How to Create an Exchange Rule to Block External Impersonation Emails
Question details
The organization needs to identify and block external emails that attempt to impersonate internal users by matching their display names.
- Product
- Microsoft Exchange
- Device & OS
- not provided
- Scenario
- Administrators are setting up mail flow rules to enhance email security and prevent phishing attacks from external senders.
- Observed behavior
- Attackers send malicious messages from external addresses using display names that match protected internal employees, bypassing standard filters.
Ensure you have administrator credentials and access to the Exchange Admin Center (EAC) with the necessary permissions to create and manage mail flow rules.
Create a Mail Flow Rule in Exchange Admin Center
Configure a custom rule to detect incoming emails originating outside the organization that use display names matching internal users.
While this rule is highly effective for basic spoofing attempts, be aware that attackers frequently vary display names and sender addresses. This manual rule serves as an excellent foundational layer of security.
Log in to the Exchange Admin Center (EAC) using your organizational administrator account.
In the left-hand navigation pane, select 'Mail flow' and then click on 'Rules'.
Click the '+' icon to add a new rule and assign it a descriptive name, such as 'Block External Impersonation'.
Under 'Apply this rule if', configure the condition to trigger when the sender is located 'Outside the organization'.
Add a second condition to check whether the sender's display name or email address matches your protected internal users.
Under 'Do the following', select 'Quarantine the message' or 'Reject the message with the explanation', depending on your company's security policy, then save the rule.
Looking for a Free, Secure Office Alternative?
While securing your email server requires Microsoft Exchange administrative tools, your organization may also be searching for a cost-effective, secure desktop productivity suite. WPS Office is a highly compatible, lightweight, and free alternative to Microsoft Office.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded installation file and follow the simple on-screen prompts to complete the setup.
- 3. Open and Edit Documents: Launch the application to seamlessly open, edit, and save your existing Microsoft Office files without any formatting issues.
Frequently Asked Questions
Why is display-name matching alone insufficient for complete impersonation protection?
Attackers often make subtle variations to display names (like using a zero instead of the letter 'O') or use look-alike domains. A static mail flow rule checking for exact matches may miss these sophisticated techniques.
Can I test the mail flow rule before enforcing it across the organization?
Yes. When setting up the rule in the Exchange Admin Center, you can choose the 'Test without Policy Tips' or 'Test with Policy Tips' mode. This allows you to monitor the rule's impact in message traces before actively blocking or quarantining emails.
What is the difference between an Exchange mail flow rule and Microsoft Defender Anti-phishing?
An Exchange mail flow rule relies on static, manually defined conditions like exact name matches. Microsoft Defender for Office 365 uses machine learning and dynamic algorithms to automatically detect anomalies, advanced spoofing, and impersonation attempts without manual continuous updating.
