The Exchange sender filter must block unaccepted domains.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259612	EX19-ED-000126	SV-259612r961161_rule		Medium

Description
Spam origination sites and other sources of suspected email-borne malware have the ability to corrupt, compromise, or otherwise limit availability of email servers. Limiting exposure to unfiltered inbound messages can reduce the risk of spam and malware impacts. The Global Deny list blocks messages originating from specific sources. Most block list filtering is done using a commercial block list service, because eliminating threats from known spammers prevents the messages being evaluated inside the enclave where there is more risk they can do harm. Additional sources should also be blocked to supplement the contents of the commercial Block List service. For example, during a zero-day threat action, entries can be added and then removed when the threat is mitigated. An additional best practice is to enter the enterprise's home domains in the block list, because inbound email with a "from" address of the home domain is very likely to be spoofed spam.

Description

Spam origination sites and other sources of suspected email-borne malware have the ability to corrupt, compromise, or otherwise limit availability of email servers. Limiting exposure to unfiltered inbound messages can reduce the risk of spam and malware impacts. The Global Deny list blocks messages originating from specific sources. Most block list filtering is done using a commercial block list service, because eliminating threats from known spammers prevents the messages being evaluated inside the enclave where there is more risk they can do harm. Additional sources should also be blocked to supplement the contents of the commercial Block List service. For example, during a zero-day threat action, entries can be added and then removed when the threat is mitigated. An additional best practice is to enter the enterprise's home domains in the block list, because inbound email with a "from" address of the home domain is very likely to be spoofed spam.

STIG	Date
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-63351r942148_chk )
Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement. Review the Email Domain Security Plan (EDSP). Determine the unaccepted domains that are to be blocked. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig \| Select-Object -Property Name, BlockedDomains, BlockedDomainsAndSubdomains If the value for "BlockedDomains" or "BlockedDomainsAndSubdomains" does not reflect the list of accepted domains, this is a finding.

Check Text ( C-63351r942148_chk )

Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

Review the Email Domain Security Plan (EDSP).

Determine the unaccepted domains that are to be blocked.

Open the Exchange Management Shell and enter the following command:

Get-SenderFilterConfig | Select-Object -Property Name, BlockedDomains, BlockedDomainsAndSubdomains

If the value for "BlockedDomains" or "BlockedDomainsAndSubdomains" does not reflect the list of accepted domains, this is a finding.

Fix Text (F-63259r942149_fix)
Update the EDSP to reflect the unaccepted domains that are to be blocked. Open the Exchange Management Shell and enter the following command: For BlockedDomains: Set-SenderFilterConfig -BlockedDomains To add additional domains to the list (array): Set-SenderFilterConfig -BlockedDomains @{add="","",""} Each domain added must be quotes and separated by a comma. Repeat the procedure for each domain that is to be blocked. or For BlockedDomainsAndSubdomains: Set-SenderFilterConfig -BlockedDomainsAndSubdomains Same procedure applies for adding multiple domains applies to this filter. Repeat the procedure for each domain and all of its subdomains that are to be blocked.

Fix Text (F-63259r942149_fix)

Update the EDSP to reflect the unaccepted domains that are to be blocked.

Open the Exchange Management Shell and enter the following command:

For BlockedDomains:

Set-SenderFilterConfig -BlockedDomains

To add additional domains to the list (array):

Set-SenderFilterConfig -BlockedDomains @{add="","",""}

Each domain added must be quotes and separated by a comma.

Repeat the procedure for each domain that is to be blocked.

or

For BlockedDomainsAndSubdomains:

Set-SenderFilterConfig -BlockedDomainsAndSubdomains

Same procedure applies for adding multiple domains applies to this filter.

Repeat the procedure for each domain and all of its subdomains that are to be blocked.