Microsoft 365 (Exchange Online) Inbound Security Settings for DMARC

This article will provide some best practice configurations for MS365 Inbound Security Settings

Anti-Phishing Policy

1. Go to the above URL.
2. Create a new Anti-Phishing Policy or edit the default Anti-Phishing Policy with the priority rule of "Lowest".
3. Select an Anti-Phishing threshold for the Anti-Phishing engine.
4. Configure Anti-Phishing to protect the domains you own.
   
5. Enable Mailbox Intelligence and Intelligence for impersonation protection.
   
6. Enable Spoof Intelligence.
   
7. If a message is detected as a user impersonation Quarantine the message.
   
8. If a message is detected as a domain impersonation Quarantine the message.
   
9. If Mailbox intelligence detects an impersonated user Quarantine the message.
   
10. Select Honor the DMARC Policy and configure delivery as per your requirements. (We recommend Junk/Quarantine for DMARC Quarantine failures and Reject for DMARC Reject failures)
    
11. We recommend turning on all available Safety Tips and Indicators.
    

You will now have configured the MS365 Anti-Phishing policy to protect against impersonations and spoofs, while also telling MS365 how to handle DMARC failures.

Anti-Spam Policy

1. Go to the above URL.
2. Create a new Anti-Spam Policy or edit the default Anti-Spam Policy with the priority rule of "Lowest".
3. Turn the Backscatter protection feature on.
   

This feature will protect you from a "Backscatter" attack, where malicious actors will impersonate your domain, but due to your DMARC protection policy those emails will be rejected, flooding the attacked user with bounce-backs or NDR (non-delivery reports).

Need Help?