# DKIM SHOULD be enabled for all domains

Coexistence domains related to Hybrid Configuration Wizard (HCW) are skipped.

Source: https://maester.dev/docs/tests/CISA.MS.EXO.3.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/jeanphilippegeorge" title="Jean-Philippe George · Co-contributor"><img src="https://github.com/JeanPhilippeGeorge.png" alt="Jean-Philippe George" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/brianreidc7" title="Brian Reid · Co-contributor"><img src="https://github.com/brianreidc7.png" alt="Brian Reid" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/amlhive-tech" title="Haris Habib · Co-contributor"><img src="https://github.com/amlhive-tech.png" alt="Haris Habib" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/blindzero" title="Matthias · Co-contributor"><img src="https://github.com/blindzero.png" alt="Matthias" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a> with 4 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cisa">CISA</a> · Exchange Online · Email authentication · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CISA.MS.EXO.3.1
```

## Overview

DKIM SHOULD be enabled for all domains.

Coexistence domains related to Hybrid Configuration Wizard (HCW) are skipped.
Production use of coexistence domains is discouraged, and additional controls, such as transport rules, should be used to restrict their use.

Rationale: An adversary may modify the `FROM` field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Enabling DKIM is another means for recipients to detect spoofed emails and verify the integrity of email content.

Every other accepted domain is checked, including a parked domain that never sends email: MS.EXO.3.1v1 asks for DKIM on all domains and gives no separate rule for one. Turning off **Allow mail to be sent from this domain** in Exchange no longer leaves a domain out of this test, and the `ParkedDomains` global setting does not change it.

### Remediation action

To enable DKIM, follow the instructions listed on [Steps to Create, enable and disable DKIM from Microsoft 365 Defender portal | Microsoft Learn](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide#steps-to-create-enable-and-disable-dkim-from-microsoft-365-defender-portal).

### Related links

* [Defender admin center - Email authentication settings](https://security.microsoft.com/authentication?viewid=DKIM)
* [CISA 3 Sender Policy Framework - MS.EXO.3.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo31v1)
* [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/EXOConfig.rego#L107)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CISA.MS.EXO.3.1 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1598 Phishing for Information, T1684.002 Email Spoofing |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.3.1 |
| Criticality | SHOULD |
| Upstream requirement | MS.EXO.3.1v1 |
| Supports controls | cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8 |
| PowerShell test | [Test-MtCisaDkim](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.3.1.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cisa/exchange/Test.CISA.MS.EXO.3.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.3.1.ps1)
- Documentation: [`tests/cisa/exchange/Test.CISA.MS.EXO.3.1.md`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.3.1.md)