# Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies

Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies: Emails coming from allow listed domains bypass several layers of…

Source: https://maester.dev/docs/tests/ORCA.118.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/thomas-s-schmidt" title="Thomas Schmidt · Original author"><img src="https://github.com/thomas-s-schmidt.png" alt="Thomas Schmidt" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/thomas-s-schmidt">Thomas Schmidt</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/orca">ORCA</a> · Defender · Anti-spam · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ORCA.118.3
```

## Overview

Emails coming from allow listed domains bypass several layers of protection within Exchange Online Protection. When allow listing your own domains, an attacker can spoof any account in your organisation that has this domain. This is a significant phishing attack vector.

#### Remediation action

Remove allow listing on domains belonging to your organisation.

#### Related Links

* [Microsoft 365 Defender Portal - Anti-spam settings](https://security.microsoft.com/antispam)
* [Use Anti-Spam Policy Sender/Domain Allow lists](https://aka.ms/orca-antispam-docs-4)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ORCA.118.3 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-spam |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | [Test-ORCA118_3](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.118.3.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/orca/Test.ORCA.118.3.ps1`](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.118.3.ps1)
- Documentation: [`tests/orca/Test.ORCA.118.3.md`](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.118.3.md)