Look-alike domains · External sender tag

Does an "External" tag help against look-alike domains?

Yes: a look-alike of your own domain is an outside sender, so the tag shows on it even when the name looks like a colleague's.

Last read from the sources at the foot of this page.

Check my firm Read the steps
01

Why does the tag matter for look-alikes?

If your organization already uses mail flow rules (also known as transport rules) to add text to the subject line of messages from external senders, you should disable those rules before you enable this feature to avoid duplication.

A message from yourfirm-billing.example may carry a colleague's name and your logo. It still comes from outside your firm, and the tag says so before anyone acts on it.

02

How does it work in Outlook?

After an admin enables this setting, it can take between 24 and 48 hours for users to see the External icon in messages from external senders in supported versions of Outlook.

In Exchange Online, the Set-ExternalInOutlook setting adds an External icon to messages from outside senders, and Microsoft says it can take 24 to 48 hours after an admin turns it on before people see it.

If you already add text such as [EXTERNAL] to subject lines with a mail flow rule, Microsoft says to turn that rule off before turning this on, to avoid two tags.

  1. In Exchange Online PowerShell, run Set-ExternalInOutlook with Enabled set to true.
  2. Keep the allow list short.Senders on it get no tag.
03

How does it work in Gmail?

External recipient warnings are on by default.

Gmail's external recipient warnings are on by default and show when someone replies to an outside sender or writes to an outside address.

Gmail does not show the warning for people in your directory or contacts, so remove a contact that turns out to be a look-alike.

  1. In the Google Admin console, go to Apps, Google Workspace, Gmail, End User Access.
  2. Check that 'Warn for external recipients' is on.
Sources

Where does this come from?

Related
05 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy