What Does 'Outside the Organization' Mean in Office 365 Mail Flow Rules?
Question details
The user wants to understand why an Office 365 mail flow rule designed to warn about external messages failed to flag a phishing email spoofing their domain, and how the system defines 'Outside the organization'.
- Product
- Office 365
- Device & OS
- not provided
- Scenario
- Setting up Exchange mail flow rules to flag external emails and protect users from phishing attempts.
- Observed behavior
- The external sender warning rule did not trigger on a spoofed email because the 'Outside the organization' condition only checks the sender domain rather than verifying the sender's authenticity.
Before modifying your Exchange Online settings, ensure you have Exchange Administrator privileges in your Microsoft 365 tenant to access and edit threat policies and mail flow rules.
Configure Anti-Phishing Policies and Spoof Intelligence
Since the 'Outside the organization' condition does not verify sender authenticity, you must configure dedicated anti-phishing policies to properly identify and block spoofed domains.
In Office 365, a sender is considered 'outside the organization' only if their address is not in an accepted domain, or if it belongs to an external relay domain. This condition does not evaluate the Message-ID or verify authentication protocols (like SPF, DKIM, or DMARC). As a result, if an attacker spoofs your own accepted domain, the mail flow rule will treat the message as internal and bypass external warnings.
Log in to the Microsoft 365 Defender portal using your administrator credentials.
Go to 'Email & Collaboration' in the left-hand navigation menu, select 'Policies & Rules', and then click on 'Threat policies'.
Select 'Anti-phishing' and either create a new policy or edit your existing default policy.
Ensure that 'Enable spoof intelligence' is turned on so Microsoft 365 can automatically filter messages from senders who fail authentication.
In the safety tips section of the policy, enable 'Show first contact safety tip' and 'Unauthenticated sender indicators' to display a question mark (?) in Outlook for senders who fail SPF or DKIM checks.
Enhance Your Daily Productivity with WPS Office
While securing your organization's email server requires Microsoft 365 administrator tools, managing your daily documents does not have to be complicated or expensive. WPS Office provides a free, lightweight, and highly compatible alternative for your word processing, spreadsheet, and presentation needs.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the on-screen prompts to set up the software in just a few clicks.
- 3. Open Your Documents: Launch WPS Office and instantly open, edit, or save your existing Microsoft Word, Excel, and PowerPoint files.
Frequently Asked Questions
Why did a spoofed email bypass my external sender warning in Office 365?
Spoofed emails typically forge your organization's own domain in the 'From' address. If your domain is configured as an accepted domain in Office 365, the mail flow rule views the sender as internal, meaning the 'Outside the organization' condition is not met and the warning is bypassed.
How exactly does Office 365 determine if a sender is internal or external?
Office 365 considers a sender internal if their email address belongs to one of your tenant's accepted domains, provided that domain is not configured as an external relay domain. Any domain not listed in your accepted domains is considered external.
Can I use mail flow rules to block all spoofed emails?
It is highly discouraged to rely on basic mail flow rules for spoofing protection. Basic rules cannot process complex SPF, DKIM, and DMARC authentication results accurately. You should use Microsoft 365's built-in Anti-phishing policies and Spoof intelligence features instead.
