1.1 Ensure 'Enable sender ID agent' is configured

Information

The Sender ID agent is an antispam agent enabled on Exchange servers that perform the Edge Transport server role. Sender ID tries to verify that every e-mail message originates from the Internet domain from which it claims to have been sent. Sender ID checks the address of the server that sends the message against a registered list of servers that the domain owner has authorized to send e-mail.

Rationale:

Spam consumes a large amount of network bandwidth and server capacity. In addition, it is often the source of malicious software. Rejecting messages that have evidence of spoofing will reduce the possibility of users falling victim to phishing attacks.

Impact:

Some legitimate messages may be blocked.

Solution

To implement the recommended state, execute the below cmdlet:

Set-SenderIDConfig -Enabled $true -SpoofedDomainAction Reject

Default Value:

Enabled: True

SpoofedDomainAction: StampStatus

See Also

https://workbench.cisecurity.org/benchmarks/12442

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8a.

Plugin: Windows

Control ID: b823eb0fbd6febd3d0e1344f8534d420df975c4c08483fa4a25b59ccff70a3a9