CISA.MS.EXO.4.3: The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov.

ID	CISA.MS.EXO.4.3
Severity	Medium
Suite	CISA SCuBA baselines
Product	Exchange Online
Feature	Email authentication
Security area	Email and collaboration protection
Resource type	Domain
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.4.3 (SHALL)
Framework controls	cisa-scuba:MS.EXO.4.3 nist-800-53-r5:SI-4(5) System Monitoring | System-generated Alerts
MITRE ATT&CK	T1684.002
Reads from	Exchange Online

What this checks and how to fix it

The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov.

Rationale: Email spoofing attempts are not inherently visible to domain owners. DMARC provides a mechanism to receive reports of spoofing attempts. Including reports@dmarc.cyber.dhs.gov as a point of contact for these reports gives CISA insight into spoofing attempts and is required by BOD 18-01 for FCEB departments and agencies.

Note: Only federal, executive branch, departments and agencies should include this email address in their DMARC record.

For other organization’s there are many services that offer managed DMARC analysis and reporting, though ensure you properly align your implementation with your organization’s policies for data handling.

Remediation action:

• See MS.EXO.4.1v1 Instructions for an overview of how to publish and check a DMARC record.
• Ensure the record published includes reports@dmarc.cyber.dhs.gov as one of the emails for the RUA field.

Related links

• Exchange admin center - Accepted domains
• CISA 4 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) - MS.EXO.4.3v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.