Does Outlook "trusted domain" actually do any sort of checking?

Question

When you receive an email containing pictures from a new domain in Outlook you can right-click on the address and "Mark this domain as trusted" which will autoload all the photos on future emails.

But the "from" field in an email is spoofable by anyone with a passing knowledge of programming. So my question is does Outlook actually scrutinize the headers and the email's origins? Or is it just setting a text filter for future "from" fields?

Under the latter case if I marked example.com as trusted then any future spam falsely claiming to be from example.com would screw me.

Answer 1

It appears from Microsoft's documentation that the "Mark this domain as trusted" is a simple regex on the sender's email address, including the account name. So, it would appear that there is no analysis of the headers, MX records, SPF records, etc. on the client-side.

That means that a spoofed allowed email address from a blocked domain could be treated as an allowed email.

But this is the client-side of things. Header analysis should be done on the server-side, checking the SPF records, matching account domain with server domain, etc. By the time it gets to the client, all that should (that's a big 'should', I know) be required is a simple regex on the email account ("I don't want to hear from Bob").

I do a lot of phishing analysis and attack simulation, and I have successfully used a client's internal Exchange server to spoof internal employee's email from my own custom application. So, I know that hoping the server will do everything is a vain hope. But, my point is that the client really isn't designed or supposed to do this level of checking for you, protection at this level is expected to come from the server.

Answer 2

An attacker can do far more than spoof the "from" field. If a mail server is mis-configured, it can be used as a mail relay. In this case a malicious email can be crafted and really be from the domain you trust.

That being said, Outlook is simply applying a filter. Even if it did analyze the headers, how would you handle emails from an organization with multiple email servers? You would have to apply a new filter for every server.

Also, for reasons stated above, it is never a good idea to let your email client load anything automatically.