The Exchange Sender filter must block unaccepted domains.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221235	EX16-ED-000360	SV-221235r961161_rule	CCI-001308	medium
Description
Spam origination sites and other sources of suspected email-borne malware have the ability to corrupt, compromise, or otherwise limit availability of email servers. Limiting exposure to unfiltered inbound messages can reduce the risk of spam and malware impacts. The Global Deny list blocks messages originating from specific sources. Most blacklist filtering is done using a commercial Block List service, because eliminating threats from known spammers prevents the messages being evaluated inside the enclave where there is more risk they can do harm. Additional sources should also be blocked to supplement the contents of the commercial Block List service. For example, during a zero-day threat action, entries can be added and then removed when the threat is mitigated. An additional best practice is to enter the enterprise’s home domains in the Deny List, because inbound email with a "from" address of the home domain is very likely to be spoofed spam.
STIG			Date
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide			2024-12-06

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

END-08.2Automatic Spam and Phishing Protection Updates

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SI-8(2)Automatic Updates

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-001308

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)

Details

Check Text (C-221235r961161_chk)

Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement. Review the Email Domain Security Plan (EDSP). Determine the unaccepted domains that are to be blocked. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select Name, BlockedDomains, BlockedDomainsAndSubdomains If the value for "BlockedDomains" or "BlockedDomainsAndSubdomains" does not reflect the list of unaccepted domains, this is a finding.

Fix Text (F-22939r411832_fix)

Update the EDSP to reflect the unaccepted domains that are to be blocked. Open the Exchange Management Shell and enter the following command: For BlockedDomains: Set-SenderFilterConfig -BlockedDomains <BlockedDomain> Repeat the procedure for each domain that is to be blocked. or For BlockedDomainsAndSubdomains: Set-SenderFilterConfig -BlockedDomainsAndSubdomains <BlockedDomainAndSubdomain> Repeat the procedure for each domain and all of its subdomains that are to be blocked.