Back to Documentation
Securing Office 365 with Defender

Configure Spoof Intelligence and Anti-Spoofing Protection in Microsoft 365

Overview

Spoofing attacks occur when attackers forge the sender address to make an email appear as if it came from a trusted domain or internal user. These attacks are commonly used in:

  • Business Email Compromise (BEC)
  • CEO fraud
  • Vendor payment redirection scams
  • Brand impersonation campaigns

Microsoft 365 includes Spoof Intelligence and Anti-Spoofing Protection within Defender for Office 365 to detect and manage spoofed senders.

If you are searching for:

  • Spoof intelligence Office 365
  • Prevent spoofed emails Microsoft 365

This guide explains how spoof detection works, how to configure allow/block decisions, and how authentication standards like SPF, DKIM, and DMARC interact with spoof protection.

Why Spoof Intelligence Is Important

Spoofing attacks can bypass basic spam filters because:

  • The sender address appears legitimate.
  • Display names mimic internal executives.
  • Attackers may use lookalike or compromised domains.

Spoof Intelligence helps:

  • Detect forged sender domains.
  • Identify impersonation attempts.
  • Provide visibility into spoofing activity.
  • Allow administrators to take allow or block actions.

Proper configuration reduces brand impersonation and domain abuse risks.

Licensing Requirements

Spoof Intelligence is available in:

  • Microsoft Defender for Office 365 Plan 1
  • Microsoft Defender for Office 365 Plan 2
  • Microsoft 365 Business Premium
  • Microsoft 365 E5

Basic anti-spoofing protections exist in Exchange Online Protection (EOP), but advanced spoof intelligence and visibility require Defender for Office 365.

How Spoof Detection Works

Microsoft evaluates:

  • SPF authentication results
  • DKIM signature validation
  • DMARC policy alignment
  • Historical sender behavior
  • Domain reputation

When inconsistencies are detected, messages may be flagged as spoofed.

  1. Go to Microsoft 365 Defender Portal
    https://security.microsoft.com

  2. Navigate to:
    Email & Collaboration → Policies & Rules → Threat Policies → Anti-Phishing

  3. Select Spoof Intelligence

You will see detected spoofed senders and domains.

Spoofed Sender Detection

What It Detects

Spoof Intelligence identifies:

  • External senders pretending to be internal users
  • Messages failing DMARC alignment
  • Domains sending unauthenticated mail
  • Lookalike domains targeting your organization

Review Detected Senders

In the Spoof Intelligence dashboard:

  • Review detected spoofing attempts
  • Check authentication results
  • Evaluate sender behavior

Always analyze headers before making allow decisions.

Allow / Block Decisions

Administrators can:

  • Allow a spoofed sender (if legitimate)
  • Block a spoofed sender or domain

When to Allow

Allow only if:

  • You have verified legitimate business need
  • Authentication misalignment is expected (e.g., third-party services)
  • Domain ownership is confirmed

When to Block

Block if:

  • The domain is impersonating internal users
  • DMARC fails and sender is unauthorized
  • Pattern suggests phishing activity

Avoid blindly allowing spoofed senders without investigation.

Authentication Results: SPF, DKIM, and DMARC Interaction

Spoof protection relies heavily on email authentication.

SPF (Sender Policy Framework)

Validates whether the sending IP address is authorized to send email for the domain.

If SPF fails:

  • Message may be flagged as spoofed.

DKIM (DomainKeys Identified Mail)

Uses cryptographic signatures to verify message integrity and domain ownership.

If DKIM fails:

  • Message authenticity is questioned.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Builds on SPF and DKIM to enforce domain alignment policies.

DMARC policies:

  • p=none (monitoring only)
  • p=quarantine
  • p=reject

Strong DMARC enforcement significantly reduces spoofing success.

For detailed DKIM configuration, see the "How to?" documentation section.

Best Practices for Anti-Spoofing Protection

  • Enable DKIM for all accepted domains.
  • Implement DMARC with enforcement (quarantine or reject).
  • Regularly review spoof intelligence dashboard.
  • Protect high-risk users using Anti-Phishing policies.
  • Avoid excessive allow-list entries.

Spoof Intelligence works best when authentication is properly configured.

Common Misconfigurations

  • DKIM not enabled for custom domains.
  • DMARC set to monitoring only (p=none).
  • Allowing spoofed senders without validation.
  • Ignoring spoof intelligence alerts.
  • Not reviewing third-party senders for proper SPF alignment.

Monitoring and Investigation

Security analysts should monitor:

  • Spoof intelligence dashboard
  • Threat Explorer (Plan 2)
  • Quarantine reports
  • Message trace results

Investigate:

  • Authentication failures
  • Repeated spoof attempts
  • Targeted executive impersonation

Limitations to Understand

  • Spoof protection depends on proper DNS authentication.
  • Misconfigured SPF/DKIM/DMARC weakens detection.
  • Compromised legitimate accounts are not prevented by spoof controls.
  • Display name impersonation may still occur if not covered by anti-phishing policies.

A layered security strategy combining authentication, anti-phishing, Safe Links, and Safe Attachments provides stronger protection.

Frequently Asked Questions

What is the difference between spoofing and phishing?
Spoofing involves forging the sender address. Phishing is a broader attack that may include spoofing plus malicious links or attachments.

Does DMARC prevent spoofing completely?
DMARC significantly reduces spoofing when properly enforced (quarantine or reject), but must be combined with SPF and DKIM.

Can internal users spoof each other?
Internal spoofing is typically blocked, but misconfigured connectors or relays may allow it. Review mail flow settings.

Is Spoof Intelligence enabled by default?
Basic protections exist, but administrators should review and configure spoof intelligence settings explicitly.

Should I allow third-party senders that fail DMARC?
Only after verifying legitimate business purpose and updating SPF/DKIM configuration if necessary.

Summary

Spoof Intelligence and Anti-Spoofing Protection in Microsoft 365 help prevent domain spoofing and brand impersonation attacks.

To secure your environment:

  • Enable and review Spoof Intelligence regularly
  • Configure SPF, DKIM, and DMARC properly
  • Make informed allow/block decisions
  • Monitor impersonation activity

Proper email authentication combined with spoof intelligence significantly reduces the risk of Business Email Compromise and brand abuse.