efa-project.org

How can I make the system put a notification at the top of each email that will let them know that the email originated outside of their email server.
I am trying to combat spoofed emails that look like they are coming from other employees of the same company.

Usually I would do this with transport rules on exchange but with this hosting provider it is not available. This is a stop gap until I get the 298 email addresses moved from this provider

MailScanner cannot prepend the body of an email, only add a footer.

Instead, why not modify the subject with [EXTERNAL], perhaps? Not sure how to go about this without a little research, but MailScanner can modify the subject line.

Why not just do this the right way and use an SPF record.

ASEsysadmin wrote: ↑01 Mar 2019 17:44 Why not just do this the right way and use an SPF record.

SPF does nothing to prevent spoofed names

The way I handled this with my in-house Exchange server was with a server-side rule. There were only a few employees being spoofed (one of which was the CEO) so the rule says if the email comes from outside the organization with the FROM header having certain values (names of employees) then delete the message. If you have a large number of employees to add to this rule it might get unwieldy, but I can dig up the exact rule settings if you think it would help.

As an org-wide rule, you could tweak it to say if an email originates from outside the organization add {External} to the subject, or something like that.