# (L1) Ensure that DKIM is enabled for all Exchange Online Domains
2.1.9 (L1) Ensure that DKIM is enabled for all Exchange Online Domains
Source: https://maester.dev/docs/tests/CIS.M365.2.1.9
Part of CIS · Defender · Email authentication · All checks
```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.2.1.9
```
## Overview
2.1.9 (L1) Ensure that DKIM is enabled for all Exchange Online Domains
DKIM is one of the trio of Authentication methods (SPF, DKIM and DMARC) that help prevent attackers from sending messages that look like they come from your domain. DKIM lets an organization add a digital signature to outbound email messages in the message header. When DKIM is configured, the organization authorizes it's domain to associate, or sign, its name to an email message using cryptographic authentication. Email systems that get email from this domain can use a digital signature to help verify whether incoming email is legitimate. Use of DKIM in addition to SPF and DMARC to help prevent malicious actors using spoofing techniques from sending messages that look like they are coming from your domain.
#### Rationale
By enabling DKIM with Office 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and not being spoofed.
#### Impact
There should be no impact of setting up DKIM however, organizations should ensure appropriate setup to ensure continuous mail-flow.
>Note: Initial (MOERA, e.g. `contoso.onmicrosoft.com`) and coexistence (`*.mail.onmicrosoft.com`) domains are excluded from this check, as Microsoft automatically signs outbound mail for those domains.
For each sending domain, the check requires Exchange DKIM to be enabled and its status to be **Valid**.
#### Remediation action
To remediate using a DNS Provider:
1. For each accepted domain in Exchange Online, two DNS entries are required.
```txt
Host name: selector1._domainkey
Points to address or value: selector1-._domainkey.
TTL: 3600
Host name: selector2._domainkey
Points to address or value: selector2-._domainkey.
TTL: 3600
```
For Office 365, the selectors will always be **selector1** or **selector2**.
domainGUID is the same as the domainGUID in the customized MX record for your custom domain that appears before mail.protection.outlook.com. For example, in the following MX record for the domain contoso.com, the domainGUID is contoso-com:
```txt
contoso.com. 3600 IN MX 5 contoso-com.mail.protection.outlook.com
```
The initial domain is the domain that you used when you signed up for Office 365. Initial domains always end with onmicrosoft.com.
1. After the DNS records are created, enable DKIM signing in Defender.
2. Navigate to [Microsoft 365 Defender](https://security.microsoft.com)
3. Expand **Email & collaboration** > **Policies & rules** > **Threat policies**.
4. Under **Rules** section click **Email authentication settings**.
5. Select **DKIM**
6. Click on each domain and click **Enable** next to **Sign messages for this domain with DKIM signature**.
Final remediation step using the Exchange Online PowerShell Module:
1. Connect to Exchange Online service using `Connect-ExchangeOnline`.
2. Run the following Exchange Online PowerShell command:
```powershell
Set-DkimSigningConfig -Identity < domainName > -Enabled $True
```
#### Related links
* [Microsoft 365 Defender](https://security.microsoft.com)
* [Set up DKIM to sign mail from your cloud domain](https://learn.microsoft.com/defender-office-365/email-authentication-dkim-configure?view=o365-worldwide)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 112](https://www.cisecurity.org/benchmark/microsoft_365)
## Details
Every attribute of this check
| Field | Value |
| --- | --- |
| Test ID | CIS.M365.2.1.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:2.1.9, nist-800-53-r5:SC-8 |
| PowerShell test | [Test-MtCisDkim](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.2.1.9.ps1) |
| Services | ExchangeOnline |
## Source
- Test: [`tests/cis/Test.CIS.M365.2.1.9.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.2.1.9.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.2.1.9.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.2.1.9.md)
