Tagging External Emails: Warning Banners in Outlook and Gmail

Why tag external emails at all

Business email compromise often uses a lookalike address or a display name copied from your director: 'Your Director <yourdirector.office@gmail.com>'. On a phone, only the display name shows. An External tag tells the reader this did not come from inside the company, whatever the name says.

Our guide to business email compromise explains the scam patterns these tags are designed to catch.

Microsoft 365: turn on the External tag in Outlook

Microsoft's Set-ExternalInOutlook documentation describes external sender identification for Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.

1. 1

   Remove old subject-tag rules first

   Microsoft says if you already use mail flow rules to add text to the subject of external messages, disable them before enabling this feature to avoid duplication.

2. 2

   Connect to Exchange Online PowerShell

   An Exchange admin signs in with the Exchange Online PowerShell module.

3. 3

   Enable the tag

   Run Set-ExternalInOutlook -Enabled $true. An 'External' icon is then added near the subject of messages from external senders.

4. 4

   Add trusted exceptions if needed

   Use -AllowList for addresses or domains that should not be tagged, such as your accounting firm. Up to 200 entries.

5. 5

   Wait and check

   Microsoft says it can take 24 to 48 hours for users to see the External icon. Test from a personal address.

Microsoft 365: first contact safety tip and unauthenticated senders

Microsoft's anti-phishing policy documentation lists two more indicators available to all Microsoft 365 cloud mailboxes, not only those with Defender for Office 365.

• Show first contact safety tip: warns recipients the first time they get a message from a sender, or when they don't often get messages from that sender. Microsoft recommends turning it on.
• Show (?) for unauthenticated senders: adds a question mark to the sender's photo when the message fails SPF or DKIM and doesn't pass DMARC or composite authentication.
• 'via' tag: shows when the From address domain differs from the domain that signed or sent the message.

These are set in the Microsoft Defender portal under anti-phishing policies, Safety tips and indicators. The first contact tip is the most useful against a lookalike supplier address, because it fires on the new address even if the display name is familiar.

Microsoft 365: a custom banner with a mail flow rule

If you want a visible banner in the message body, an Exchange mail flow rule can add one. Microsoft's guide to disclaimers and banners shows how to apply a disclaimer at the top (prepend) or bottom (append), in HTML or plain text.

Use either the native tag or a banner as the main signal, not both plus a subject prefix. Three warnings on every email train people to ignore all of them.

Google Workspace: Gmail warnings and subject tags

Gmail handles this differently. Google's article on external recipient warnings says warnings are on by default for Workspace accounts. Gmail shows a banner and a coloured marker when a thread includes external recipients, when replying to an external sender, and when composing to an external address, except for people in your directory or contacts.

Google's advanced phishing and malware protection settings include protection against spoofing of employee names, which catches the 'director's name from a Gmail address' trick directly. Google notes that certain spam bypass settings stop warning banners from showing at all, so check those if banners never appear.

Avoiding banner blindness

A warning on every external email becomes wallpaper within weeks. The aim is a quiet, consistent signal for 'outside' and a loud one for 'risky'.

Pair the tags with training: our guide on how to spot a phishing email is a good handout.

Do it yourself or get help?

Turning on Outlook's External tag and Gmail's defaults is quick for an admin. Tuning anti-phishing policies, writing exceptions that don't open holes, and adding payment-change rules takes more care.

Our Email Threat Protection (S$290) tunes Defender for Office 365 or Google Workspace protection, adds an external sender warning banner, impersonation protection for directors and finance staff, rules for payment-change and gift-card scams, and a Report phishing button, with a before-and-after report. For wider account security, our Microsoft 365 / Google Security Lockdown (S$590) covers MFA and admin roles. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.