This article explains how to define the sender email address of Phishing and Ransomware simulations, and how to prevent some email clients from showing the "via livefense.com" message (or similar) next to the sender.
Why the "via livefense.com" message appears
All Phishing and Ransomware simulations from SMARTFENSE are always sent from the email account info@livefense.com.
To recreate the scenario, spoofing (impersonation) is used: the email shows the address defined in the scenario as the sender, instead of info@livefense.com.
Because the address shown in the email differs from the real address it is sent from, some email clients may display a message such as "via livefense.com" (or similar) next to the sender's name and email address.
To prevent this message from appearing, one option is to perform impersonation only in the From field. The Email address field must contain the real value, without impersonation.
This can be configured broadly, for all Phishing and Ransomware simulation emails, from the Senders section.
Sender fields in simulations
All Phishing and Ransomware simulation contents have two fields referring to the sender of the email:
- From: sender's name.
- Email address: sender's email address.
These values are usually set so that impersonation of a person or organization is performed, following the simulation scenario.
How to configure the sender
- From the main menu, go to Settings > Simulations > Senders.
- Under Sender's email address, select one of the available options (see details below).
- Click Save.
Each option has a help icon that shows, on screen, which data the email sender will use.
Important: the change does not apply to campaigns in progress. It will apply to subsequent campaigns.
Recommended configuration: use the value defined in the scenario and configure the exception in Spoof Intelligence (EOP). This preserves the realism of the simulation and gives the email a good look and feel on delivery. If your security tool does not allow this exception to be configured, we recommend using DMI (Direct Message Injection) as the delivery method, which is configured under Settings > Simulations > Delivery method*. With DMI, the "via livefense.com" message (or similar) is not shown, even when keeping the value defined in the scenario.
Available options
Use value defined in the scenario
The sender data of the simulation email will be the data set in the content of each scenario, in the fields:
- From: sender's name.
- Email address: sender's email address.
With this option, the impersonation defined in the scenario is kept. It is the option selected by default and the recommended one, together with the exception in Spoof Intelligence (EOP).
Use a fixed value that does not cause impersonation and therefore avoids the appearance of the message "via livefense.com" or similar
The sender data of the simulation email will be:
- From: sender name set in the content.
- Email address: info@livefense.com.
With this option, the sender name stays as set in the scenario, but the email address no longer impersonates an identity. Use it when it is not possible to configure the exception or use DMI.
💡 Best practices
- Use the value defined in the scenario and configure the exception in Spoof Intelligence (EOP), whenever your security tool allows it. This is the recommended configuration for a good look and feel on delivery and to keep the simulation realistic.
- If your security tool does not allow the exception to be configured, use DMI (Direct Message Injection) as the delivery method. This method injects emails directly into users' inboxes, bypassing most of the organization's filtering tools and rules, and prevents the "via livefense.com" message (or similar) from appearing. See the articles Microsoft - How to configure simulation delivery via DMI (Direct Message Injection) or Google - How to configure simulation delivery via DMI (Direct Message Injection), as applicable.
- Use the fixed value only when it is not possible to configure the exception or use DMI, and the "via livefense.com" message (or similar) is detected in simulation emails.
- Keep in mind that, with the fixed value, the email address no longer reproduces the one in the scenario, so the realism of the simulation relies solely on the sender name.
- Validate the result with a test campaign before launching the campaign to the entire organization.
- Define this setting before scheduling campaigns, since it does not modify those already in progress.
- Confirm that the address info@livefense.com is allowed in the safe sender lists (whitelist) of your email server or filter.