3

I'm trying to find a solution to block the sending of emails to domains with typo errors in it, for example gmai.com or outlok.com.

I am working for a client who uses Office 365 that would like to make sure the address is correct for some specific domains they share private information with via email so they don't end up sending important stuff to a catchall mailbox on a parked domain.

Improve this question
5
  • One easy way would be to come up with a list of typo domains and blacklist those. Would that work? – schroeder♦ Jul 16 '19 at 14:18
  • If you are looking for a product recommendation, those are off-topic here. – schroeder♦ Jul 16 '19 at 14:20
  • 2
    "... they share private information with via email so they don't end up sending important stuff to ...". Keep in mind that words like "important" and "private" don't mix with "email" unless you are using content encryption. While the use of encrypted federated relays has improved dramatically in recent years, email is fundamentally an insecure transport mechanism. – user10216038 Jul 16 '19 at 15:00
  • make sure to include all typos of names in the list so nobody can send an email to john.exampl@outlook.com instead of john.example@outlook.com – Josef says Reinstate Monica Jul 16 '19 at 15:20
  • Thx schroeder, I am not looking for product recommandation. I think the blacklist thing could work, it's a bit tedious to maintain with a big list of domains. I'll maybe look into using some regex filters. – JTouz Jul 17 '19 at 15:10
1

I've implemented this before for the same exact issue because there is no "simple fix" for typo's here's how to cleanly handle it.

First a company policy needs to be written and employees need to read and sign that they acknowledge it and SANS has some good boilerplate's that can be used. The policy must state that all sensitive emails MUST be sent by using a global address book which is centrally managed. Here you put in all the correct email addresses and also confirm that they are correct before telling the users to use them and showing them how to access them. The policy needs to be very clear that ONLY the Global Access List (GAL) is to be used for sensitive emails and that if not followed may take action against the employee for disciplinary action.

Second, either completely disable autocomplete or train the users how to remove invalid addresses one at a time.

Third, train the employees of the new policy and it will only happen when they intentionally do not select the users from the GAL.

Lastly, if information is truly sensitive like patient information, credit cards, etc. then a 3rd party email encryption product should be used. If you are in a regulated industry like in medical with HIPAA and HITECH then encryption systems like this MUST be used or they can be fined or they can stick with only faxing while the recipient is waiting to receive or use SFTP/FTPS but that's a whole other conversation.

Improve this answer
3
  • A policy is not the best method for this. Proper procedural training is what you want to do. The policy backs up the training. – schroeder♦ Jul 17 '19 at 7:19
  • Studies have shown that disabling autocomplete actually increases the chance for missent emails, so you have to be careful how you implement. – schroeder♦ Jul 17 '19 at 7:20
  • I agree about the governance and employees formation aspect on a long term perspective. My problem is the delay before we have good results, just the encryption part is hard to implement with the actual staff we have. – JTouz Jul 17 '19 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.