How do you restrict who can email a distribution list?

Company-wide addresses like all@, staff@ or everyone@ are a gift to spammers. One message to a group reaches every inbox at once, and a phishing email that appears to come through an internal list looks more trustworthy. The fix is simple: only people who should post to a list can post to it. This guide covers Microsoft 365, Google Workspace, and how to make exceptions for partners without reopening the door.

Why do distribution lists attract spam?

A list address multiplies whatever reaches it. Spam sent to a 60-person all@ list becomes 60 messages, and every recipient gets a chance to click. These addresses also leak easily: they appear in website footers, press releases, old signatures and contact lists. Our guide to protecting public email addresses from spam explains how harvesting works.

There are only a few groups that need outside mail. Most internal lists, such as all-staff, managers and department lists, never should receive it. Restrict those first.

How do you restrict a distribution list in Microsoft 365?

Exchange Online has several group types that can receive mail: distribution lists, mail-enabled security groups, dynamic distribution groups and Microsoft 365 groups. They're configured in slightly different places.

Distribution lists in the Exchange admin center

1. Open the Exchange admin center and go to Recipients > Groups > Distribution list.
2. Select the group and open the Settings tab.
3. Under Delivery management, choose Only allow messages from people inside my organization.
4. Select Save.

Microsoft describes the result plainly: "if someone outside your organization sends an email message to this group, it is rejected. This is the default setting" (Microsoft Learn). The other option, Allow messages from people inside and outside my organization, lets anyone on the internet send to the group.

Distribution lists in PowerShell

The same setting is the RequireSenderAuthenticationEnabled parameter. Microsoft defines $true as "Messages are accepted only from authenticated (internal) senders. Messages from unauthenticated (external) senders are rejected."

Find groups that accept outside mail:

Get-DistributionGroup -ResultSize Unlimited | Where-Object {$_.RequireSenderAuthenticationEnabled -eq $false} | Format-Table Name,PrimarySmtpAddress

Restrict one:

Set-DistributionGroup -Identity "All Staff" -RequireSenderAuthenticationEnabled $true

New groups created with New-DistributionGroup default to $true, but groups created years ago, migrated, or opened up for a single vendor often don't. Audit them all.

Dynamic distribution groups

Dynamic groups build their membership from rules, such as everyone in a department. They're ideal for all-staff lists because leavers drop out automatically. Microsoft says that for these groups, "By default, only people inside your organization can send messages to this group", and the Delivery management options are the same (Microsoft Learn). In PowerShell, Set-DynamicDistributionGroup takes the same RequireSenderAuthenticationEnabled parameter.

Microsoft 365 groups

Microsoft 365 groups, which also back Teams, have a single switch in the Microsoft 365 admin center:

1. Go to Teams & groups > Active teams & groups.
2. Select the group and open the Settings tab.
3. Make sure Let people outside the organization email the group is cleared, unless the group really needs outside mail.
4. Select Save.

Microsoft notes "It may take up to 30 minutes" for a change to take effect (Microsoft Learn). In PowerShell, the same setting is Set-UnifiedGroup -RequireSenderAuthenticationEnabled $true, and Get-UnifiedGroup shows the current value.

How do you restrict who can post to a Google Group?

Google Workspace controls this at two levels: an organization-wide policy and each group's own settings.

The organization-wide policy

In the Admin console, go to Menu > Apps > Google Workspace > Groups for Business > Sharing settings. The setting Group owners can allow incoming email from outside the organization is "Unchecked (not allowed)" by default (Google Workspace Admin Help). Leave it unchecked unless group owners genuinely need to open groups to outsiders. Google says changing it doesn't affect any existing external group member or message, so check existing groups separately.

Each group's access settings

As an admin:

1. Go to Menu > Directory > Groups and click the group.
2. Click Access settings, then Edit in the Access type section.
3. Choose an access type: Public, Team, Announcement only or Restricted. Or click individual cells to customize; Google then shows the type as Custom.
4. Check the Who can post row. For internal lists, make sure the External category, which Google says "includes anyone outside your organization", can't post. Check Who can contact group owners too, since it controls who "can directly email group owners".
5. Click Save.

The steps are in Google's update group details page. Announcement only suits an all-staff list where only managers or owners should send.

Group owners can make the same change at groups.google.com under Group settings > General > Who can post, which Google describes as choosing "who can send messages to the group email address" (Google Groups Help).

Spam handling for groups that must stay open

For groups that need outside mail, such as a sales@ group, set Spam message handling in the posting policies. Google offers Reject all messages marked as spam, two moderation options, and Post suspicious messages to the group. Moderation only helps if someone reviews the queue.

Which lists should accept outside mail?

Sort your groups into three kinds before you change anything. It takes a few minutes and avoids breaking a list a customer relies on.

For the first two kinds, close the list. For the third, ask whether a group is the right tool at all. A shared mailbox or helpdesk gets one copy of each message, lets the team see who replied, and is filtered like any mailbox. A group copies every spam message to every member.

Common mistakes

• Opening a list for one vendor. Someone ticks "allow outside senders" so a supplier can reach accounts@, and forgets to undo it. Use a specific exception instead.
• Nested groups. A closed outer group can contain an inner group that accepts outside mail directly. Check both.
• Forgotten aliases. A group can have several addresses. Restricting senders covers all of them, but old aliases still show up in old signatures, so retire the ones nobody uses.
• Publishing the address. An all-staff address in a website footer or press release will be harvested. Use a role mailbox for public contact.

How do you allow partners without opening the list to everyone?

Sometimes a supplier, accountant or parent company needs to post to an internal list. Make a narrow exception, not a general one.

Two cautions apply to every exception:

• Addresses can be forged. An exception based on a sender address is only as strong as that domain's authentication. Check that the partner publishes an enforced DMARC policy with the DMARC Checker, and keep the exception list short.
• Lists that must be public are better as mailboxes. If outsiders need a general address, point it at a shared mailbox or helpdesk and keep your internal lists closed. Our whitelisting guide explains why sender-based allows should always require authentication.

How do you check the change worked?

1. From an outside account, such as a personal Gmail address, send a test message to the restricted list.
2. Expect a bounce (a non-delivery report) instead of delivery. The SMTP error codes lookup can decode the code it contains.
3. Send from an internal account and from any partner you allowed, and confirm both arrive.
4. If outside mail still arrives, open its headers in the Email Header Analyzer. Mail that reaches the group by another route, such as forwarding from a member's mailbox or a misconfigured connector, won't be stopped by the group setting.

Next steps

• Export a list of every mail-enabled group and its external posting setting, and close every one that doesn't need outside mail.
• Replace static all-staff lists with dynamic groups on Microsoft 365 so leavers drop out automatically.
• Write down each partner exception, who asked for it and when to review it.
• Treat phishing that arrives through a group like any other. Our guide to stopping phishing in Microsoft 365 covers the wider settings, and an inbound filter such as iBlockSpam adds allow and block lists that can require sender verification.