This article describes the steps for setting up a mail flow rule that detects spoofed emails, prepends a warning and redirects the message.
Warn users that an email is from outside of your organization and they should only click on links from a trusted source.
Create a mail flow rule that prepends a warning to the subject line of an email where user impersonation is being used and redirects the email.
Outlines steps for troubleshooting a spoofing incident.
This article gives you step by step instructions on how to enable DKIM within your Office 365 tenant.