condition will be true because the sender (based on return-path) is outside the organization
from : me @mydomain.com and return-path : ******@mydomain.com and 1st condition will be false because the sender (based on return-path) is inside the organization
Am i right?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-23T03:24:13.107+00:00

Hi @Handian Sudianto ,

so 'the sender' mean is 'Return-Path' and not 'From', am i rigth?

As said earlier, my understanding is that both "Return-path" and "From" would be checked, as long as either one is true, it returns true.

from : ******@mydomain.com and return-path : info@X .com and 1st condition will be true because the sender (based on return-path) is outside the organization

Yes, it will be true but it's because although "From" is false, "return-path" is true, so, it's still true.

from : me @mydomain.com and return-path : ******@mydomain.com and 1st condition will be false because the sender (based on return-path) is inside the organization

Yes, it will be false because neither "From" nor "Return-path" is outside the organization.
Handian Sudianto 6,621 Reputation points

2022-12-23T03:38:29.707+00:00

Hi @Yuki Sun-MSFT

From this definition the header or envelope will examine sender in header AND the message enveloper.
The logical operator is AND, so 2 conditions should be true to get true in the result.

Your statement is 'as long as either one is true, it returns true' it that true with AND logic operator?
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-23T03:58:37.95+00:00

Hi @Handian Sudianto ,

I don't think they are contradictory. Yes, from the definition, both header AND the enveloper would be EXAMINED, but when the rule did the COMPARISON, it's not necessary that both of them are true.
Handian Sudianto 6,621 Reputation points

2022-12-23T04:15:35.85+00:00

Hi @Yuki Sun-MSFT

I still, confused :)
1st condition is the sender located outside the organization => this is based on From or Return-Path
2nd condition is the sender domain is mydomain.com => this is based on From or Return-Path
The sender examination based on header or Envelope

2 scenario :
1st from is ******@mydomain.com and return-path is info@X .com
2nd from is ******@mydomain.com and return-path is ******@mydomain.com

When the rule process 1st scenario the rule will examine the sender as ******@mydomain.com or info@X .com after do checking header or envelope? If the rule indicate the sender is ******@mydomain.com (the sender taken from From field) so 1st rule will be false since ******@mydomain.com is inside the organization and don't care about 2nd condition this rule will be false and not taken any action.
If the rule indicate the sender is info@X .com (the sender taken from return-path field) so 1st rule will be true since info@X .com is outside the organization and 2nd condition will be false since parameter 'the sender domain is' will be filled with @X .com and this rule will not take any action

When the rule process 2nd scenario the rule will examine the sender as ******@mydomain.com as from and return-path is same after. 1st condition will be false since this sender inside the organization and don't care about 2nd condition this rule will be false and not taken any action.

Hopefully you can make me more understanding about this rule.
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-23T04:33:02.49+00:00

Hi @Handian Sudianto

When the rule process 1st scenario the rule will examine the sender as ******@mydomain.com or info@X .com after do checking header or envelope?

Both ******@mydomain.com and info@X .com would be considered when the rule does the comparison. For the 1st condition, although ******@mydomain.com will return false, info@X .com can return true. False+True--> True, so it can proceed to the 2nd condition.
For the 2nd condition, still both ******@mydomain.com and info@X .com would be examined, ******@mydomain.com is true and info@X .com is false. True+False --> True, so both conditions are true and the rule will take action.

To put it simple, per my understanding, the rule uses OR operator when doing the condition comparison. Regarding the "AND operator" you mentioned above, it just means both header "and" envelop can be checked, it doesn't mean both of them need return true for the rule to fire. Also, it doesn't mean if return-path returns true for the 1st condition, header cannot be used when doing the comparison in the 2nd condition.

Feel free to let me know if there's anything unclear.
Handian Sudianto 6,621 Reputation points

2022-12-23T06:06:55.35+00:00

hi @Yuki Sun-MSFT

Great for explanation, now i understood. I will try to make this rule.
Yuki Sun-MSFT 41,451 Reputation points Moderator

2022-12-23T06:13:09.253+00:00

Hi @Handian Sudianto

Glad to hear that : )

Share via

Fake Email

0 additional answers

Your answer