How do I block spoofed email from external sender

DARAdmin 0

How do I block spoofed email. I continue to get emails to my user with their name as the sender.

I have SPF, DKIM and DMARC set up. MS seems to be ignoring them.

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2025-11-24T23:52:20.6866667+00:00
Hello,
Here are some troubleshooting steps that you can try.

Verify DMARC Enforcement

Ensure your DNS DMARC record uses p=reject or p=quarantine.

In Microsoft 365, confirm Honor DMARC policy is enabled in Anti-Phishing policies.

Enable Advanced Anti-Spoofing

Turn on Microsoft Defender for Office 365 Anti-Phishing policies.

Configure rules to block:

Domain spoofing

Display-name impersonation

Use Spoof Intelligence

Go to Microsoft 365 Security & Compliance → Email & Collaboration → Spoof Intelligence.

Review detected spoofed senders:

Block malicious spoofed senders

Allow legitimate SaaS senders (to avoid false positives)

Configure Tenant Allow/Block Lists

Navigate to Policies & Rules → Threat Policies → Tenant Allow/Block Lists.

Add spoofed domains or email addresses to Block for persistent protection.

Monitor Spoof Reports

Use Spoof detections report in Microsoft 365 Security.

Track spoof attempts and policy effectiveness by filtering:

Result codes (Pass, Fail, SoftPass)

Spoof type (internal/external)

Extra Hardening

Enable Safe Links and Safe Attachments in Defender for Office 365.

Consider Conditional Access for sensitive accounts.

Regularly audit Tenant Allow/Block Lists and Spoof Intelligence overrides.

Your answer