How to Handle Spam Sent to onmicrosoft.com Recipients
Question details
An organization receives recurring spam and spoofed messages sent from Gmail addresses targeting an onmicrosoft.com recipient.
- Product
- Microsoft 365 / Exchange Online
- Device & OS
- not provided
- Scenario
- Managing and mitigating persistent spam or phishing attacks.
- Observed behavior
- Despite reporting and deleting the messages, similar spam emails continue to arrive in the user's inbox.
Do not click any links, open any attachments, or reply to suspicious emails, as doing so verifies your email address to the spammers and increases the attacks.
Analyze Message Headers and Report Phishing
Identify the true source of spoofed emails by checking the message headers and report them to train your organization's spam filters.
Spammers frequently spoof legitimate domains like Gmail to bypass basic filters. Blocking the visible sender address may not be effective if the underlying sending server keeps changing. Analyzing the message headers allows you to find the true origin.
Open the suspicious email in Outlook. Click 'File' > 'Properties' and locate the 'Internet headers' box at the bottom.
Copy the header text and paste it into an online message header analyzer tool (like Microsoft's Remote Connectivity Analyzer) to determine the actual sender IP and routing information.
Use the built-in 'Report Message' add-in in your email client to officially report the email as Phishing or Junk to Microsoft. This helps improve backend filtering algorithms.
Configure Exchange Anti-Spam and Mail Flow Rules
Administrators can set up stricter spam filtering rules and block specific IPs in the Microsoft 365 Defender portal.
Looking for a Lightweight, Reliable Office Suite?
While you manage your organization's email security, you also need a dependable office suite for processing daily documents. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office.
Frequently Asked Questions
Why do I keep getting spam even after blocking the sender's email address?
Spammers often use a technique called 'spoofing' where they fake the 'From' address. Even if you block the visible email address, they can simply send the next email using a newly forged address. This is why reporting the email and blocking the actual sending IP is more effective.
What is an onmicrosoft.com domain?
The onmicrosoft.com domain is the default routing domain provided by Microsoft 365 when an organization sets up a new tenant. It acts as a fallback and routing address for Exchange Online mailboxes behind the scenes.
How do I safely share a spam email with IT support for analysis?
Instead of forwarding the email normally (which strips crucial header information and can trigger spam filters), save the email as an attachment (.msg or .eml file) or copy the internet headers and share those securely with your IT department.
