onmicrosoft.com global rule

That I know all mails from *@*.onmicrosoft.com are signed (but every subdomain have a different signer).

Since I got an unsigned mail that is phishing is it possible to specify that this domain must be globally signed without specify the signer domain?

[lieser]

Unfortunately the above rule interferes with the automatic adding of more precise rules for the onmicrosoft.com domain. Additionally in my opinion the usage of such domains unrelated to the one which should be responsible for the e-mail brings little value to the end user (onmicrosoft.com being a little better than most, as it used subdomains for each customer).

Given the reasons above, I currently don’t see myself adding such a rule to the defaults.

As a side note, in my opinion the e-mails should not be only signed by the onmicrosoft.com domain anyway. Any good service sending e-mails on behalf of third party’s should allow them to specify custom domains used for DKIM signing. And if I understand the documentation correctly, Microsoft does allow it: https://docs.microsoft.com/en-us/office365/SecurityCompliance/use-dkim-to-validate-outbound-email

[lieser]

It should be possible by creating the following sign rule:

• domain onmicrosoft.com
• From: * (i.e. matching all addresses)
• SDID: leave empty
• Rule type 1 (must be signed)
• Priority: lower than any other you have for the onmicrosoft.com domain specifying a specify SDID (e.g. 1000)