CIS.M365.6.2.2 - (L1) Ensure mail transport rules do not whitelist specific domains
Overview
No mail flow rule sets the spam confidence level to -1 for mail from specific sender domains.
A spam confidence level of -1 tells Exchange Online to deliver the message without spam filtering. If the rule matches a sender domain, anyone who can spoof that domain, or who compromises it, sends mail straight to your users, with the same trust as an internal sender.
If a business exception is necessary, CIS says to whitelist the domain only when inbound mail from that domain originates from a specific IP address, and to document and regularly review the exception. The CIS PowerShell audit flags every rule that combines SenderDomainIs with SetSCL -1; this check does not verify an IP restriction or exception documentation, so assess each flagged rule against those conditions. Prefer fixing the cause of false positives, for example by configuring SPF, DKIM and DMARC for the partner domain.
Remediation action
- Sign in to the Exchange admin center.
- Go to Mail flow > Rules.
- Open each rule that is listed in the test result and remove the action Set the spam confidence level (SCL) to Bypass spam filtering, or delete the rule.
Related links
- Exchange admin center - Mail flow rules
- Use mail flow rules to set the spam confidence level
- Create safe sender lists in Microsoft Defender for Office 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.2.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.2.2, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisTransportRulesNoDomainAllowList |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.2.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.2.2.md