Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000208

Exchange Online organization without an enforced DMARC policy

High
Entra ID
Initial Access

Signature Identity

CTD-000208
Threat ID
Version
IOE
Indicator Type

Threat Description

A domain that has no DMARC (Domain-based Message Authentication, Reporting, and Conformance) record, or that publishes a DMARC record with the policy p=none, is a vulnerability. Without an enforcement policy, receiving mail servers aren’t instructed to reject or quarantine unauthenticated messages that claim to come from your organization.

A threat actor can exploit this gap to run convincing spoofing and business email compromise (BEC) campaigns, because the recipient’s mail server has no enforced policy to act on SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) authentication failures.

To mitigate this vulnerability, publish a DMARC record that specifies an enforcement policy of quarantine or reject. Enforcement significantly reduces the success rate of domain-spoofing attacks.

Example: The domain contoso.com has no DMARC record, or its record is set to p=none. When a threat actor sends spoofed invoices from billing@contoso.com, receiving mail servers deliver the messages to recipients’ inboxes, because no policy instructs them to reject or quarantine messages that fail authentication.

MITRE ATT&CK: Attack Tactics

Initial Access

D3FEND: Defend Tactics

D3-ACH (Application Configuration Hardening)

Remediation

A DMARC policy is published as a TXT record in the DNS zone for your domain, so the exact steps depend on the provider that hosts your DNS records:

  1. Verify that SPF and DKIM are configured for the domain. DMARC relies on both, so configure them first.
  2. Sign in to the portal of your DNS hosting provider and open the DNS zone for the domain.
  3. Add or update a TXT record named _dmarc (for example, _dmarc.contoso.com).
  4. Set the record value to an enforcement policy, and include a mailbox that receives aggregate reports. For example: v=DMARC1; p=reject; pct=100; rua=mailto:dmarcreports@contoso.com.
  5. If the domain doesn’t yet have a DMARC record, start with p=none, review the aggregate reports to confirm that legitimate senders pass authentication, and then move to p=quarantine and finally p=reject.
  6. Save the record, wait for DNS propagation, and then confirm that the published record returns the expected enforcement policy.
  7. Repeat these steps for every domain that your organization sends mail from, including parked domains.

For more information, see Set up DMARC to validate the From address domain for senders in Microsoft 365.

Frequently Asked Questions

What does Exchange Online organization without an enforced DMARC policy mean?

An Exchange Online organization without an enforced DMARC policy lacks a DMARC record or has a record set to p=none, allowing receiving mail servers to deliver unauthenticated messages without explicit instruction to reject or quarantine.

Without an enforced DMARC policy, receiving mail servers don't receive explicit instructions to reject or quarantine unauthenticated messages, making it easier for attackers to send convincing spoofing and business email compromise emails.

Attackers can exploit the lack of an enforced DMARC policy to send spoofed emails that claim to come from the organization, potentially evading recipient email authentication checks and making it difficult to distinguish between legitimate and malicious messages.

Cayosoft Guardian continuously monitors for Exchange Online organization without an enforced DMARC policy and alerts administrators when the condition is detected. This provides visibility into the exposure so security teams can review the finding and determine whether investigation or response is required. Guardian monitors Exchange Online and Entra ID for this condition and flags it when detected.

Cayosoft Guardian helps reduce the risk of Exchange Online organization without an enforced DMARC policy by alerting administrators when the condition is detected and providing visibility into the affected mailboxes, inbox rules, and permissions. This helps security teams identify exposure more quickly and respond before the issue contributes to a larger security event.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Entra ID
Themes
Infrastructure
Attack Tactics
Initial Access
Defend Tactics
D3-ACH (Application Configuration Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical