CIS.M365.2.1.10 - (L1) Ensure DMARC records for all Exchange Online domains are published
Overview
Every accepted domain, including the initial onmicrosoft.com domain, has a DMARC policy of quarantine or reject that covers all mail and names addresses for aggregate and forensic reports.
DMARC tells receiving servers what to do with mail that fails SPF and DKIM alignment, and sends you reports about who is sending mail in your name. With a policy of none, spoofed mail is still delivered. Quarantine or reject stops it, and the reports show abuse and legitimate senders that you forgot.
The test uses the record at the domain, or at its organisational domain (for example contoso.com for mail.contoso.com) when the domain has no valid record, including a malformed record, applying the subdomain policy where one exists. The policy must apply to 100 percent of mail (no pct tag, or pct=100). Both rua and ruf addresses must be mailto addresses. Move to enforcement in steps and review the aggregate reports first.
Remediation action
- Open the DNS zone of each custom domain at your DNS host. For the initial
*.onmicrosoft.comdomain, use the Microsoft 365 admin center instead: go to Settings > Domains, select the*.onmicrosoft.comdomain, open the DNS records tab and select Add record. - Create or edit the TXT record
_dmarc.<domain>(in the admin center, the host name is_dmarc) with a value such asv=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@<domain>; ruf=mailto:dmarc-forensic@<domain>. - Start with
p=noneorp=quarantineif you are not sure that all your senders are aligned, review the reports and then move top=reject. - Check the record with
Resolve-DnsName -Name _dmarc.<domain> -Type TXT.
Related links
- Use DMARC to validate email
- Email authentication in Microsoft 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.1.10
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.2.1.10 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:2.1.10, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisDmarcRecordsPublished |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.2.1.10.ps1 - Documentation:
tests/cis/Test.CIS.M365.2.1.10.md