Skip to content
MitoMito Docs

CISA.MS.EXO.4.1: A DMARC policy SHALL be published for every second-level domain.
ID CISA.MS.EXO.4.1
Severity Medium
Suite CISA SCuBA baselines
Product Exchange Online
Feature Email authentication
Security area Email and collaboration protection
Resource type Domain
User impact of fixing Low
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.4.1 (SHALL)
Framework controls cisa-scuba:MS.EXO.4.1
nist-800-53-r5:SI-8 Spam Protection
MITRE ATT&CK T1566, T1598, T1684.002
Reads from Exchange Online

What this checks and how to fix it

Section titled “What this checks and how to fix it”

A DMARC policy SHALL be published for every second-level domain.

Rationale: Without a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling spoofed emails to reach end users’ mailboxes. Publishing DMARC records at the second-level domain protects the second-level domains and all subdomains.

Remediation action

Section titled “Remediation action”

DMARC is not configured through the Exchange admin center, but rather via DNS records hosted by the agency’s domain. As such, implementation varies depending on how an agency manages its DNS records. See Form the DMARC TXT record for your domain | Microsoft Learn for Microsoft guidance.

A DMARC record published at the second-level domain will protect all subdomains. In other words, a DMARC record published for example.com will protect both a.example.com and b.example.com, but a separate record would need to be published for c.example.gov.

To test your DMARC configuration, consider using one of many publicly available web-based tools. Additionally, DMARC records can be requested using the PowerShell tool Resolve-DnsName. For example:

Resolve-DnsName _dmarc.example.com txt

If DMARC is configured, a response resembling v=DMARC1; p=reject; pct=100; rua=mailto:reports@dmarc.cyber.dhs.gov, mailto:reports@example.com; ruf=mailto:reports@example.com will be returned, though by necessity, the contents of the record will vary by agency. In this example, the policy indicates all emails failing the SPF/DKIM checks are to be rejected and aggregate reports sent to reports@dmarc.cyber.dhs.gov and reports@example.com. Failure reports will be sent to reports@example.com.

Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: moorereason. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.