CIS.M365.6.2.2 - (L1) Ensure mail transport rules do not whitelist specific domains
Overview
No mail flow rule sets the spam confidence level to -1 for mail from specific sender domains.
A spam confidence level of -1 tells Exchange Online to deliver the message without spam filtering. If the rule matches a sender domain, anyone who can spoof that domain, or who compromises it, sends mail straight to your users, with the same trust as an internal sender.
Use the tenant allow/block list with an expiry for temporary exceptions, and fix the cause of the false positives, for example with SPF, DKIM and DMARC for the partner domain.
Remediation action
- Sign in to the Exchange admin center.
- Go to Mail flow > Rules.
- Open each rule that is listed in the test result and remove the action Set the spam confidence level (SCL) to Bypass spam filtering, or delete the rule.
Related links
- Exchange admin center - Mail flow rules
- Use mail flow rules to set the spam confidence level
- Create safe sender lists in Microsoft Defender for Office 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.2.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.2.2, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisTransportRulesNoDomainAllowList |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.2.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.2.2.md