M365EXO-016: DKIM enabled for all domains (MS.EXO.3.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.3.1 recommends that DKIM be enabled for all domains. DKIM adds a cryptographic signature to the message header so recipients can verify message integrity and authenticity. Without DKIM, recipients have one fewer signal to detect spoofed mail and DMARC alignment cannot rely on DKIM, weakening overall email authentication.
Valor recomendado
DKIM signing enabled for every custom domain with the corresponding selector CNAME records published in DNS
Remediación
Enable DKIM signing in Exchange Online for every custom domain and publish the two selector CNAME records that the service generates in the domain's DNS. Verify that the signing configuration reports an Enabled state once the CNAME records propagate. Rotate keys periodically and confirm that newly added domains have DKIM enabled as part of domain onboarding.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.EXO.3.1v1
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566.001