CISA.MS.EXO.3.1: DKIM SHOULD be enabled for all domains.
| ID | CISA.MS.EXO.3.1 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Email authentication |
| Security area | Email and collaboration protection |
| Resource type | Domain |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.3.1 (SHOULD) |
| Framework controls | cisa-scuba:MS.EXO.3.1nist-800-53-r5:SC-8 Transmission Confidentiality and Integrity |
| MITRE ATT&CK | T1566, T1598, T1684.002 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”DKIM SHOULD be enabled for all domains.
Coexistence domains related to Hybrid Configuration Wizard (HCW) are skipped. Production use of coexistence domains is discouraged, and additional controls, such as transport rules, should be used to restrict their use.
Rationale: An adversary may modify the FROM field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Enabling DKIM is another means for recipients to detect spoofed emails and verify the integrity of email content.
Remediation action
Section titled “Remediation action”Option 1: Enable DKIM
Section titled “Option 1: Enable DKIM”To enable DKIM, follow the instructions listed on Steps to Create, enable and disable DKIM from Microsoft 365 Defender portal | Microsoft Learn.
Option 2: Disallow mail to be sent from domain
Section titled “Option 2: Disallow mail to be sent from domain”If the domain is not used for sending mail, we recommend disabling the ability to send from this domain. This will skip the domain for this particular test.
- Sign in to the Exchange Admin Center - Accepted Domains.
- Select the domain to disable sending from.
- Uncheck Allow mail to be sent from this domain.
We recommend doing this for *onmicrosoft.com domains.
Related links
Section titled “Related links”- Defender admin center - Email authentication settings
- CISA 3 Sender Policy Framework - MS.EXO.3.1v1
- CISA ScubaGear Rego Reference
Mito check, based on CISA ScubaGear. Author: soulemike; contributors: JeanPhilippeGeorge, brianreidc7, amlhive-tech, blindzero. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.