--- title: "Are external emails tagged as originating from an external source?" url: https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source category: "Email security and phishing" canonical_key: q_eml_009 evidence_state: verified updated: 2026-08-24 --- # Are external emails tagged as originating from an external source? URL: https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source Section: Email security and phishing Evidence state: Verifiable from your tenant One setting, no licence cost, and it undercuts the most common impersonation technique. Carriers ask because it is close to free and still frequently off. ## What the carrier is actually asking The carrier is asking whether mail arriving from outside the organisation is visibly marked, so that a message claiming to be from the chief executive is obviously external at a glance. It is a small interface change with an outsized effect on impersonation attacks. ## Why it is underwritten Executive impersonation relies on the display name looking familiar. On mobile clients particularly, the display name is often all a user sees. An external tag interrupts that at the moment of reading, before the request is acted on, and it costs nothing to enable. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is directly measurable in Microsoft 365, and it is one of the fastest gaps to close if it is not already on. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Microsoft 365 | External sender identification in Exchange Online | Enabled tenant-wide, which adds the native external tag across clients | | Microsoft 365 | MailTips configuration | Enabled, so users are warned when replying to external recipients as well as when receiving from them | | Microsoft 365 | Any transport rule adding a banner, and its exclusions | Where a custom banner is used, its exclusion list is reviewed, since partner exclusions accumulate | | Microsoft 365 | Anti-phishing impersonation protection, first-contact safety tip | Enabled, which flags messages from senders the recipient has never corresponded with | | Microsoft 365 | Behaviour on mobile and web clients | The tag appears where users actually read mail, since a banner that only renders on desktop misses the highest-risk context | **Exclusions defeat the control quietly** Transport rules that add a banner usually accumulate exclusions for partners and vendors whose mail looked untidy with it. Those excluded domains are exactly the ones an attacker will impersonate, because their mail arrives looking internal. ## What a defensible yes requires - External tagging is enabled tenant-wide with minimal exclusions. - The tag renders on mobile and web, not only on the desktop client. - First-contact safety tips are enabled for senders never seen before. - MailTips warn on outbound external replies as well. - Any exclusion list is reviewed rather than accumulated. ## How this answer goes wrong A transport rule adds a banner and a dozen partner domains are excluded, so the most trusted external senders arrive unmarked. Or the banner is HTML that renders inconsistently on mobile, where most impersonation is read. The setting reports as enabled and the effect is partial. ## If this answer turns out to be wrong Business email compromise is the highest-frequency cyber claim, so the mail controls described on the application are among the first things an adjuster reads back against it. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Do users stop noticing the tag? Somewhat, over time. It still works at the moment that matters, when the message asks for something unusual, and its cost is close to zero. ### Native tagging or a custom banner? Native, where available. It renders consistently across clients and needs no maintenance, whereas custom rules drift and collect exclusions. ### What about first-contact tips? Worth enabling alongside. A sender you have never corresponded with is a meaningfully different signal from a sender outside the organisation. ### Does this help with internal compromise? No. Mail from a compromised internal mailbox is genuinely internal. That is why the impersonation protections and reporting controls matter alongside it. ## Related questions - [Does the Applicant employ SPF, DKIM, and DMARC?](https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc) - [Are employees with financial/accounting responsibility given social engineering and phishing training?](https://insuranceposture.com/questions/email-security/employees-financial-accounting-responsibility-given-social-engineering-phishing-training) - [Does the Applicant have a report-phishing email add-in enabled for all email users?](https://insuranceposture.com/questions/email-security/applicant-report-phishing-email-add-enabled-email-users) - [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.