Friday brainfart: how to block internal spoofing when using proofpoint on MX records?
An end user was bombarded yesterday by emails from herself that she did not send. I've had Proofpoint on their domain for over a year (on their MX records) with very few issues. The emails she received bypassed the MX records, sample header properties below. Both Microsoft and Proofpoint have writeups on this very issue, but I'm having a brainfart as to how to proceed. Stephanie@mydomain.com is using M365 Business Premium.
Received: from CO1PR05MB7879.namprd05.prod.outlook.com (::1) by
IA3PR05MB10713.namprd05.prod.outlook.com with HTTPS; Thu, 25 Jun 2026
14:37:05 +0000
Received: from DS7P220CA0008.NAMP220.PROD.OUTLOOK.COM (2603:10b6:8:1ca::15) by
CO1PR05MB7879.namprd05.prod.outlook.com (2603:10b6:303:f3::17) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.21.181.7; Thu, 25 Jun 2026 14:32:24 +0000
Received: from DS1PEPF00017099.namprd05.prod.outlook.com
(2603:10b6:8:1ca:cafe::60) by DS7P220CA0008.outlook.office365.com
(2603:10b6:8:1ca::15) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.17 via Frontend Transport; Thu,
25 Jun 2026 14:32:23 +0000
Authentication-Results: spf=none (sender IP is 108.175.8.93)
smtp.helo=mta-80-125.sparkpostmail.com; dkim=none (message not signed)
header.d=none;dmarc=fail action=quarantine
header.from=mydomain.com;compauth=none reason=451
Received-SPF: None (protection.outlook.com: mta-80-125.sparkpostmail.com does
not designate permitted sender hosts)
Received: from mta-80-125.sparkpostmail.com (108.175.8.93) by
DS1PEPF00017099.mail.protection.outlook.com (10.167.18.103) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6
via Frontend Transport; Thu, 25 Jun 2026 14:32:23 +0000
Return-Path: <>
From: stephanie@mydomain.com
To: stephanie <stephanie@mydomain.com>
Subject: mCaller left stephanie - 34s Preview vHC- June 25, 2026
3517286943
Message-ID:
<[1782397942584.17a9c193f74e0b73-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@mydomain.com]>
Date: Thu, 25 Jun 2026 14:32:22 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--_NmP-289a666a40f8f530-Part_1"
X-MS-Exchange-Organization-ExpirationStartTime: 25 Jun 2026 14:32:23.4717
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
b48d577c-0b2c-4399-3061-08ded2c69266
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 220a3ae7-e220-4b76-abb2-d1cefeba692f:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
DS1PEPF00017099:EE_|CO1PR05MB7879:EE_|IA3PR05MB10713:EE_
X-MS-Exchange-Organization-AuthSource:
DS1PEPF00017099.namprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id: b48d577c-0b2c-4399-3061-08ded2c69266
X-MS-Exchange-AtpMessageProperties: SA|SL
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam:
BCL:0;ARA:13230040|29132699027|5009299003|6049299003|57112099003|55112099003|18002099003|19002099009|17002299006|4053099003|5063699009;
X-Forefront-Antispam-Report:
CIP:108.175.8.93;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mta-80-125.sparkpostmail.com;PTR:ip108-175-8-93.pbiaas.com;CAT:NONE;SFS:(13230040)(29132699027)(5009299003)(6049299003)(57112099003)(55112099003)(18002099003)(19002099009)(17002299006)(4053099003)(5063699009);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jun 2026 14:32:23.1133
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: b48d577c-0b2c-4399-3061-08ded2c69266
X-MS-Exchange-CrossTenant-Id: 220a3ae7-e220-4b76-abb2-d1cefeba692f
X-MS-Exchange-CrossTenant-AuthSource:
DS1PEPF00017099.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR05MB7879
X-MS-Exchange-Transport-EndToEndLatency: 00:04:42.5262254
X-MS-Exchange-Processed-By-BccFoldering: 15.21.0159.007
X-MS-Exchange-ExternalInOutlookResult: NotEnabled
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003)(1310096);
X-Microsoft-Antispam-Message-Info:
=?us-ascii?Q?n+j9JsLrhwvRb6OmvBUb3zljh6lgyFRYEtg3psgCsmqnGcQ/8jBmnCrECPJg?=
u/pkokkinis — 9 days ago