MT.1182: Mature DMARC policy SHALL be published for every Entra managed and verified domain.

ID	MT.1182
Severity	Medium
Suite	Mito
Product	Entra ID
Related products	Exchange Online
Feature	User and directory settings
Security area	Email and collaboration protection
Resource type	Domain
User impact of fixing	Medium
Effort to fix	High
Framework controls	nist-800-53-r5:SI-8 Spam Protection
MITRE ATT&CK	T1566, T1684.002
Reads from	Microsoft Graph

What this checks and how to fix it

A DMARC policy SHALL be published with reject policy for every verified and managed domain in the Entra tenent.

Rationale: Without a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling spoofed emails to reach end users’ mailboxes. Publishing DMARC records protects the domains and all subdomains. reject policy with pct=100 is the recommended policy value that should be set after some time and results in a passed test. Any policy with pct < 100 or quarantine will result in a “Low” severity fail. none results in a failed test with “Medium” severity, assuming that only fully missing DMARC entry results in a “High” severity.

Remediation action

DMARC is not configured directly through the Microsoft Admin Center, but rather via DNS records hosted by the agency’s domain. As such, implementation varies depending on how an agency manages its DNS records. See Form the DMARC TXT record for your domain | Microsoft Learn for Microsoft guidance.

A DMARC record published at the second-level domain will protect all subdomains. In other words, a DMARC record published for example.com will protect both a.example.com and b.example.com, but a separate record would need to be published for c.example.gov.

To test your DMARC configuration, consider using one of many publicly available web-based tools. Additionally, DMARC records can be requested using the PowerShell tool Resolve-DnsName. For example:

Resolve-DnsName _dmarc.example.com txt

If DMARC is configured, a response resembling v=DMARC1; p=reject; pct=100; rua=mailto:reports@dmarc.cyber.dhs.gov, mailto:reports@example.com; ruf=mailto:reports@example.com will be returned, though by necessity, the contents of the record will vary by agency. In this example, the policy indicates all emails failing the SPF/DKIM checks are to be rejected and aggregate reports sent to reports@dmarc.cyber.dhs.gov and reports@example.com. Failure reports will be sent to reports@example.com.

Related links

• Microsoft Learn - Set up DMARC
• NSCS.gov - Protect Parked Domains
• CISA 4 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) - MS.EXO.4.1v1
• CISA ScubaGear Rego Reference

---

Mito check. Author: blindzero. Open-source licences.