@andrewt My work's last phishing email was set up to get past Mimecast's impersonation detection (which would highlight a real phishing email as being from an external sender), and then they tied themselves in knots when asked whether this was something a phisher could actually do. To this day I don't know for sure whether impersonation protection is reliable.