DKIM SHOULD be enabled for all domains
Part of CISA · Exchange Online · Email authentication · All checks
Invoke-Maester -TestId CISA.MS.EXO.3.1Overview
Section titled “Overview”DKIM SHOULD be enabled for all domains.
Coexistence domains related to Hybrid Configuration Wizard (HCW) are skipped. Production use of coexistence domains is discouraged, and additional controls, such as transport rules, should be used to restrict their use.
Rationale: An adversary may modify the FROM field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Enabling DKIM is another means for recipients to detect spoofed emails and verify the integrity of email content.
Every other accepted domain is checked, including a parked domain that never sends email: MS.EXO.3.1v1 asks for DKIM on all domains and gives no separate rule for one. Turning off Allow mail to be sent from this domain in Exchange no longer leaves a domain out of this test, and the ParkedDomains global setting does not change it.
Remediation action
Section titled “Remediation action”To enable DKIM, follow the instructions listed on Steps to Create, enable and disable DKIM from Microsoft 365 Defender portal | Microsoft Learn.
Related links
Section titled “Related links”- Defender admin center - Email authentication settings
- CISA 3 Sender Policy Framework - MS.EXO.3.1v1
- CISA ScubaGear Rego Reference
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.3.1 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1598 Phishing for Information, T1684.002 Email Spoofing |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.3.1 |
| Criticality | SHOULD |
| Upstream requirement | MS.EXO.3.1v1 |
| Supports controls | cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8 |
| PowerShell test | Test-MtCisaDkim |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/cisa/exchange/Test.CISA.MS.EXO.3.1.ps1 - Documentation:
tests/cisa/exchange/Test.CISA.MS.EXO.3.1.md