How to Stop Legitimate Emails from Going to Junk Due to Impersonation Detection
Question details
Prevent legitimate external emails from being routed to the Junk folder because of false-positive impersonation detection.
- Product
- Microsoft Defender
- Device & OS
- not provided
- Scenario
- Legitimate external emails are marked as phishing and sent to Junk despite passing standard SPF, DKIM, and DMARC authentication checks.
- Observed behavior
- Messages are flagged by mailbox intelligence impersonation protection because the external sender's display name matches an internal user's display name.
Before adjusting your security policies, verify that the external sender's domain has passed standard authentication checks (SPF, DKIM, and DMARC) and confirm that the messages are truly legitimate.
Adjust Microsoft Defender Anti-Phishing Policies
Add trusted senders or domains to the impersonation protection bypass list in the Microsoft Defender portal to fix the issue globally.
By modifying the anti-phishing policy at the tenant level, administrators can prevent impersonation detection from mistakenly flagging trusted external partners whose display names match internal users.
Log in to the Microsoft 365 Defender portal, navigate to 'Policies & rules', and select 'Threat policies'.
Click on 'Anti-phishing' and choose the active policy that applies to your users to open its configuration pane.
Scroll to the impersonation protection settings and add the legitimate external sender's email address or domain to the list of trusted senders and domains.
Save the updated policy to ensure future messages from this sender bypass the impersonation filter.
Train Mailbox Intelligence Manually (Client-Side)
Individual recipients can manually train the system by moving the email and adding the sender to their Safe Senders list.
Looking for a Lightweight and Free Productivity Suite?
While enterprise solutions offer extensive security features, dealing with complex policies can be overwhelming for simple tasks. If you need a straightforward, lightweight, and highly compatible office suite for creating documents, spreadsheets, and presentations without the administrative hassle, WPS Office is an excellent free alternative.
Frequently Asked Questions
Why do emails go to Junk even if SPF, DKIM, and DMARC pass?
Security systems use impersonation protection that flags emails if the sender's display name matches someone inside your organization or a familiar contact, regardless of whether standard domain authentication checks pass.
What is mailbox intelligence in email security?
Mailbox intelligence analyzes user communication habits to build a graph of frequent contacts. It helps identify anomalies, such as first-time senders using familiar display names, which can trigger anti-phishing alerts.
Do all users need to whitelist the sender manually to stop emails going to junk?
If the issue is not fixed globally via the central anti-phishing policy portal, each recipient will need to manually move the first message from Junk to Inbox and add the sender to their Safe Senders list to train the mailbox intelligence system.
