How to Create a Mail Flow Rule that Redirects Spoofed Emails with Prepended Message

Here are the instructions for setting up a mail flow rule for detecting spoofed messages and redirecting them.

1. Login to Exchange Online (https://outlook.office365.com/ecp/)
2. Click on mail flow > rules
3. From the dropdown next to the ‘+’ icon select ‘Create a new rule’
4. Click on ‘More options…’
5. Enter a name in the ‘Name:’ field
6. Under ‘*Apply this rule if..’ select ‘is external/internal’
7. In the popup select ‘Outside the organization’ and click ‘OK’
8. Click the ‘add condition’ button
9. Mouse over ‘The sender’ and select ‘domain is’
10. In the popup window enter your domain and click the ‘+’ button and then click ‘OK’
11. Under ‘*Do the following’ mouse over ‘Apply a disclaimer to the message…’ and select ‘prepend a disclaimer’.
12. Click on the ‘Enter text…’ link and copy in the HTML code found below:
13. Click on the ‘Select one…’ link and select ‘Wrap’ and then ‘OK’
14. Click on the ‘add action’ button.
15. From the dropdown mouse over ‘Redirect the message to…’ and select ‘these recipients’
16. From the popup window select the recipients who will receive the redirected message and click ‘OK’.
17. Add exceptions as needed.
    1. It may be the case that there are legitimate 3^rd party tools that are spoofing from your domain on your behalf. These exceptions can be added here.
18. Under ‘Choose a mode for the rule:’ select ‘Enforce’
19. Adjust the activation and deactivation dates/times as desired or leave as default.
20. Click ‘Save’

Once the rule is saved it will be toggled on. The rule can be toggled off by unchecking the checkbox in the ‘ON’ column in the list of mail flow rules.

HTML Code: