Can Microsoft 365 warn us about email from a look-alike of our domain?

Why does a look-alike get past ordinary checks?

An impersonated domain might otherwise be considered legitimate (the domain is registered, email authentication DNS records are configured, etc.), except the intent of the domain is to deceive recipients.

Microsoft says an impersonating domain can look legitimate in every technical way, registered and with email authentication records in place, and still be meant to deceive.

Checks that look for forged mail in your own name do not catch it, because the look-alike is not forging your domain. It is a different domain that passes its own checks.

Which setting covers it?

The impersonation settings for user impersonation protection , domain impersonation protection , mailbox intelligence , impersonation safety tips , and trusted senders and domains are available only in anti-phishing policies in Defender for Office 365.

In Microsoft 365, user and domain impersonation protection are only in the anti-phishing policies of Defender for Office 365, and the default policy does not turn them on.

Domain impersonation protection can cover all the domains your firm owns, and other domains you name, such as a bank or a client you pay often.

You can list up to 50 custom domains for domain impersonation protection in each anti-phishing policy.

How do I turn it on?

You can specify a maximum of 50 custom domains for domain impersonation protection in each anti-phishing policy.

1. In the Microsoft Defender portal, open the anti-phishing policies.
2. Edit the default policy or create one for the people who handle payments.
3. Turn on domain impersonation protection and include the domains you own.
4. Add the outside domains you send money to or receive instructions from.
5. Choose to quarantine or move flagged messages, and turn on the impersonation safety tips.