Don’t Disable this if you use Azure Email Communication

EmailEvents
|where Timestamp > ago(7d)
|where EmailDirection == 'Inbound' and Connectors == '' and isnotempty(SenderIPv4) and SenderMailFromDomain == "domain.com.au" and SenderFromDomain == "domain.com.au"

Set-OrganizationConfig -RejectDirectSend $true

We do something similar, but it works like this:

• IF a message is “from” an internal domain (header or envelope”)
• AND IF the message recipient is internal to the organization
• AND IF the “Authentication-Results” header includes (“spf=fail” OR “spf=softfail” AND dkim=none)
• Then take some action on the message (e.g., quarantine or reject)