I've been told it's best practice for anyone on the VIP list to also add their external or personal email addresses to the VIP if they will be sending from these external addresses to the organisation. This stops the external address from coming up as Spoofed VIP, but it still flags as Internal Name Match. I understand they are different threat detections, but surely logically a Spoofed VIP is just a more severe form of Internal Name Match, and if we are going to add the external address to the VIP list, and it's known to the Org, then it would make sense for this to automatically prevent the Internal Name Match too ?
Could this be looked at as a future improvement, maybe in the form of a selectable option to "Never warn on Internal Name Match for users in the VIP list" checkbox.
Otherwise best practice for us will have to be add users to VIP list and then create allow list entries for each one to suppress Internal Name Match too
Please authenticate to join the conversation.
In Review
Email Security
12 days ago

Brandon Howard
Get notified by email when there are changes.
In Review
Email Security
12 days ago

Brandon Howard
Get notified by email when there are changes.