I use "Outlook on the Web" (OWA) to access my company email address.

Some emails that I receive include the following warning:

This sender [email protected] is from outside your organization. Block sender.

Sometimes emails that originate from outside my organization do not also include the warning.

Where in OWA can I find a list of domains or addresses that get the warning applied?

Alternatively, is there a way in OWA to list the domains and addresses that are considered "Internal" to the organization, so I can figure out which domains are "External" to my account?


1 Answer 1


How can I find a list of addresses that are "outside your organization"?

  1. Search your messages in the web app for any that you know to originate from other organizations and note any missing the "External Sender Identification."
  2. Ask your organization's mail admins to provide you with the contents of their exception list.
  3. Access the information via ExchangePowerShell using admin privileges.

External Sender Identification

Your organization uses "External Sender Identification" to add a warning message to incoming emails that originate from outside your organization.

Email is considered to originate from outside your organization if the sender domain doesn't match one of Exchange's "accepted" domains. "Accepted" domains are any that are configured in Exchange as either "authoritative" or "relay" domains.

Exchange admins can optionally exclude messages that would otherwise be identified by adding addresses and/or domains to an exception list.

Why can't I access the list?

Current security best practices are based on "keeping doors closed unless and until they need opening" rather than "closing doors as needed."

  • Non-privileged users are exposed to the "accepted" domains that are relevant to them (eg. organization email/alias domains, directory listings, etc.).
  • Non-privileged users are exposed to exceptions to 'external sender identification' that is relevant to them when a message they know to be from another organization is not identified.
  • I don't yet see a compelling use case presented for allowing non-privileged users to query the exception list or the Exchange domain configuration.
  • I do see security risks associated with non-privileged access to these tools.

Additional Resources:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.