You can also look at Microsoft’s documentation for SPF, DKIM, and DMARC. The first and most obvious step is to review and fix your SPF, DKIM, and DMARC records. But it’s out there now, so what do we do about it? This change is one of those “good idea, bad execution” situations that could have been handled a lot better from a communication perspective. If you don't want to viewed suspiciously by your 365 friends, get your DMARC/SPF/DKIM house in order! #office365 #EOP #ATP customers at #Office365 now get cloud scale detection protection based on historical sending patterns of their external senders If you don't publish your #SPF or #DMARC records then prepare to get your emails marked as spoofsĭomains with poor email sender authentication (no or inaccurate SPF/DMARC) are being used by spoofers to try and get past current email filters. A recent surge in spoof based attacks means protection has been updated again. #Office365 antispoofing protection in Exchange Online is always been improved. Some tweets from my fellow MVPs explain what’s happening. The reference to “policies” in the roadmap post likely mean there will be admin controls released for this behavior in the near future.

However, there’s no public documentation or other announcements available to let customers know what to do about it. You’ll notice that the roadmap item was just added in the last 24 hours, and was immediately listed as “rolling out”. Anti-phishing policies look for lookalike domains and senders, whereas anti-spoofing is more concerned with domain authentication (SPF, DMARC, and DKIM). The anti-spoof capabilities referred to in that roadmap item are different, but related to, the ATP anti-phishing policies I wrote about recently here. This commonality wasn’t immediately obvious until some background discussions in the last 24 hours, and the posting of this Office roadmap item. The common element of each customer where I’ve seen this happening is that they have Office 365 ATP licenses in their tenant. The same advice applies here too, but it’s a little more complicated now, as you’ll see below. The solution then was to fix your SPF records.

I’ve previously written about this safety tip here. This sender failed our fraud detection checks and may not be who they appear to be. The junked emails have a safety tip inserted by EOP that says:

I’m personally seeing the same high rate of false positives, as are some of my customers. Noticed an increase in legitimate email going to the junk mail folder lately? You’re not alone.Īnyone seeing high volumes of legitimate email on go straight to the junk folder today? We're getting a lot of support calls about this.

Microsoft spam filter not working well