Table of Contents
Introduction
Imagine receiving an email that looks like it came from your own company. It has your domain name, your logo, and even your email address. But you didn't send it. This is called self-spoofing, and it's one of the most dangerous email threats businesses face today.
Cybercriminals use self-spoofing to trick employees into clicking malicious links, sharing sensitive information, or transferring money. The worst part? Traditional email security tools often miss these attacks because the email appears to come from a trusted source.
Self-spoofing emails come from YOUR own domain. They bypass many security filters because they appear to be from a trusted internal source.
What Is Self-Spoofing?
Self-spoofing is when a hacker sends an email that appears to come from your own email domain. For example, if your company uses @yourcompany.com, the hacker sends an email that looks like it came from ceo@yourcompany.com or hr@yourcompany.com.
Hackers use a technique called Direct Send to send these emails. They find an email server or service that allows sending without authentication, then set the "From" address to a real email address from your company.
Real-World Example
Recently, an employee received an email that appeared to come from their own domain. The email claimed to be a "Check Remit Payment Request" with a "DocuSign" attachment.
What made this email suspicious?
- The sender appeared to be from their own company (self-spoofing)
- The email claimed to be from "DocuSign" but was sent from their own domain
- The attachment was a suspicious file type (.svg)
- The email created a false sense of urgency about a payment
DocuSign will NEVER send you a document from your own company domain. Legitimate DocuSign emails come from docusign.net or docusign.com.
Why Self-Spoofing Is Dangerous
- Trust: Employees trust emails from their own domain and are more likely to click links or open attachments.
- Bypasses Security: Many email filters assume internal emails are safe and don't scan them thoroughly.
- Hard to Detect: The email doesn't have obvious red flags like misspellings or unusual sender addresses.
- Widespread Damage: A successful attack can compromise payroll, financial accounts, or client data.
How to Fix It: Reject Direct Send
Microsoft has released a powerful new feature called Reject Direct Send for Exchange Online. This feature blocks any email sent to your tenant that uses your domain but isn't authenticated.
Enabling Reject Direct Send stops self-spoofing attacks immediately. Legitimate emails from approved senders can still be delivered through partner connectors.
Step-by-Step Guide
Step 1: Identify Legitimate Senders
Before enabling the feature, identify any legitimate senders that use your domain without authentication. These include on-premises applications, third-party cloud services, and legacy devices like printers or scanners.
Check your SPF record to see which IPs are already authorized to send as your domain.
Step 2: Set Up Partner Connectors
For legitimate senders, create a partner connector that authenticates their emails using either:
- Certificate (recommended): The sender presents a valid certificate.
- IP Address: The sender's IP address must match the connector settings.
Step 3: Enable Reject Direct Send
Connect to Exchange Online PowerShell and run this command:
The change takes effect within 30 minutes.
Step 4: Monitor and Test
Use the Change Optics Report in the Exchange Admin Center to see what traffic will be impacted. If legitimate emails are being blocked, create partner connectors for those senders.
Final Thoughts
Self-spoofing emails are a serious threat that can lead to financial loss and data breaches. Microsoft's Reject Direct Send feature provides a powerful way to stop these attacks by blocking unauthenticated emails that use your domain.
Key takeaways:
- Self-spoofing emails come from your own domain and are hard to detect.
- Enable Reject Direct Send in Exchange Online to block these attacks.
- Create partner connectors for legitimate senders to avoid blocking important emails.
- Regularly monitor your email flow using the Change Optics Report.
If you need help implementing this security measure, contact SystemLogicIT today.