Mature DMARC policy SHALL be published for every Entra managed and verified domain
Part of Maester · Entra ID · User and directory settings · All checks
Invoke-Maester -TestId MT.1182Overview
Section titled “Overview”A DMARC policy SHALL be published with reject policy for every verified and managed domain in the Entra tenent.
Rationale: Without a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling spoofed emails to reach end users’ mailboxes. Publishing DMARC records protects the domains and all subdomains.
reject policy with pct=100 is the recommended policy value that should be set after some time and results in a passed test.
Any policy with pct < 100 or quarantine will result in a “Low” severity fail.
none results in a failed test with “Medium” severity, assuming that only fully missing DMARC entry results in a “High” severity.
Remediation action
Section titled “Remediation action”DMARC is not configured directly through the Microsoft Admin Center, but rather via DNS records hosted by the agency’s domain. As such, implementation varies depending on how an agency manages its DNS records. See Form the DMARC TXT record for your domain | Microsoft Learn for Microsoft guidance.
A DMARC record published at the second-level domain will protect all subdomains. In other words, a DMARC record published for example.com will protect both a.example.com and b.example.com, but a separate record would need to be published for c.example.gov.
To test your DMARC configuration, consider using one of many publicly available web-based tools. Additionally, DMARC records can be requested using the PowerShell tool Resolve-DnsName. For example:
Resolve-DnsName _dmarc.example.com txt
If DMARC is configured, a response resembling v=DMARC1; p=reject; pct=100; rua=mailto:[email protected], mailto:[email protected]; ruf=mailto:[email protected] will be returned, though by necessity, the contents of the record will vary by agency. In this example, the policy indicates all emails failing the SPF/DKIM checks are to be rejected and aggregate reports sent to [email protected] and [email protected]. Failure reports will be sent to [email protected].
Related links
Section titled “Related links”- Microsoft Learn - Set up DMARC
- NSCS.gov - Protect Parked Domains
- CISA 4 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) - MS.EXO.4.1v1
- CISA ScubaGear Rego Reference
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1182 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Related products | Exchange Online |
| Feature | User and directory settings |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Medium |
| Implementation cost | High |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtDomainsDmarcRecordMaturity |
| Services | Graph |
Source
Section titled “Source”- Test:
tests/maester/entra/Test.MT.1182.ps1 - Documentation:
tests/maester/entra/Test.MT.1182.md