The DMARC message rejection option SHALL be p=reject

Contributed by Michael Soule with Jean-Philippe GeorgeAll contributors →

Part of CISA · Exchange Online · Email authentication · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.4.2

Overview

The DMARC message rejection option SHALL be p=reject.

Rationale: Of the three policy options (i.e., none, quarantine, and reject), reject provides the strongest protection. Reject is the level of protection required by BOD 18-01 for FCEB departments and agencies.

Remediation action:

• See MS.EXO.4.1v1 Instructions for an overview of how to publish and check a DMARC record.
• Ensure the record published includes p=reject.

Related links

• Exchange admin center - Accepted domains
• CISA 4 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) - MS.EXO.4.2v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.4.2
Severity	High
Suite	CISA
Product	Exchange Online
Feature	Email authentication
Area	Email and collaboration protection
Resource type	Domain
User impact	Medium
Implementation cost	High
MITRE ATT&CK	T1566 Phishing, T1598 Phishing for Information, T1684.002 Email Spoofing
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.4.2
Criticality	SHALL
Upstream requirement	MS.EXO.4.2v1
Supports controls	cisa-scuba:MS.EXO.4.2, nist-800-53-r5:SI-8
PowerShell test	Test-MtCisaDmarcRecordReject
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.4.2.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.4.2.md