Microsoft counted roughly 129 million malicious emails last quarter that didn't just fake a familiar name — they claimed a real company's sending domain as their own.
Here's the part that should bother you: plenty of them landed in inboxes anyway. Not because the filter missed them. Because someone inside the tenant had set up an exception that overrode the block, even after the message already failed its authentication checks.
I see this in law offices constantly. Two years ago a signing request wouldn't come through, so somebody allow-listed the sender to get the closing done. Nobody ever took the rule back out. Now anything wearing that costume walks straight past the guard — and in September, DocuSign accounted for 29% of the spoofed business-service brands Microsoft tracked. A fake signature request is a very believable thing to send a law firm.
SPF, DKIM and DMARC are three DNS records that let a receiving mail server prove a message really came from your domain, and tell it what to do when one didn't. Not glamorous. They're also the difference between a client getting a convincing wire-change email "from you" and that email dying before anyone reads it.
Two things worth doing this month: confirm all three records exist on your domain, and pull the list of every allow rule in your tenant. The second one is usually the uglier surprise.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email