{
  "id": "CB-M365-MAIL-035",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-035",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-035.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-035.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-035",
    "title": "Do not send mail from the onmicrosoft.com domain",
    "finding": {
      "title": "Mailboxes send mail with the tenant's onmicrosoft.com address",
      "description": "Messages from the shared Microsoft domain carry no organization branding or DMARC under the organization's control, and Microsoft throttles them."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "moera",
      "onmicrosoft",
      "domains",
      "deliverability"
    ],
    "description": "No mailbox, group or application sends mail with an address in the tenant's Microsoft Online\nEmail Routing Address domain (`<tenant>.onmicrosoft.com`, MOERA). Every mailbox and group has its\nprimary SMTP address in a custom domain, and the default domain of the tenant is a custom domain.\nThe MOERA address stays as a secondary address, as Exchange Online requires.\n",
    "rationale": "The `onmicrosoft.com` domains are shared by all tenants and their reputation is shared too.\nRecipients cannot tell a message from `contoso.onmicrosoft.com` from one sent by an attacker who\ncreated a look-alike tenant, and the organization's DMARC, DKIM and branding do not apply.\nMicrosoft now limits outbound mail from MOERA domains to 100 external recipients per day per\ntenant; messages above the limit are rejected.\n",
    "impact": "Accounts whose primary address changes keep receiving mail on the old address. Scripts,\napplications or devices that send as the MOERA address must be updated. Admin accounts without a\nmailbox are not affected.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global\n   Reader. Browse to **Settings** > **Domains** and check that a custom domain is marked\n   **Default**.\n2. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-EXORecipient -ResultSize Unlimited | Where-Object { $_.PrimarySmtpAddress -like '*.onmicrosoft.com' } |\n     Format-Table Name, RecipientTypeDetails, PrimarySmtpAddress\n   Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date) -SenderAddress \"*@<tenant>.onmicrosoft.com\" |\n     Group-Object SenderAddress | Select-Object Name, Count\n   ```\n3. Fail if a mailbox or group other than a documented system object has an `onmicrosoft.com`\n   primary address, or if message trace shows outbound mail sent from the MOERA domain.\n"
    },
    "remediation": {
      "manual": "1. In the Microsoft 365 admin center, **Settings** > **Domains**, select the main custom domain >\n   **Set as default** (Domain Name Administrator).\n2. For each listed user, **Users** > **Active users** > select the user > **Manage username and\n   email**, add an address in the custom domain and set it as primary (User Administrator or\n   Exchange Administrator). PowerShell equivalent:\n   ```powershell\n   Set-Mailbox -Identity <user> -WindowsEmailAddress user@example.com\n   Set-UnifiedGroup -Identity <group> -PrimarySmtpAddress group@example.com\n   ```\n   For synchronized users, change the `mail` / `proxyAddresses` attributes in Active Directory.\n3. Update the scripts and devices that send as the MOERA address.\n"
    },
    "references": [
      {
        "title": "Add or remove email addresses for a mailbox in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/recipients-in-exchange-online/manage-user-mailboxes/add-or-remove-email-addresses",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Exchange Online limits",
        "url": "https://learn.microsoft.com/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1076 - MOERA should not be used for sent mail",
        "url": "https://maester.dev/docs/tests/MT.1076",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1074 - outbound mail sent with the onmicrosoft.com domain",
        "url": "https://maester.dev/docs/tests/MT.1074",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}