EOP can be used for sending email by anonymous user

Question

EOP can be used for sending email by anonymous user

Ardan Zaki 236

Feb 6, 2024, 2:12 AM

Hi all, I just found this discovery where my EOP can be used for sending email by anonymous. I'm using smtp test by DNS Checker. I used a made up email address. Screenshot 2024-02-06 084738 And the message is sent. Screenshot 2024-02-06 090924

How can I prevent this?

1 answer

Your answer

Answer 1

Kael Yao-MSFT 37,721 Microsoft External Staff

Feb 6, 2024, 6:12 AM

Hi @Ardan Zaki

Please note that this is like you are sending from a mail server to EOP, it is expected that as an external sender you are anonymous to EOP.

If you want to send as an authenticated sender you need to authenticate with your credentials in Azure AD (in other words only internal users can authenticate).

If you check the message header, you will see Received: from dnschecker.org and the domain in message-ID is dnschecker.org, which indicates the message is originated from dnchecker.org.

Hope it answers your question.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Ardan Zaki 236 Reputation points

Feb 6, 2024, 8:19 AM

The problem is, I can also fill the "email from" with any name in my domain also without any authentication, which means there is possibility to get impersonated.

I'm aware that the header is giving the explanation where it comes from, but the recipient is the same as we fill the form in dnschecker, what if someone can customize the header, that would be chance for phising message.

How can we prevent that?
Ardan Zaki 236 Reputation points

Feb 6, 2024, 8:26 AM

I'm aware that the header give the description of where the email sent from. But what if someone fill the "email from" with my domain and can change the header, that would be a chance for phising/impersonation. for example, my domain name is tech.com in dnschecker we can fill the email from with "******@tech.com" and send to one user in tech.com , what if someone can change the header and make it seems like it sent from trusted account. How can I prevent that?
Kael Yao-MSFT 37,721 Reputation points Microsoft External Staff

Feb 6, 2024, 8:27 AM

EOP will check SPF/DKIM/DMARC, combined with sender reputation and other factors to determine whether the email is spam or not. Please make sure you have setup SPF/DKIM/DMARC for your domain.
Ardan Zaki 236 Reputation points

Feb 6, 2024, 8:31 AM

Is there any option to require authentication when someone want to send email with our domain?
Ardan Zaki 236 Reputation points

Feb 6, 2024, 8:33 AM

is there any option to require authentication when someone attemp to send email by our domain?
Kael Yao-MSFT 37,721 Reputation points Microsoft External Staff

Feb 6, 2024, 8:53 AM

No it is not possible.

But you can use other methods to reject the phishing emails sent to your tenant.

For example, create a mail flow rule like:

For phishing mails sent to other recipients like Gmail, please setup SPF/DKIM/DMARC records for your domain as these are used to prove you are an authorized sender from your domain.

Other email service will also determine whether the emails are legal by these records.
Kael Yao-MSFT 37,721 Reputation points Microsoft External Staff

Feb 7, 2024, 12:26 AM

Hi @Ardan Zaki Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
Kael Yao-MSFT 37,721 Reputation points Microsoft External Staff

Feb 9, 2024, 6:31 AM

Hi @Ardan Zaki Are there any updates on this issue? If the question has been answered, please accept the helpful reply as the answer to the question to help other community members. Thanks for your understanding.

AI Skills Fest

Share via

EOP can be used for sending email by anonymous user

1 answer

Your answer