title: What e-mail address ("From" vs. "Mail From") is considered by my block list?
body: <p>We are getting a lost of spam /phishing e-mails where the [From] is showing our own domain (e.g. "john@foobar.com"), but the [Mail From] (return-path) in the e-mail header is showing "root@foo-574401.hostbar.com".</p>
  
  <p>Question is now, which e-mail address is actually considered by the Exchange Online block list and could someone point me to the corresponding documentation of Microsoft? </p>
  
  <p>In case the block-list does not consider the [Mail From] we need to setup an transport-rule to address those kind of e-mails? </p>