I'm investigating a possible incident where a user appeared to receive an email from their own account. I'm trying to determine whether the message was spoofed or whether the account was compromised. In the Microsoft 365 message trace, the sender appears to be the same user who received the message. Our managed service provider says the trace is only displaying the claimed sender address, while the originating IP and location indicate that the message came from the internet. Can an email sent from an external system appear in Exchange message trace as though the user sent it to themselves? What headers or trace details would definitively distinguish spoofing from an actual account compromise?
4 Answers
Treat the incident cautiously until the headers are checked. If the evidence points to a real mailbox submission, revoke active sessions, reset the password, and verify MFA. But don’t assume compromise solely because the trace lists the user as the sender; an external system can spoof that visible address.
Don’t make the GUI trace the deciding factor. Retrieve the complete headers from the delivered message and inspect the last external Received hop plus the Authentication-Results header. Check SPF, DKIM, and DMARC alignment with your domain. A spoofed message will typically fail alignment or authenticate only for another domain. If it authenticated properly as your domain from an external source, investigate account compromise or an incorrectly configured connector.
Use a header analyzer to review every sender field, relay, and IP address. If the message was actually submitted from the mailbox, you should see an internal submission path. Also review your DMARC policy: with a policy of p=none, obviously forged messages may still be delivered, which can make the trace look more convincing than it really is.
Yes, this can happen. The sender shown in the message trace may reflect the address claimed in the message rather than proving that the mailbox submitted it. Direct Send and similar spoofing attempts can make a message appear to come from the recipient. Check whether anything in your environment relies on Direct Send before disabling it, since legitimate devices or applications may break.
The high-level trace can look like a user-to-user message, but the originating IP and other message attributes usually reveal that it came from outside Microsoft 365.