Risky Policies Detection and Remediation
Risky sender allow policies
Email Protection detects and surfaces sender allow policies that may reduce protection so they can be reviewed and safely remediated. This release focuses on exemptions involving domains that are frequently targeted for impersonation and phishing. A policy may be flagged whether it allows an entire domain, a wildcard or subdomain pattern, or a specific sender address associated with one of these domains.
These types of exemptions can bypass security controls that would otherwise evaluate the message. Many were created historically to address deliverability issues, before SPF, DKIM, and DMARC were as widely adopted as they are today. Most major legitimate senders now authenticate their mail using one or more of these standards, which can reduce the need for persistent sender exemptions.
These domains were selected because they are high-value impersonation targets and include many of the brands most frequently abused in phishing campaigns. Email Protection currently identifies sender exemptions involving the following domains as risky:barracuda.combarracudanetworks.commicrosoft.com intuit.com google.com docusign.net amazon.com netsuite.com apple.com zoom.us linkedin.com dropbox.com sf-notifications.com adobesign.com paypal.com sharepointonline.com mailchimp.com ukg.com quickbooks.com
However, there may be cases where the risk is understood and required for a specific reason. Before removing an exemption, review any user-specific mail-flow requirements or applications that may depend on the existing policy.
What happens when the card is shown
When the Risky policies found card appears at the top of the Policies page, click it to open a page that summarizes what was found, why it is considered risky, and how many policies are affected at each level (account, domain, user). Then review the risky settings and initiate remediation on the affected policies.
Best practice: Avoid persistent sender allow rules for commonly impersonated domains unless they are required for a specific mail-flow need. Where an exception is necessary, scope it as narrowly as possible (for example, to a validated sending subdomain or a specific service address) and keep standard inspection and sender-authentication controls enabled wherever possible.
Step-by-step remediation
To access the Email policies page, click the Open Email Protection link located at the top right corner of the respective product (Email Gateway Defense, Impersonation Protection, Incident Response).
Click Policies in the left-hand navigation menu.
Look for and click the Risky policies found card at the top.
Review to see which rules are affected and at which levels (account, domain, user). For user-level sender policies, the associated user is displayed alongside the policy details. This allows you to identify and contact the affected user before removing the policy.
Confirm that these are the policies you want to delete.
Select Delete all at the top upper right. Email Protection removes the flagged policies across the account, domain, and user levels where it exists, in the tenant you are currently managing. Alternatively, delete each policy individually by using the trash can icon next to the policy you want to remove.
Note that this process cannot be undone.
When removal is complete, the risk counts update, and a Done button appears; clicking it returns you to the Policies page.
If some layers could not be updated (for example, due to a permission issue) or the delete fails, an alert appears in the lower-left corner. The policies that could not be deleted are returned to the default state (other policies show a green checkmark).
The card is only shown again on the Policies page if some risky policies could not be removed or a recheck finds that qualifying high-severity risky policies still remain.
Notes
Tenant-specific changes – All detections and remediations apply only to the tenant you are currently managing. Other tenants are not changed.
No automatic remediation – Email Protection does not delete or modify risky policies without your explicit confirmation.