Rules/MAIL-001.spf-configured.psd1
|
@{ Id = 'MAIL-001' Title = 'Every custom domain publishes a strict SPF record' Area = 'EmailAuthDns' Severity = 'High' References = @( 'CIS Microsoft 365 Foundations Benchmark (SPF records for all domains)' 'https://learn.microsoft.com/defender-office-365/email-authentication-spf-configure' ) Rationale = 'Without SPF (or with +all), anyone can spoof mail from the domain. SPF must end in -all (hardfail) or at least ~all (softfail).' Remediation = 'Publish a TXT record "v=spf1 include:spf.protection.outlook.com -all" (plus any legitimate senders) on every custom domain.' Test = { param($Snapshot) $domains = @($Snapshot.EmailAuthDns | Where-Object { -not $_.isOnMicrosoft }) if ($domains.Count -eq 0) { return New-TLRuleResult -Status Pass -Evidence 'Only *.onmicrosoft.com domains are verified - Microsoft manages their SPF.' } $bad = @($domains | Where-Object { -not ($_.spf.present -and (@('hardfail', 'softfail') -contains [string]$_.spf.qualifier)) }) if ($bad.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($bad | ForEach-Object { $detail = 'no SPF record' if ($_.spf.present) { $detail = "qualifier '$($_.spf.qualifier)'" } "$($_.domain): $detail" }) } else { New-TLRuleResult -Status Pass -Evidence @($domains | ForEach-Object { "$($_.domain): $($_.spf.qualifier)" }) } } } |