Tagging External Messages

Two years ago, I posted a blog on how to implement Transport Rules in Microsoft Exchange to flag messages originating from outside the organization. Goal is to aid end users in identifying messages originating from outside of the organization, by displaying tags in the subject or body part of received messages. This to make them aware – and hopefully more cautious – when it comes to clicking links or opening attachments. Downside of this method is that every inbound message gets a bit cluttered in their subject or body with tags and notifications, which becomes more evident when replying back and forth to external messages. Back then, I already stated a sort of MailTip would be a more preferable and elegant solution.

Onward to 2021, where tagging of external messages became a generally available feature in March for Exchange Online (MC243047, announcement), when used together with Outlook for Web Access (OWA), Outlook for Mac, Outlook Mobile. Outlook for Desktop will also receive support for the feature (supported per version 2105 build 14026.20000, InsiderFast currently). To start adopting this tagging mechanism for new messages, organizations need to deploy an organization level setting using Set-ExternalInOutlook, e.g.

Set-ExternalInOutlook -Enabled $True -AllowList 'contoso.com'

This will enable the tagging of external messages in your tenant, except for domains or e-mail addresses which have been specified through the AllowList. In the example above, messages from contoso.com senders will bypass tagging. The AllowList is limited to 30 entries or 1 kB, whichever comes first. You can reconfigure the AllowList through the hashtable method, e.g.

Set-ExternalInOutlook –AllowList @{Add='fabrikam.com','john@wingtiptoys.com'; Remove='contoso.com'}

After configuring Set-ExternalInOutlook, tagging is not immediate and can take a short while to become active. To inspect current settings, run Get-ExternalInOutlook.

How tagged mail is presented depends on the client. For example, Outlook for Web Access displays an ‘External’ label in the message list, as well as a MailTip at the top of the e-mail contents:

image

Same goes for Outlook Mobile, where the message list as well as the message view will show an indicator:

image

Outlook for Desktop
However, Outlook for Desktop does not present a label in the message list, nor exposes a field to filter those external messages, only displaying a MailTip after opening the message:

image

So, people almost started asking right away if it was not possible to expose External information in the message list. Well, with a little help of “Oldskool” Outlook and forms customization, this is possible, and here is how:

First, we need information related to the MAPI attribute. As the field is not by default available in Outlook, we need to know some of its properties to define it later on. As mention in some of the documents, or Glen Scales’ article on how to identify messages using Graph or Exchange Web Services, the MAPI property tag is 41F28F13-83F4-4114-A584-EEDB5A6B0BFF and its name is IsExternalSender.

Next, we need to construct a .CFG file where we will define the property we want to expose. I’ve already done this part for you, and you can download IsExternalSender.cfg from GitHub. Also download the two .ico files and put them in the same folder as the .cfg file. Note that those .ico files only represent the form. Alternatively, you can copy the .cfg file to your Personal Forms Library folder and skip installing, but this way the instruction is a bit simpler, allows you to pick the Folder Forms Library and will skip the elevated access dialog as the Personal Forms Library is a protected folder.

Open Outlook, go to File > Options > Advanced and click the Custom Forms button. There, click Manage Forms. By default, the form is installed in your Personal Folder Library. You can also pick a mailbox to store the form, allowing it to roam together with the view changes we will perform later. Click Install and pick the prepared .cfg file you downloaded from GitHub, and the following dialog should be shown:

image

Click OK to confirm you want to load the information in the form file in your personal forms library and close the Forms Manager. Going back to the Outlook navigation view, you can now add an IsExternalSender field to the message list. Right-click the field header and select Field Chooser. In the drop-down list, select Forms.., and add External Tagging Form to the Selected Forms. Field Chooser should now display an available field named IsExternalSender, which you can add to your current view using drag & drop.

image

Note that the .cfg defines the IsExternalSender as Boolean and showing it as an Icon. This means that for External messages, the column IsExternalSender will contain a checkbox:

image

When you want, you can create custom fields to adjust how the information is presented. For example, you can create a custom field using a formula to display [EXTERNAL] for IsExternalSender messages, which might be more usable in certain views instead of the checkbox. To accomplish this, select New in Field Chooser,and create a field named ExternalTag, type Formula and enter the following formula:

iif([IsExternalSender]=-1,"[EXTERNAL]","")

You can then add the ExternalTag field to Compact View. Do note the text takes up a row in Compact view, thus might replace sender or the subject depending on layout and field order.

On a final note, when wanted you can filter, sort or create Search Folders using the new IsExternalSender field.

Exchange On-Premises
Organizations running Exchange Hybrid, routing inbound messages through Exchange Online, are not able to benefit from external e-mail tagging. IsSenderExternal is only stamped on messages destined for mailboxes in Exchange Online. These organizations have therefor no way to identify these messages landing in their Exchange on-premises environment, and may require them to deploy the less elegant Transport Rules solution regardless.

End Users & External Messages

Ex2013 Logo

Update 5May2021: Relocated information regarding External Tagging feature to new blog.

In the ongoing battle against spam and phishing, technical measures have much effect as they are able to triage spam or phishing messages based on configuration or programmed rules. By now, many of these measures have been widely adopted to limit messages of those categories to reach the inbox of the end user. Measures like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) can be used to validate origination or contents of the message, or authenticate senders.

This post isn’t about those measures or how to implement them. I suggest reading this excellent DMARC implementation guide by MSFT’s Martijn van Geffen for more information on how to implement SPF and DMARC successfully. Note that his website also contains lots of tools and scripts to troubleshoot and report on SPF/DMARC. If you’re unfamiliair with his site, I suggest you have a look.

One of the “weaker links” in the whole chain of messaging remains the end end user. One can still devise technical measures up to a point, there are still end users out there who blindly click links or follow instructions in that message from ‘Microsoft’ requesting them to change their Office 365 password. One can not always blame the end user; phishers became very crafty in making their deceptions look genuine; even IT professionals often need to look twice to determine legitimacy of a message. For those interested, few months ago Google put a phishing quiz online where you can assess your phishing detection skills.

To assist end users processing inbound messages, many companies have resorted to providing visual clues so end users can more quickly determine the origin of a message or the message being potentially non-legit. One measure often is marking messages originating from outside the organization, by inserting a notice before the contents, or prefixing the subject with something like “[External]”.

Recently, MVP fellow Tony Redmond wrote an article on how to accomplish marking external messages using transport rules in Exchange. For example, to create a transport rule you can use the following cmdlet:

New-TransportRule -Name 'Tag External Mail' -SetHeaderName 'X-ExternalMail-Tagged' -SetHeaderValue 'True' -ApplyHtmlDisclaimerLocation Prepend -ApplyHtmlDisclaimerText '<span style="background-color:yellow;color:black;"><b>Notice</b>: This message originates from outside the organization. Make sure to validate the sender before clicking links or opening attachments.</span>' -ExceptIfHeaderContainsMessageHeader 'X-ExternalMail-Tagged' -ExceptIfHeaderContainsWords 'True' -ExceptIfSenderInRecipientList Allow -FromScope NotInOrganization

The above will create a transport rule that prepends the message with a colored (HTML) notice, inserting a message header to prevent insertion of multiple notices and allowing end users to add senders to their Safe Sender Allow List to bypass tagging messages.

image

However, the problem with these notices is that over time it might make end users insensitive, as messages from external sources are usually large in numbers and become part of the other visual noise like disclaimers and marketing messages. Therefor a better option might be to mark messages which fail DMARC or SPF checks, provided you are not rejecting those messages at some level.

For example, to mark messages failing DMARC or SPF checks, you could create the following transport rule:

New-TransportRule -Name 'Tag DMARCSPFFail Mail' -SetHeaderName 'X-DMARCSPFFail-Tagged' -SetHeaderValue 'True' -ApplyHtmlDisclaimerLocation Prepend -ApplyHtmlDisclaimerText '<span style="background-color:white;color:red;"><b>Warning:</b> The sender of this message could not be validated, and may not be the actual sender.</span>' -ExceptIfHeaderContain
sMessageHeader 'X-DMARCSPFFail-Tagged' -ExceptIfHeaderContainsWords 'True' -ExceptIfSenderInRecipientList Allow -FromScope NotInOrganization -HeaderMatchesMessageHeader 'Authentication-Results' -HeaderMatchesPattern 'dkim=fail','spf=TempError','spf=PermError', 'spf=SoftFail', 'spf=Fail', 'spf=None'

Of course, you could also prepend the subject with a tag to help identifying messages in this category.

More recently, Microsoft added the MailTip feature to Outlook Mobile which also helps in making end users more aware of their outbound communications. After enabling the MailTips for external recipients using:

Set-OrganizationConfig -MailTipsExternalRecipientsTipsEnabled $true

end users will receive a notification when replying to or sending messages outside their organization from Outlook Mobile; Outlook Desktop already had this feature.

Outlook Desktop:
recext

Outlook Mobile:
image

MailTips are in my opinion the preferred visual clue when compared to inserting content, as it not only can notify users upfront, it also doesn’t clutter message bodies with notifications and warnings. In the end, these notifications are however a small price to pay, compared to the cost of phishing or end users clicking malicious links. It would be nice if Microsoft could already show the MailTip when displaying the message, so it would prevent accidental clicking of malicious links or attachments.

May 5th 2021: A new feature has been introduced to Exchange Online (MC243047), which allows organizations to tag external inbound messages. Information on this new feature has been published in a new blog: Tagging External Messages.

On a final note, Advanced Threat Protection (ATP) could also help companies with the protection against malicious links and attachments, however not every company has ATP licenses. In both cases, these notices might complement the overall set of measures.