{"id":7891,"date":"2024-05-15T22:54:25","date_gmt":"2024-05-15T22:54:25","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=7891"},"modified":"2024-05-17T08:50:58","modified_gmt":"2024-05-17T08:50:58","slug":"message-from-internal-domain-made-it-through-antiphish-protection-in-defender-due-to-header-from","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/message-from-internal-domain-made-it-through-antiphish-protection-in-defender-due-to-header-from","title":{"rendered":"Message from Internal Domain made it through AntiPhish Protection in Defender due to Header From"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Mail From (<\/strong>envelope-from <@gator4212.hostgator.com<\/a>>) ( RFC5321.MailFrom ) <\/p>\n\n\n\n

Header From <\/strong>From: CEO Name <ceo@domain.com>( RFC5322.From ) <\/p>\n\n\n\n

Reply-To: CEO Name  <edkl@gmail.com><\/p>\n\n\n\n

SPF and DKIM only apply on Mail From ( Not header from ) so it passed through DKIM and SPF Protection<\/strong><\/p>\n\n\n\n

Authentication-Results: spf=pass (sender IP is 44.202.169.33)<\/p>\n\n\n\n

 smtp.mailfrom=gator4212.hostgator.com; dkim=pass (signature was verified)<\/p>\n\n\n\n

 header.d=hellowonder.co;dmarc=fail action=none<\/p>\n\n\n\n

 header.from=domain.com;compauth=fail reason=601<\/p>\n\n\n\n

DMARC<\/strong>: Set up DMARC to validate the From address domain for senders in Microsoft 365<\/a>, DMARC uses SPF and DKIM to check for alignment between the domains in the MAIL FROM and From addresses<\/strong>. DMARC also specifies the action that the destination email system should take on messages that fail DMARC, and identifies where to send DMARC results (both pass and fail).<\/p>\n\n\n\n

<\/p>\n\n\n\n

    \n
  1. Look to enable Dmarc in Fail Mode ( Not None ) <\/li>\n\n\n\n
  2. We have increased the Anti Phishing Threshold in Defender from 2 to 3<\/li>\n\n\n\n
  3. Make sure all important accounts are added to Impersonation Users in Defender Anti Phish Policy<\/li>\n\n\n\n
  4. We have created a Rule in Exchange to Delete any emails with\u00a0Header From<\/strong>\u00a0CEO outside the organisation\u00a0 ( Can also try ‘Authentication-Results’ header contains ”compauth=fail reason=601” ) <\/li>\n<\/ol>\n\n\n\n
    \"\"<\/a><\/figure>\n\n\n\n
      \n
    1. We have created an Audit Rule in exchange with Header From <\/strong>emails domain.com so we can whitelist any legitimate emails before we turn this rule to delete<\/li>\n<\/ol>\n\n\n\n
      \"\"<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"

      Mail From (envelope-from <@gator4212.hostgator.com>) ( RFC5321.MailFrom ) Header From From: CEO Name <ceo@domain.com>( RFC5322.From ) Reply-To: CEO Name  <edkl@gmail.com> SPF and DKIM only apply on Mail From ( Not header […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-7891","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/7891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=7891"}],"version-history":[{"count":3,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/7891\/revisions"}],"predecessor-version":[{"id":7903,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/7891\/revisions\/7903"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=7891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=7891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=7891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}