impersonation email from the CEO

[dexter.legwabe]

Good day,

we have an email sent to employees "from the CEO" the email is an impersonation email, the business would like assistance in regards with the policies 

[Ken Stieers]

So there are a few ways to tackle this:

1. Its items like this that gave rise to marking mail as "External" on its way in... if its external, its NOT from the CEO.
2. If they've spoofed your domain, you can point your ESA at your own DMARC/DKIM/SPF, which ought to just toss it.
3. Content filters if they're using a "lookalike" domain, and for other keywords you know your CEO won't use (eg. "Office of the CEO")
For domain lookalikes I use KnowBe4's free Domain Doppleganger tool. https://www.knowbe4.com/domain-doppelganger

[dexter.legwabe]

I guess, i am answered we only looking at the email address not the names, example Donald Trump <rtyba@gmail.com> , Cyrial Ramaphosa <rtyba@gmail.com>, Presidents names wont be taken as impersonation

[Ken Stieers]

In this use case, you could also look at Forged Email Detection.

It's a content filter that uses fuzzy match on the from head header.