CIS.M365.2.1.8 - (L1) Ensure that SPF records are published for all Exchange Domains
Overview
Every custom domain that is accepted by Exchange Online publishes an SPF record that ends in a hard fail (-all) or soft fail (~all).
SPF lists the servers that may send mail for a domain. Receiving servers use it to reject, or to mark as suspicious, mail that pretends to come from your domain. Without an SPF record, or with one that ends in a neutral or permissive qualifier, anyone can send mail that looks like it comes from you without raising a flag.
The test follows a redirect modifier only when the record has no all mechanism, since receivers ignore the redirect in that case. Domains in the onmicrosoft.com namespace are skipped. Parked domains that never send mail should publish a record of "v=spf1 -all".
Remediation action
- Open the DNS zone of each custom domain at your DNS host.
- Create or edit the TXT record at the domain root so that it lists your sending services and ends with
-all(or~all). For Exchange Online only, usev=spf1 include:spf.protection.outlook.com -all. - Wait for the change to propagate and check the record with
Resolve-DnsName -Name <domain> -Type TXT.
Related links
- Set up SPF to help prevent spoofing
- Email authentication in Microsoft 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.1.8
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.2.1.8 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.8 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:2.1.8, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisSpfRecordsPublished |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.2.1.8.ps1 - Documentation:
tests/cis/Test.CIS.M365.2.1.8.md