Publish an enforcing DMARC policy with reporting for every domain

Description

Every domain the organization owns publishes a DMARC TXT record at _dmarc.<domain> with:

• p={{ dmarc_policy }} for domains that send mail, and p=reject for domains that never send mail (parked domains);
• no pct tag, or pct=100;
• a subdomain policy (sp) that is absent or not weaker than p;
• aggregate reports (rua) sent to {{ dmarc_report_address }}.

SPF (CB-M365-MAIL-014) and DKIM (CB-M365-MAIL-015) must pass and align for legitimate senders before the policy is enforced.

Rationale

DMARC is the only standard that protects the From address users actually see. With p=none, receivers only report forgeries; with quarantine or reject they stop them, which protects employees, customers and partners from phishing that uses the organization's name. Reports show forgery attempts and forgotten legitimate senders.

Impact

Legitimate senders that fail SPF and DKIM alignment (a forgotten marketing tool, a partner that sends on the organization's behalf) see their messages quarantined or rejected. Start with p=none, read the reports for a few weeks, fix the senders, then move to quarantine and reject. A third-party DMARC report service makes the reports usable.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. List the domains as in CB-M365-MAIL-014 (Microsoft 365 admin center > Settings > Domains, plus registrar inventory).
2. For each domain, query DNS (no tenant role needed):

   Get-AcceptedDomain | ForEach-Object {
     Resolve-DnsName -Name "_dmarc.$($_.DomainName)" -Type TXT -ErrorAction SilentlyContinue | Select-Object Name, Strings
   }
   

3. Fail if a domain has no DMARC record, if a sending domain's policy is weaker than {{ dmarc_policy }}, if a parked domain is not p=reject, if pct is below 100, if sp is weaker than the required policy, or if there is no rua address.

Remediation

1. Publish a monitoring record first, for example v=DMARC1; p=none; rua=mailto:[email protected], and analyze the aggregate reports.
2. Fix SPF and DKIM for every legitimate sender found in the reports.
3. At the DNS hosting provider, update the TXT record at _dmarc.<domain>:

   v=DMARC1; p=quarantine; rua=mailto:[email protected]
   

   then p=reject where the parameter requires it.
4. For parked domains, publish v=DMARC1; p=reject directly.

Rollback

Lower the policy to p=none while a delivery problem is investigated.

References

• Set up DMARC to validate the From address domain for cloud senders Microsoft, vendor-doc, accessed 2026-10-24
• RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) IETF, rfc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-014 Publish an SPF record that fails unauthorized senders for every domain
• related CB-M365-MAIL-015 Sign outgoing mail with DKIM for every sending domain
• related CB-M365-MAIL-017 Honor the sender's DMARC policy for inbound spoofed mail

People and lifecycle