Rules/MAIL-003.dmarc-enforced.psd1
|
@{ Id = 'MAIL-003' Title = 'DMARC is published and enforced for every custom domain' Area = 'EmailAuthDns' Severity = 'High' References = @( 'CIS Microsoft 365 Foundations Benchmark (DMARC records)' 'https://learn.microsoft.com/defender-office-365/email-authentication-dmarc-configure' ) Rationale = 'DMARC tells receiving servers what to do with mail that fails SPF/DKIM. A policy of none only monitors; quarantine or reject actually stops spoofing.' Remediation = 'Publish a _dmarc TXT record with at least p=quarantine (ideally p=reject) and rua reporting, after validating SPF and DKIM alignment.' Test = { param($Snapshot) $domains = @($Snapshot.EmailAuthDns | Where-Object { -not $_.isOnMicrosoft }) if ($domains.Count -eq 0) { return New-TLRuleResult -Status Pass -Evidence 'Only *.onmicrosoft.com domains are verified - nothing to check.' } $bad = @($domains | Where-Object { -not ($_.dmarc.present -and (@('quarantine', 'reject') -contains [string]$_.dmarc.policy)) }) if ($bad.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($bad | ForEach-Object { $detail = 'no DMARC record' if ($_.dmarc.present) { $detail = "policy 'p=$($_.dmarc.policy)'" } "$($_.domain): $detail" }) } else { New-TLRuleResult -Status Pass -Evidence @($domains | ForEach-Object { "$($_.domain): p=$($_.dmarc.policy)" }) } } } |