How to prevent internal email spoofing in my Exchange organization?

Question

Recently, some employees of my organization received couple of phishing email from internal email addresses. I found out that spoofed messages may originate from someone or somewhere other than the actual address. However, they thought that they had to click on the link which hacker sent since the sender is valid. However, I could see any solution to prevent these dangerous emails. Please let me know if I should configure something in Exchange Server to block this kind of threat.

Answer 1

What are you using for anti-spam? Thats where this should really be handled. Third party or 365/EOP is much better than trying to do this with Exchange or using the built-in anti-spam features.

Otherwise, I would create a transport rule and block the messages that way. Be sure to exclude any IPs of sending servers that may be allowed to send as your domain..https://support.knowbe4.com/hc/en-us/articles/212679977-Domain-Spoof-Prevention-in-Exchange-2013-2016-Office-365

You should also have a valid SPF record at minimum (DKIM and DMARC even better) and you can checking for that with your anti-spam solution.

Answer 2

See if this article helps: https://www.codetwo.com/admins-blog/how-to-prevent-internal-email-spoofing-in-exchange/. It shows how to prevent email spoofing in an Exchange organization.