How it works: SPF allows domain owners to specify which mail servers are permitted to send email on behalf of their domain. Receiving mail servers verify the SPF record to check if the email comes from an authorized server.
Setup: Add a TXT record to your DNS with the SPF policy. Example:
v=spf1 include:_spf.example.com ~all
Mechanisms:
include - Include another domain's SPF recordip4/ip6 - Specify allowed IP addressesa/mx - Allow domain's A or MX records~all (soft fail) or -all (hard fail)How it works: DKIM adds a digital signature to email headers using public-key cryptography. The sending server signs the email with a private key, and receiving servers verify it using the public key published in DNS.
Setup:
Example DKIM record:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...
How it works: DMARC builds on SPF and DKIM, allowing domain owners to publish policies on how receivers should handle emails that fail authentication, and request reports about authentication results.
Setup: Add a DMARC TXT record to your DNS. Example:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensics@example.com; pct=100
Policy options:
p=none - Monitor only, no actionp=quarantine - Treat as suspiciousp=reject - Reject the messageFilters unsolicited bulk email using machine learning and reputation analysis.
Configuration: Set spam filtering policies in Security & Compliance Center → Threat management → Policy → Anti-spam
Actions: Move to Junk, Quarantine, Delete, etc.
Scans attachments and links for known malware using multiple engines.
Features:
Detects impersonation attempts and suspicious links.
Techniques:
Safe Links: Rewrites URLs to check them in real-time when clicked.
Safe Attachments: Opens attachments in a sandbox before delivery.
Create custom rules in Exchange Admin Center → Mail flow → Rules
Examples:
Manage in Security & Compliance Center → Threat management → Policy → Anti-spam
Types:
Available in Defender for Office 365 Plan 2
Features:
Track email path through Exchange Online (Exchange Admin Center → Mail flow → Message trace)
Data: Sender/recipient, status, timestamp, message size
Real-time and historical threat detection (Microsoft 365 Defender → Email & collaboration → Explorer)
Capabilities:
Key headers to examine:
Received: - Mail server pathAuthentication-Results: - SPF/DKIM/DMARC resultsX-MS-Exchange-Organization-* - Microsoft-specific data| Action | Tool | Description |
|---|---|---|
| Delete emails | Threat Explorer | Remove malicious emails from all mailboxes |
| Block sender/domain | Tenant Allow/Block List | Add to block list in Anti-spam policies |
| Block URLs | Tenant Allow/Block List | Block malicious links |
| Block attachments | Mail Flow Rules | Create rule to block file types |
Components:
| Issue | Possible Causes | Troubleshooting Steps |
|---|---|---|
| Emails not received | DNS issues, filtering, blacklisting | Check message trace, test connectivity |
| Delays in delivery | Queue backups, throttling | Check queues, review connector settings |
| Recipient not found | Invalid address, directory sync issues | Validate recipient, check directory sync |
Key Factors:
Common RBLs (Real-time Blackhole Lists):
Delisting Process:
Azure Information Protection (AIP) is a cloud-based solution that helps organizations classify and protect documents and emails by applying labels.
DLP helps prevent sensitive information from being inappropriately shared by detecting, monitoring, and protecting data across Microsoft 365.
Manage content through its lifecycle with retention policies and labels.
Identify, preserve, and export electronic information for legal cases.
Additional capabilities for complex investigations: