CISA.MS.EXO.3.1 - DKIM SHOULD be enabled for all domains.
Overview
DKIM SHOULD be enabled for all domains.
Coexistence domains related to Hybrid Configuration Wizard (HCW) are skipped. Production use of coexistence domains is discouraged, and additional controls, such as transport rules, should be used to restrict their use.
Rationale: An adversary may modify the FROM field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Enabling DKIM is another means for recipients to detect spoofed emails and verify the integrity of email content.
Remediation action
Option 1: Enable DKIM
To enable DKIM, follow the instructions listed on Steps to Create, enable and disable DKIM from Microsoft 365 Defender portal | Microsoft Learn.
Option 2: Disallow mail to be sent from domain
If the domain is not used for sending mail, we recommend disabling the ability to send from this domain. This will skip the domain for this particular test.
- Sign in to the Exchange Admin Center - Accepted Domains.
- Select the domain to disable sending from.
- Uncheck Allow mail to be sent from this domain.
We recommend doing this for *onmicrosoft.com domains.
Related links
- Defender admin center - Email authentication settings
- CISA 3 Sender Policy Framework - MS.EXO.3.1v1
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.3.1 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Email authentication |
| Area | Email and collaboration protection |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1598 Phishing for Information, T1684.002 Email Spoofing |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.3.1 |
| Criticality | SHOULD |
| Upstream requirement | MS.EXO.3.1v1 |
| Supports controls | cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8 |
| PowerShell test | Test-MtCisaDkim |
| Services | ExchangeOnline |
Source
- Test:
tests/cisa/exchange/Test.CISA.MS.EXO.3.1.ps1 - Documentation:
tests/cisa/exchange/Test.CISA.MS.EXO.3.1.md