4 ms·

https://support.microsoft.com/en-us/office/add-recipients-of-my-email-messages-to-the-safe-senders-list-be1baea0-beab-4a30-b968-9004332336ce https://support.mic

https://support.microsoft.com/en-us/office/add-recipients-of-my-email-messages-to-the-safe-senders-list-be1baea0-beab-4a30-b968-9004332336ce https://support.microsoft.com/en-us/office/add-recipients-of... Yes. Although I will say that ATP runs before safesenders or any other rule applies, and it's been hair trigger lately. Sadly this is the only way to do business sometimes. Every org has to deal with a couple other organizations that absolutely refuse to get their auth game together. Users just want their mail to work and the particulars don't matter to them. The result is that your contacts can be spoofed. If I (the admin) push back on this my boss will get a complaint like "jabroni is interfering with my bazillion dollar sale" and any argument to the contrary is obviously just me playing the blame game. So I whitelist it and now that company we are trading PDFs with can be spoofed by anybody and skips security scanning :)

peanut-walrus 3y ago
I mean, yeah, I've been in that position, I get it for the poorly configured domains. However, if I set a DMARC policy for my domain to reject, I would expect at least Google and Microsoft who control something like 90% of the email market to respect that policy. The realist in me realises that there is probably a non-negative number of domains out there with dmarc set to reject but failing absolutely all spf and dkim checks, but this should be their problem, not the receiver's.
MichaelZuo 3y ago
If the other organization insists on sticking to older methods, then best practice is for all parties involved to revert to the last commonly and unarguably fully agreed-to method of communication, which is most likely fax in the US.
- jabroni_salad 3y ago
  which is hilarious, since both companies are probably using a fax gateway anyhow. You end up with email-> gateway -> real fax -> gateway -> email. This is somehow easier than configuring a dmarc record.

peanut-walrus 3y ago

I mean, yeah, I've been in that position, I get it for the poorly configured domains. However, if I set a DMARC policy for my domain to reject, I would expect at least Google and Microsoft who control something like 90% of the email market to respect that policy. The realist in me realises that there is probably a non-negative number of domains out there with dmarc set to reject but failing absolutely all spf and dkim checks, but this should be their problem, not the receiver's.

MichaelZuo 3y ago

If the other organization insists on sticking to older methods, then best practice is for all parties involved to revert to the last commonly and unarguably fully agreed-to method of communication, which is most likely fax in the US.

jabroni_salad 3y ago
which is hilarious, since both companies are probably using a fax gateway anyhow. You end up with email-> gateway -> real fax -> gateway -> email. This is somehow easier than configuring a dmarc record.