Detections
Analytics

2.1.10 Ensure DMARC records for all Exchange Online domains are published

Information

DMARC, or Domain-based Message Authentication, Reporting, and Conformance, assists recipient mail systems in determining the appropriate action to take when messages from a domain fail to meet SPF or DKIM authentication criteria.

DMARC strengthens the trustworthiness of messages sent from an organization's domain to destination email systems. When combined with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), DMARC significantly enhances defenses against email spoofing and phishing attempts.

This includes the MOERA domain (e.g., contoso.onmicrosoft.com), which is provisioned with every Microsoft 365 tenant and is capable of originating email. Because it is often overlooked in favor of custom domains, it represents a common gap in email authentication coverage if left unprotected.

Leaving a DMARC policy set to p=none can result in the mail system taking no action when a spear-phishing email fails DMARC but passes SPF and DKIM checks. Having DMARC fully configured is a critical part of preventing business email compromise.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using a DNS provider:

 - For any out of compliance domain sending email, add the following record to DNS:

Record: _dmarc.domain1.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:<[email protected]>; ruf=mailto:<[email protected]>

 - This will create a basic DMARC policy that will allow the organization to start monitoring message statistics.
3. One week is enough time for data generated by the reports to be useful in understanding email trends and traffic. The final step requires implementing a policy of p=reject OR p=quarantine and pct=100 with the necessary rua and ruf email addresses defined:

Record: _dmarc.domain1.com
Type: TXT
Value: v=DMARC1; p=reject; pct=100; rua=mailto:<[email protected]>; ruf=mailto:<[email protected]>

 Parked Domains:
For any domain not used for sending email, add the following record to DNS:

Record: _dmarc.domain1.com
Type: TXT
Value: v=DMARC1; p=reject;

To remediate the MOERA domain using the UI:

 - Navigate to the Microsoft 365 admin center https://admin.microsoft.com/
 - Expand Settings and select Domains.
 - Select your tenant domain (for example, contoso.onmicrosoft.com).
 - Select DNS records and click + Add record.
 - Add a new record with the TXT name of _dmarc with the appropriate values outlined above.

Impact:

The remediation portion can take time to implement and involves a multi-staged approach over time. First, a baseline of the current state of email will be established with p=none and rua and ruf . Once the environment is better understood and reports have been analyzed, an organization will move to the final state with DMARC record values as outlined in the audit section.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv7|7.8

Plugin: microsoft_azure

Control ID: a86fae41f99937938959659aefa386c056f55dc1174b8eb12ce2765c492b784c