# Anti-phishing policy exists and EnableUnauthenticatedSender is true
Anti-phishing policy exists and EnableUnauthenticatedSender is true: When the sender email address is spoofed, the message appears to originate from…
Source: https://maester.dev/docs/tests/ORCA.111
Part of ORCA · Defender · Anti-phishing · All checks
```powershell title="Run this check"
Invoke-Maester -TestId ORCA.111
```
## Overview
When the sender email address is spoofed, the message appears to originate from someone or somewhere other than the actual source. It is recommended to enable unauthenticated sender tagging in Office 365 Anti-phishing policies. The feature apply a '?' symbol in Outlook's sender card if the sender fails authentication checks.
#### Remediation action
Enable unauthenticated sender tagging in Anti-phishing policy.
#### Related Links
* [Microsoft 365 Defender Portal - Anti-phishing](https://security.microsoft.com/antiphishing)
* [Recommended settings for EOP and Office 365 Microsoft Defender for Office 365 security](https://aka.ms/orca-atpp-docs-6)
* [Unverified Sender](https://aka.ms/orca-atpp-docs-12)
## Details
Every attribute of this check
| Field | Value |
| --- | --- |
| Test ID | ORCA.111 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | [Test-ORCA111](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.111.ps1) |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
## Source
- Test: [`tests/orca/Test.ORCA.111.ps1`](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.111.ps1)
- Documentation: [`tests/orca/Test.ORCA.111.md`](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.111.md)
