Policies are configured to honor sending domains DMARC

Contributed by Michael SouleAll contributors →

Part of ORCA · Defender · Anti-phishing · All checks

Run this check

Invoke-Maester -TestId ORCA.244

Overview

Domain-based Message Authentication, Reporting & Conformance (DMARC) is a standard that helps prevent spoofing by verifying the senders identity. If an email fails DMARC validation, it often means that the sender is not who they claim to be, and the email could be fraudulent. The owner of the sending domain controls the DMARC policy for their domain, and provides recommendations to receivers on what action should be performed when DMARC fails. When the Honor DMARC Policy setting is set to False, the organisations policy is not considered. It is recommended to honor this policy.

Remediation action

Configure anti-phish policy to honor sending domains DMARC configuration.

Related Links

• Announcing New DMARC Policy Handling Defaults for Enhanced Email Security
• Microsoft 365 Defender Portal - Anti-phishing

Details

Every attribute of this check

Field	Value
Test ID	ORCA.244
Severity	Medium
Suite	ORCA
Product	Defender
Related products	Exchange Online
Feature	Anti-phishing
Area	Email and collaboration protection
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing, T1684.002 Email Spoofing
Supports controls	nist-800-53-r5:SI-8
PowerShell test	Test-ORCA244
Services	ExchangeOnline

Source

• Test: tests/orca/Test.ORCA.244.ps1
• Documentation: tests/orca/Test.ORCA.244.md