Domain Spoof Prevention in Exchange 2013/2016 & Microsoft 365

 Thank to: https://support.knowbe4.com/

Setting Up Domain Spoof Protection in Exchange 2013, Exchange 2016, or Microsoft 365

The following instructions will show you how to create a rule in Exchange 2013, Exchange 2016, or Microsoft 365 that will prevent your domain from being spoofed from outside your environment. However, this rule will not prevent a person from sending someone else outside your organization an email that looks like it comes from your organization.

This rule will accomplish the following:

1. Delete any inbound emails that originate from outside your organization which appear as if they are coming from your domain or inside your organization.
2. Allow emails from KnowBe4’s servers to bypass this rule so phishing tests can be conducted that look like they are coming from internal email accounts.

Important

In this process, we recommend setting up a rule to automatically delete messages that spoof your domain. This specific step can be modified to suit your organization's network and specific requirements. We strongly recommend you test this rule before implementing it.

 

Creating the New Rule

The below screenshots display a Microsoft 365 environment.

1. Log in to your Exchange or Microsoft 365 portal and go into the Admin> Exchange area.
   
2. Click on the mail flow section and then click the + sign in the right-hand area and select Create a new rule…
   
3. Give the rule a relevant name, such as Domain Spoof Prevention and then click on more options.
4. Select Apply this rule if… and then The sender is internal/external. Select the location to outside the organization.
5. Add a condition and then choose The sender's domain is and input your organization’s email domain(s).
6. Choose a reaction based on your security policies. If you would like to automatically delete messages which spoof your domain, choose Block the message then delete the message without notifying anyone.
7. Add an exception for KnowBe4 or any other external organization that may need to send an email as if it is coming from your domain to your users.
8. Choose Sender’s IP address is in any of these ranges or exactly matches… and fill in the IP Addresses of the external organization’s mail server.
   

   For the most up-to-date list of our IP addresses, please see this article. For more Whitelisting information, please see this article.

9. Under Match sender address in message and select Header or envelope.
   
10. Be sure to save your new rule once all settings match.