We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with the following format (our email addresses/names have been sanitised):
From: Bob Smith Bob@spoofed.com <email@example.com> Date: Wed, Aug 26, 2020 at 10:02 AM Subject: External legal counsel. To: <firstname.lastname@example.org> tim, I am contacting you regarding a sensitive operation that I have approved and for which I need you to manage it, has Adv.Thomas Legler informed you about this case? Best Regards, Bob Smith Sent from my iPhone
The email From: header is:
From: "Bob Smith Bob@spoofed.com" <email@example.com>
So we can see that the Bob@spoofed.com "faked" email address that the phisher is trying to imitate is part of the email alias/phrase field. Such From headers might incorrectly lead recipients to believe the email has genuinely come from Bob@spoofed.com when in fact it's from firstname.lastname@example.org.
Are there any further best practice protections we can put in place to avoid spoofed email addresses being included in the email alias in this way?
If any further headers are required please let me know.