While DKIM and SPF records have curbed some of the phishing attempts that “come from” my domain, there are still many times that users are confused as to why the CEO is emailing them wanting to change bank information or to buy hundreds of dollars of iTunes gift cards. I’m usually met with a “just block it” mentality. My best example is to say “Hello, my name is Bob Dole, pleasure to meet you”. They know I’m not actually Bob Dole, but that doesn’t prevent me from saying I’m Bob Dole. Then I show them my ID and tell them that’s similar to looking at the technical mail headers to figure out who sent this message (more importantly where it came from). And yes, before anyone asks, my ID is different from “Bob Dole”.
That being said, we created a rule for certain executives to prevent someone from doing something stupid (generally with money involved). All of our Executives, HR, and the Payroll team have a rule setup that when a sender shares the same name as one of those team members, AND is an external sender, I pre-append the message “*** THIS MESSAGE MAY BE PHISHING AS IT ORIGINATES FROM OUTSIDE THIS ORGANIZATION***”. I thought that would be enough, but we are still getting tickets asking if those messages are legit.
So now onto the actual meat of the post – to show the sender’s domain name in our standard outlook view. I wish it were as simple as choosing this in the field chooser, but alas…
*Note* this is on a per-folder view – not mailbox specific – and does not affect mobile or OWA access views. This also assumes you’re on Office2010 or later (I’m on 2016 FYI).
Open the mail folder you want to view sender domains (in my case it’s the Inbox).
Click on View, then on the Add Columns button
Now click on the New Column… button
Name: Sender Domain
Type: Formula
Click on the Edit button
Enter this text: right([SearchFromEmail],len([SearchFromEmail])-InStr(1,[SearchFromEmail],”@”))
Click OK
Now we should be back in the Show Columns/Field dialog where you can select your newly created column and move it “up” to where you want it to show. I end up showing it between Attachment and From fields.
