Summary
Learn how to identify the "External" badge in your Outlook inbox, understand why external content like images and links may be blocked for your safety, and how to verify a sender's identity before interacting with a message.
Body
To help protect your account from phishing and spoofing, the university uses an External Email Warning Tag to clearly identify messages originating from outside our organization.
How to Use the External Tag
When you see the External badge on an email, it is a reminder to pause and verify the sender's identity before interacting with the message. This tag is an automatic safety feature and does not mean the email is definitely malicious—only that it came from a non-university source.
Automatic Content Blocking
For your protection, Outlook automatically blocks certain content in external emails to prevent malicious tracking or "one-click" phishing attacks. This includes:
- Images & Pictures: Hidden tracking pixels used by spammers are disabled.
- Links & Buttons: Interactive elements may be restricted until you confirm the sender.
- Attachments: Files are scanned but held until you acknowledge the external origin.
Action Required: If you verify the sender is legitimate, click "Show Blocked Content" or "Trust this Sender" in the warning bar at the top of the message to reveal the full content.
Visual User Experience
The appearance of the safety tag varies slightly depending on the device you are using to check your email. Refer to the examples below to see how these warnings appear on your device.
Figure 1: Desktop Outlook (Windows, Mac, and Web)
Figure 2: Outlook Mobile (iOS and Android)
What is "External"?
An email is tagged as external if the sender is not using a university-managed email account. This includes:
- Personal accounts (Gmail, Yahoo, etc.)
- External vendors and partners
- Other educational institutions
Safety Checklist
If an email is tagged External, ask yourself:
- Did I expect this email from this specific sender?
- Is the sender asking for sensitive info or a "quick favor"?
- Does the "From" address match the person's name?
If something feels off, do not click. Contact the IT Help Desk for verification.
Evaluating Tagged Emails
The external tag helps you spot spoofing—where a hacker tries to look like a university official by using a generic personal email address.
Suspicious (High Risk)
From: President Smith <official.pres123@gmail.com> [External]
Warning: A university official would use their internal account. The combination of an internal name and an external tag is a major red flag.
Legitimate (Low Risk)
From: Adobe Support <mail@adobe.com> [External]
Context: This is a known external vendor. The tag correctly identifies them as outside the university, but the email is expected.
Frequently Asked Questions
- Can I turn this off for my account? No. This is a university-wide security standard designed to protect the entire organization from data breaches.
- The tag is on a legitimate email. Is it safe? Yes, the tag is simply a "label of origin." If you know the sender and were expecting the file or link, you can proceed as usual.