🙏 Test for checking dmarc for all Domains registered to entra tenant

[jkerai1]

Describe the feature

Check all Domains in the tenant to ensure DMARC is set to p=reject

Impact and importance

Not protecting your domain(s) could allow an attacker to generate a spoofed email

Alternatives you've considered

No response

Additional context

No response

[SamErde]

Or at least quarantine? How strong is the reject requirement?

[jkerai1]

Tbh as long as its not P=none or quaratine with a low percentage (like 20%) I'd be okay with it

[SamErde]

I certainly agree! What would be a good authoritative reference to provide in the explanation/recommendation?

[jkerai1]

For Non sending email domains I like this:
https://www.ncsc.gov.uk/blog-post/protecting-parked-domains

For .onmicrosoft.com domains I like this:
https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure#use-the-microsoft-365-admin-center-to-add-dmarc-txt-records-for-onmicrosoftcom-domains-in-microsoft-365 OR https://o365info.com/dkim-dmarc-onmicrosoft-com-domain/

For mail sending domains and why you should move from p=none to reject:
https://dmarcian.com/why-dmarc/

[Mynster9361]

just adding some information to this one this would qualify as this CIS test for Microsoft 365 Foundations Benchmark:

But would only qualify on the domains used for exchange online domains that are published in your tenant

2.1.10 (L1) Ensure DMARC Records for all Exchange Online domains are published (Automated)

Remediation:

To remediate using a DNS Provider:

1. For each Exchange Online Accepted Domain, add the following record to DNS:

Record: _dmarc.domain1.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:<rua-report@example.com>;
ruf=mailto:<ruf-report@example.com>

2. This will create a basic DMARC policy that will allow the organization to start monitoring message statistics.
3. One week is enough time for data generated by the reports to be useful in understanding email trends and traffic. The final step requires implementing a policy of p=reject OR p=quarantine and pct=100 with the necessary rua and ruf email addresses defined:

Record: _dmarc.domain1.com
Type: TXT
Value: v=DMARC1; p=reject; pct=100; rua=mailto:<rua-report@example.com>;
ruf=mailto:<ruf-report@example.com>

Also remediate the MOREA domain using the UI:

1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com/
2. Expand Settings and select Domains.
3. Select your tenant domain (for example, contoso.onmicrosoft.com).
4. Select DNS records and click + Add record.
5. Add a new record with the TXT name of _dmarc with the appropriate values outlined above.

Note: The remediation portion involves a multi-staged approach over a period of time.
First, a baseline of the current state of email will be established with p=none and rua
and ruf. Once the environment is better understood and reports have been analyzed
an organization will move to the final state with dmarc record values as outlined in the
audit section.

Microsoft has a list of best practices for implementing DMARC that cover these steps in
detail.

[blindzero]

I fully agree here. The end-goal is p=reject. The usual DMARC checking tools also degrade your rating with everything else than reject.
I would maybe even create to tests and separate between MSFT / CIS (?) for p=reject and adding a MT test to check additionally for subdomain policy. A lot of DMARC tools check additionally against sp=, but this is not mentioned in official MSFT documentation as far as I can see.

I would volunteer here...if fine with you guys.

@SamErde , @Mynster9361 or is there a way to have different severities for different results? e.g. p=none or low percentage = high, quarantine low?

[blindzero]

Hi @jkerai1

I just a had a look and there are several tests for all EXO mail accepting domains on DMARC records (DMARC exist, reject, aggregated report, ...).
Just thinking loud here:

• Would a new test for all Entra domains make sense if they are not EXO accepted?
• Should ALL Entra domains be checked here or only Verified and Managed ones?

Best,
Matthias

[jkerai1]

fair point. I have seen some customers with domains added but havent been fully verified they should excluded from this test but included in a seperate Maester test to clear that down (but i cant really see an attack path from this)

Would a new test for all Entra domains make sense if they are not EXO accepted? - Yes. All domains should have DMARC regardless if they are using EXO or not even if they aren't sending mail

Should ALL Entra domains be checked here or only Verified and Managed ones? Only verified and managed.

Unverified Domains should be a seperate maester test.

Likely way to appearl to both crowds is to keep CIS test as is and have a seperate maester test for all domains

[SamErde]

I fully agree here. The end-goal is p=reject. The usual DMARC checking tools also degrade your rating with everything else than reject. I would maybe even create to tests and separate between MSFT / CIS (?) for p=reject and adding a MT test to check additionally for subdomain policy. A lot of DMARC tools check additionally against sp=, but this is not mentioned in official MSFT documentation as far as I can see.

I would volunteer here...if fine with you guys.

@SamErde , @Mynster9361 or is there a way to have different severities for different results? e.g. p=none or low percentage = high, quarantine low?

We do not yet have a feature in Maester that can dynamically assign severity based on values or conditions found. That has long been on the "mental wish list" but never put into a feature request...yet! (Sorry for not replying sooner!)

[SamErde]

This is going to be great to have, guys. Thanks for working on it! I tell my clients often that they should have DMARC/DKIM/SPF set to reject for domains that don't send email and it'll be great to have Maester cover that!