The solution is to suspect every external message and send them all to the phishing mailbox. Tell your boss that you are following the phishing training that you did first.

They will have to get their shit together and send important messages from internal mail addresses. That’s just laziness.