Ask a new question

Exchange Online / O365 mail flow rule to block spam with sender's display name starting with a leading space

Our O365 org is receiving spam with a pattern that I'd like to block using Office 365 Mail Flow rules (or any other way!). The pattern is that the sender's Display Name always starts with a space, and the sender's address is also fairly predictable (see table below). Is there any Exchange Online / O365 feature that will allow me to block mails with this pattern?  I don't want to block all mails from a "subscriptions@[somedomain].org" pattern because there could maybe be legitimate mails coming from that address. Ideally I could use the leading space on the display name as the indicator that filtering is needed. 

| DisplayName (leading space) | Address                       | Subject
------------------------------------------------------------------------------------------------
|  Drive with Lyft            | **Removed**                   | Drivers Wanted
|  Drive with Lyft            | **Removed**                   | Drivers Wanted
|  Drive with Lyft            | **Removed**                   | Drivers Wanted
|  LifeLock.                  | **Removed**                   | Data breached? Get 10% off LifeLock membership.
|  Driver Opportunities       | **Removed**                   | Turn your extra time into extra-cash

|  Globe Life Partner         | **Removed**                   | $100K protection for just a dollar*
|  Protect Your Home          | **Removed**                   | Home Alarm Equipment + $100 Visa-Gift-Card from ProtectYourHome
|  Uber-Partner               | **Removed**                   | Have a Car? Drive with Uber

-----Personal Information Removed by Moderator-----

Hi Justingrant,

Based on my expereince, it isn't feasible to block emails with sender's display name starting with a leading space. But you can block emails with their domain, email address etc. For your reference:

Besides, you can also use the spam filter to block spam. For detailed steps, please follow Configure your spam filter policies. Please feel free to let me know if you still have any questions.

Regards,

Carlos

-------------------------------------------------
If you feel a reply works for you, please kindly vote or mark it as it will be beneficial to other community members reading this thread.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I guess I shouldn't be surprised that a spammer chose a pattern of sender names, addresses, and domain names that wasn't easily filterable with current versions of Exchange.  Too bad. 

Changing the organization's spam settings is not helpful in this case, because that solution only works if the messages themselves have been classified by Microsoft as spam or bulk, or if the messages match some of the criteria defined in Advanced spam filtering (ASF) options.

Unfortunately, the best solution I could find was to follow the instructions in https://technet.microsoft.com/en-us/library/jj200769.aspx to report these spam messages to Microsoft by attaching the spam mails to a new email and sending it to a particular Microsoft email address (see that TechNet article for details), and to hope that the O365/Exchange team will eventually update their spam filters to prevent these kinds of mails.  I just sent about 15 of these mails to Microsoft. Hopefully it will help!

BTW, there's a Junk email reporting add-in for Microsoft Outlook that makes it easy (for PC Outlook users at least) to report spam messages to Microsoft.

There's also a setting in OWA for reporting spams too. See the TechNet link above for more details. 


Justin Grant

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Justingrant,

Thanks for your sharing. As a temporary workaround, you can block spam with sender mail address or domain. Besides, you can also give feedback to our related engineers via Office 365 Uservoice. Your thoungt is important for us to perfect the product and service. Your understanding and cooperation are appreciated,

Regards,

Carlos

-------------------------------------------------
If you feel a reply works for you, please kindly vote or mark it as it will be beneficial to other community members reading this thread.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info

Last updated October 1, 2021 Views 2,199 Applies to: