ORCA.244: Policies are configured to honor sending domains DMARC.
| ID | ORCA.244 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Security area | Email and collaboration protection |
| Resource type | Policy |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-8 Spam Protection |
| MITRE ATT&CK | T1566, T1684.002 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Domain-based Message Authentication, Reporting & Conformance (DMARC) is a standard that helps prevent spoofing by verifying the senders identity. If an email fails DMARC validation, it often means that the sender is not who they claim to be, and the email could be fraudulent. The owner of the sending domain controls the DMARC policy for their domain, and provides recommendations to receivers on what action should be performed when DMARC fails. When the Honor DMARC Policy setting is set to False, the organisations policy is not considered. It is recommended to honor this policy.
Remediation action
Section titled “Remediation action”Configure anti-phish policy to honor sending domains DMARC configuration.
Related Links
Section titled “Related Links”- Announcing New DMARC Policy Handling Defaults for Enhanced Email Security
- Microsoft 365 Defender Portal - Anti-phishing
Mito check, based on ORCA. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.