AW: Quarantine From Header differ From Body

[Mark Sapiro]

On 11/28/2017 11:26 PM, Braun, Thomas [WEKAL] wrote:
> 
> we get phishing Mails where supposedly our own employees write another one, want him to click a link. Not all of our employees are clever enough to check this.
> I am searching for a solution to filter mails with a visible
> From: "MyKnownFellow <fellow at mycompany>" and an invisible envelope <hackedbox at othercompany>
> 
> Those mails getting more and more lately. And they even fake our signature and having better grammar. So it is hard to spot.
> Perhaps there is a better way...


This is exactly what DMARC is for. See <https://dmarc.org/>.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan