AI Assistant
Help Center AI Assistant is now available
Got questions about Lark? Use our AI chat to find the answers.
00:00
Click and hold to drag
Got It
Try Now

Admin | Prevent spoofing and phishing

2 min read
I. Intro
🔖
Who can perform these steps: Primary administrators or administrators with Email permissions.
As an administrator, you can configure phishing and spoofing prevention policies in the Lark Admin Console. These can protect members from fraudulent emails and phishing attempts.
II. Steps
  1. Enter the Lark Admin Console and click Product Settings > Mail > Security and Anti-spam > Prevent Spoofing and Phishing.
250px|700px|reset
There are four types of phishing and spoofing prevention policies available:
Strategy Name
Description
Protect against inbound emails spoofing your domain
Prevents inbound emails that impersonate the organization's domain name and have not passed SPF or DKIM authentication.
Protect against emails unauthenticated with SPF/DKIM
Prevent all inbound emails that have not passed SPF or DKIM authentication.
Protect against spoofing of employee names
Prevents inbound emails from outside the organization if the sender's name matches the name of a member (including default name and alias) within the organization.
Protect against domain spoofing based on similar domain names
Prevents inbound emails from outside the organization that use domains similar to the organization's domain.
Note: To protect against the spoofing of employee names, you need to manually add members who could potentially be impersonated. For instance, you might want to include your head of HR in the list to prevent successful impersonation attempts.
  1. Click Edit in the upper-right corner. Next, set who the policy applies to and what actions to take.
Application scope has the following two options:
250px|700px|reset
image.png
  • To the entire organization: This policy will apply to all members of the company.
  • To the selected range: Select members, departments, public mailboxes, or user groups this policy applies to.
Perform action has the following three options. When an email fails to pass the set policy, the selected action will be performed.
250px|700px|reset
  • Keep emails in "Inbox" and show warning: The email is sent as normal to the recipient's mailbox. However, the recipient will see the following warning:
250px|700px|reset
Note: The warning that appears is different for each policy.
  • Move to the recipient's "Spam" folder: The email is sent to the recipient's spam folder and includes a warning.
  • Move to the spam quarantine: The email is sent to spam quarantine. The recipient will not receive the email. You can go to Product Settings > Mail > Security and Anti-spam > Quarantine Area > Spam to view and perform actions on the email.
250px|700px|reset
  1. After you configure the policies, click Apply in the lower-right corner.
250px|700px|reset
III. FAQs
What should be done if an email is flagged by a policy, even though it is not a phishing or spoofed email?
You can add email addresses or domains to the email allowlist to avoid emails from the sender or domain being regarded as spam. However, if the email hasn't passed SPF or DKIM authentication, the allowlist function will not take effect.
Written by: Lark Help Center
Updated on 2024-10-12
How satisfied are you with this content?
Thank you for your feedback!
Need more help? Please contact Support.
0
rangeDom
rangeDom