Spam emails blocked on exchange 2016 and Sophos

Question

Dear Helpers,

I have an issue. I have Exchanger 2016 and Sophos Spam blocker. Some spam user from gmail send mails to our workers (domain email) with different worker names. Like boss@Stuff .com and name with alice bible. So our employees continue write out spam emails. I already blocked this user. So my questions is that how i blocke these @Stuff spam emails. when i check sender IP, its always Gmail server IP. I already make a rule in Exchange server for blocking, but still with new spams comes to our server with employee names. If you have suggestion, please share with me. Thanks

Answer 1

Yea, thats the tough part, there is no real solution with Exchange itself. You could create transport rules, but that would be very difficult to manage for multiple users and probably not really be effective since you would have to account for every variation.

Third party software is really what should be used:

EOP/ ATP can do this:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide

Answer 2

Exchange itself is not very good at this and has really basic settings. Can you adjust the Sophos product in anyway to look for spoofing and check DMARC passing and SPF records?

Answer 3

So these are spoofing the display names of actual users with a gmail.com address? If so, thats going to be almost impossible to block without third party software or using EOP/ATP with Microsoft.

Users can set their junk mail settings to Safe Senders Only and that would help at least.