title: Office 365 Exchange Transport Rule to Warn About External Links
body: <p>I need help please!</p>
  
  <p>I work for the NHS at a hospital in the UK and we're getting a lot of phishing attacks.  Some are specifically targeted at our domain users - Some people really don't have any morals.</p>
  
  <p>I know staff need to be more vigilant to identify phishing emails, but at the moment they have too many other things to be worrying about with the current COVID-19 pandemic.</p>
  
  <p>I'm trying to create a Transport Rule in Exchange Online (Office 365) to warn the recipient (internal/external) of any email (inbound/outbound/internal) that contains a http/https link that is not within a set of defined domains.</p>
  
  <p>I've figured out a regex expression that works and have given some examples at the following link:
  <a href="https://regex101.com/r/wkOV4W/3" rel="nofollow noreferrer">https://regex101.com/r/wkOV4W/3</a></p>
  
  <p>The expression is:</p>
  
  <p><code>https?:\/\/[\w\d\.]*(?&lt;!(CorrectDomain1\.co\.uk))(?&lt;!(CorrectDomain2\.com))(?&lt;!(CorrectDomain3\.org))(\/|\"|\t|\r|\n|\s)</code></p>
  
  <ol>
  <li>http:// or https://</li>
  <li>Zero or more subdomains (containing letters, numbers, dots) if any exist</li>
  <li>Lookback doesn't match CorrectDomain1.co.uk or CorrectDomain2.com or CorrectDomain3.org</li>
  <li>Next character is a Forward-Slash, Double-Quote, Tab, CR, LF, White-Space</li>
  </ol>
  
  <p>The list of valid domains are:</p>
  
  <ul>
  <li>CorrectDomain1.co.uk</li>
  <li>CorrectDomain2.com</li>
  <li>CorrectDomain3.org</li>
  </ul>
  
  <p>Any <strong>other</strong> domain or sub-domain should be matched and add a message at the top of the email:</p>
  
  <blockquote>
    <p>WARNING: THIS EMAIL CONTAINS A LINK THAT POINTS OUTSIDE OUR ORGANISATION - PLEASE BE CAREFUL IF YOU ARE ASKED TO ENTER A USERNAME OR PASSWORD</p>
  </blockquote>
  
  <p>When I use this on Exchange, everything works perfectly, apart from one.</p>
  
  <p>This doesn't work: <code>&lt;a href="http://www.WrongDomainA.co.uk"&gt;Link&lt;/a&gt;</code></p>
  
  <p>This does work: <code>&lt;a href="http://www.WrongDomainA.co.uk/"&gt;Link&lt;/a&gt;</code>, this does work <code>http://www.WrongDomainA.co.uk</code></p>
  
  <p>I know the difference is the slash at the end, but that isn't included in the one where I sent the email in plain text, which worked.</p>
  
  <p>Any thoughts and help on how I can improve this would be greatly appreciated. - I couldn't find a functionality like this in 365 Security &amp; Compliance.</p>
  
  <p>[<strong>Note1</strong>: I should probably include a colon in step 4 to cater for ports]</p>
  
  <p>[<strong>Note2</strong>: I did try combining the domains <code>(?&lt;!(CorrectDomain1\.co\.uk|CorrectDomain2\.com|CorrectDomain3\.org))</code>, but it didn't work on the regex101 test because <em>A lookbehind assertion has to be fixed width</em>]</p>
  
  <p>[<strong>Note3</strong>: I'm restricted with Exchange because: <em>You cannot configure a pattern with groups of multiple match conditions like</em> (.*, <em>.+, .{0,n} or .{1,n}). Remove the group or the multiple match condition from the pattern to continue.</em>]</p>