Is there a way to search the inbound MEG for the Display Names?
We have a situation where we want to search for the following case:
We received a mail from "Kev Josephs" <email@example.com> when I check the Meg, I can only find it by searching for *ceo.mail.koaha.org and not Kev Josephs
This is a case of repeated misuse of a legit staff members display name. We have enabled SPF checking, so the spoofers cannot use our domain name, but, we continue to get new instances where the domain names are changing
Re: Is there a way to search the inbound MEG for the Display Names?
No, there is not. You can only search the sender adresses that have been seen on the smtp envelope. Also this information is stored on the meta data that can be investigated on the Email Gateway reports.
The Adress you are looking for is buried in the mail header. Unfortunately this one is easy to fake or modify, and is very often abused to fool recipients.
You may check the "from" tag on the Mailheader as a criteria for Anti-Spoofing Policies on your Email Gateway in order to get those fakes sorted out.
Since 25 Years Microsoft is not able to display the real Email Adress on Outlook when opening a mail, now guess which one is the wrong horse to put the saddle on 😉