M365EXO-015: SPF policy published for each domain (MS.EXO.2.2)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Critical
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.2.2 requires that an SPF policy be published for each domain, designating only approved addresses as senders and failing all others. SPF is published as a DNS TXT record rather than an Exchange Online setting. A missing SPF record, or one ending in +all or ?all, allows adversaries to spoof the FROM field of mail appearing to originate from the organization, enabling convincing phishing.
Valor recomendado
A single SPF TXT record per domain that lists all approved senders and ends with -all (hard fail)
Remediación
Publish a single SPF TXT record for each accepted domain that enumerates all approved sending sources and ends with -all to hard-fail unauthorized senders. Remove any duplicate SPF records, which violate RFC 7208 and cause validation to fail. Avoid +all and ?all, which neutralize SPF enforcement, and validate the record with a DNS lookup after publishing.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.EXO.2.2v1, MS.EXO.2.2v3
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566.001