The DMARC point of contact for aggregate reports SHALL include [email protected]
Part of CISA · Exchange Online · Email authentication · All checks
Invoke-Maester -TestId CISA.MS.EXO.4.3Overview
Section titled “Overview”The DMARC point of contact for aggregate reports SHALL include [email protected].
Rationale: Email spoofing attempts are not inherently visible to domain owners. DMARC provides a mechanism to receive reports of spoofing attempts. Including [email protected] as a point of contact for these reports gives CISA insight into spoofing attempts and is required by BOD 18-01 for FCEB departments and agencies.
Note: Only federal, executive branch, departments and agencies should include this email address in their DMARC record.
For other organization’s there are many services that offer managed DMARC analysis and reporting, though ensure you properly align your implementation with your organization’s policies for data handling.
Remediation action:
Section titled “Remediation action:”- See MS.EXO.4.1v1 Instructions for an overview of how to publish and check a DMARC record.
- Ensure the record published includes [email protected] as one of the emails for the RUA field.
Related links
Section titled “Related links”- Exchange admin center - Accepted domains
- CISA 4 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) - MS.EXO.4.3v1
- CISA ScubaGear Rego Reference
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.4.3 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1684.002 Email Spoofing |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.4.3 |
| Criticality | SHALL |
| Upstream requirement | MS.EXO.4.3v1 |
| Supports controls | cisa-scuba:MS.EXO.4.3, nist-800-53-r5:SI-4(5) |
| PowerShell test | Test-MtCisaDmarcAggregateCisa |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/cisa/exchange/Test.CISA.MS.EXO.4.3.ps1 - Documentation:
tests/cisa/exchange/Test.CISA.MS.EXO.4.3.md