[ms office - o365] O365 Block TLDs

[Michael]

Hi all,

 

What's the best way to block TLDs (Top Level Domains) in O365? TIA.

[mavhc]

Can you explain more? Block what from what? Documents? Emails? Links?

[Michael]

Thanks for your reply - so for example, there was various spam emails arriving from a .co.nz domain recently and being based in the UK, it's highly unlikely we'd need to communicate with our neighbours New Zealand It's not the first time, so rather than block specific domains, such as company.co.nz, to block co.nz in its entirety.

[andy_b]

This?

 

https://security.microsoft.com/tenantAllowBlockList

[Michael]

Thanks, it looks promising but is somewhat clunky. Once I've added a few TLDs, I can't then edit to amend/add to the list.

 

What actually happens to the email? Does it arrive in Spam or bounce back? Again very unclear Microsoft!?

[Michael]

Actually - I think this is the correct location

 

Amend the Inbound policy, scroll to the bottom and select Edit allowed and blocked senders and domains, then select Block domains. Any domains or TLDs will go into the Junk folder of the recipient, rather than be quarantined or blocked as such. I think this is a better strategy, just in case something genuine did arrive.

[andy_b]

Seems like they do similar tbh - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide

 

"Email messages from these senders are marked as high confidence spam (SCL = 9). What happens to the messages is determined by the anti-spam policy that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict preset security policies, high confidence spam messages are quarantined."

 

I think the inbound policy is probably the better way though.