{
  "id": "CB-M365-MAIL-002",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-002",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-002.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-002.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-002",
    "title": "Do not bypass spam filtering for sender domains in mail flow rules",
    "finding": {
      "title": "Mail flow rules let mail from listed sender domains skip spam filtering",
      "description": "Any message that claims to come from an allow-listed domain, including spoofed ones, reaches the inbox without spam or phishing verdicts."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "mail-flow",
      "transport-rules",
      "allow-list",
      "spoofing"
    ],
    "description": "No Exchange mail flow rule (transport rule) sets the spam confidence level to **Bypass spam\nfiltering** (`SetSCL -1`) based on the sender domain (`SenderDomainIs`, `FromAddressContains`,\n`FromAddressMatchesPatterns`). This applies above all to the organization's own accepted domains.\n\nA rule that sets `SCL -1` is acceptable only when it is tied to a condition the sender cannot\nforge, such as the connector or IP address of a known system (`SenderIpRanges`), and it is\ndocumented. Legitimate senders that are wrongly filtered are handled with the Tenant Allow/Block\nList, the spoof intelligence insight or the advanced delivery policy.\n",
    "rationale": "The From and envelope domains are trivial to forge. A rule that trusts a sender domain lets every\nspoofed message from that domain skip spam, bulk and part of the phishing filtering. Allow-listing\nthe organization's own domain is the worst case: an outsider can then send mail that looks\ninternal to any employee.\n",
    "impact": "Messages from the formerly listed partners go through normal filtering again and some may land\nin Junk Email until the sender fixes its SPF, DKIM and DMARC or an allow entry is created in the\nTenant Allow/Block List.\n",
    "audit": {
      "manual": "1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Mail flow** > **Rules** and open every enabled rule.\n3. Look for rules whose action is **Modify the message properties** > **Set the spam confidence\n   level (SCL)** > **Bypass spam filtering** and whose condition is on the sender's domain or\n   address.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-TransportRule | Where-Object { $_.SetSCL -eq -1 } |\n     Format-List Name, State, Priority, SenderDomainIs, FromAddressContainsWords, FromAddressMatchesPatterns, SenderIpRanges\n   ```\n5. Fail if an enabled rule sets `SCL -1` with a sender domain or address condition, and always if\n   the listed domain is one of the organization's accepted domains (`Get-AcceptedDomain`).\n"
    },
    "remediation": {
      "manual": "1. For each offending rule, note why it was created (which partner, which false positive).\n2. Replace it: report the false positive to Microsoft from **Actions & submissions** >\n   **Submissions**, add an allow entry in **Tenant Allow/Block Lists** if needed, or, for an\n   internal system, restrict the rule to the system's IP range or inbound connector.\n3. In the Exchange admin center, browse to **Mail flow** > **Rules**, select the rule and\n   turn it off; delete it once the replacement is tested.\n4. PowerShell equivalent (Exchange Administrator):\n   ```powershell\n   Disable-TransportRule -Identity \"<rule name>\"\n   Remove-TransportRule -Identity \"<rule name>\"\n   ```\n",
      "rollback": "Turn the rule back on (`Enable-TransportRule`) while the replacement is being set up.\n"
    },
    "references": [
      {
        "title": "Mail flow rules (transport rules) in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Create safe sender lists in EOP",
        "url": "https://learn.microsoft.com/defender-office-365/create-safe-sender-lists-in-office-365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-118-2, ORCA-118-4)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1043",
        "url": "https://maester.dev/docs/tests/MT.1043",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-030",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-032",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}