Honor the sender's DMARC policy for inbound spoofed mail

Description

In every anti-phishing policy (the default policy, custom policies and the preset policies), the spoof setting Honor DMARC record policy when the message is detected as spoof is on (HonorDmarcPolicy $true), with:

• p=quarantine failures: Quarantine the message (DmarcQuarantineAction Quarantine);
• p=reject failures: Reject the message (DmarcRejectAction Reject).

Spoof intelligence stays enabled (EnableSpoofIntelligence $true).

Rationale

A domain owner who publishes p=reject states that unauthenticated mail with its domain is forged. Honoring that policy stops the forgery at the door instead of moving it to Junk Email, where users still find and open it. This setting is part of Exchange Online Protection and needs no extra license.

Impact

None known for well-configured senders. Messages from domains with broken authentication and an enforcing DMARC policy are quarantined or rejected; senders of legitimate mail can be allowed through the spoof intelligence insight.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-phishing and open each policy (Office365 AntiPhish Default and custom policies).
3. Under Actions, check that Honor DMARC record policy when the message is detected as spoof is selected, with Quarantine the message for p=quarantine and Reject the message for p=reject.
4. In Exchange Online PowerShell (read-only):

   Get-AntiPhishPolicy | Format-Table Name, Enabled, EnableSpoofIntelligence, HonorDmarcPolicy, DmarcQuarantineAction, DmarcRejectAction
   

5. Fail if a policy that applies to users has HonorDmarcPolicy set to False, or a weaker action than the ones above.

Remediation

1. In the Defender portal, open each anti-phishing policy > Actions > Edit actions.
2. Select Honor DMARC record policy when the message is detected as spoof, choose Quarantine the message and Reject the message, and save.
3. PowerShell equivalent (Security Administrator):

   Get-AntiPhishPolicy | Set-AntiPhishPolicy -EnableSpoofIntelligence $true -HonorDmarcPolicy $true `
     -DmarcQuarantineAction Quarantine -DmarcRejectAction Reject
   

   (The preset policies cannot be edited and already use these values.)

Rollback

Set-AntiPhishPolicy -Identity <policy> -HonorDmarcPolicy $false.

References

• Anti-phishing policies in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Recommended settings for EOP and Microsoft Defender for Office 365 security Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-244) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-016 Publish an enforcing DMARC policy with reporting for every domain
• related CB-M365-MAIL-018 Configure Enhanced Filtering and trusted ARC sealers behind a third-party mail gateway
• related CB-M365-MAIL-029 Configure anti-phishing impersonation protection, mailbox intelligence and safety tips

People and lifecycle