Exchange 2016 mail flow rule - which header is checked for "outside the organization"?

Question

Hello all,

I set up a mail flow rule in Exchange 2016 to prepend the subject of externally received emails with "external". While the rule seems to be working most of the time a user recently received an external (fraud) email which was not tagged according to the rule.

The rule is configured to be applied when "The Sender is located… Outside the organization".

Now I wonder which header field Exchange checks to determine if an email was sent from inside or outside the organization. Can anyone please shed a light?

Kind regards,
Klaus

Answer 1

Sure there isnt another rule stamping those based on some other criteria or another rule allowing those in - excluding some messages based on some other criteria that isfiring before your external disclaimer?

Answer 2

Yes, I'm sure about that. There is only one rule in our Exchange org that prepends [EXTERN] to the subject and at the same time prepends a disclaimer to the message body .

Only two more rules are active:
One is redirecting emails sent to one specific external recipient's address to an internal address.
The other deletes messages from a specific external address to a specific internal address when the subject exactly matches a certain string.