Cybersecurity and Infrastructure Security Agency Logo

Secure Cloud Business Applications (SCuBA)

Baseline Documents

Light mode

Details

Exchange Online Baseline Report


Tenant Display NameTenant Domain NameReport DateBaseline VersionModule Version
tqhjytqhjy.onmicrosoft.com10/15/2026 21:46:53 Coordinated Universal Time12.0.0
Policy Indicators:
BOD 25-01 Requirement Required by CISA BOD 25-01
Automated Check Automatically verified by ScubaGear
Configurable Customizable via config file

EXO-1 Automatic Forwarding to External Domains

Control IDRequirementResultCriticalityDetails
MS.EXO.1.1v2Automatic forwarding to external domains SHALL be disabled.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShallNo domains allow automatic forwarding.

EXO-2 Sender Policy Framework

Control IDRequirementResultCriticalityDetails
MS.EXO.2.2v3An SPF policy SHALL be published for each domain that fails all non-approved senders.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShallRequirement met. View DNS logs for more details.

EXO-3 DomainKeys Identified Mail

Control IDRequirementResultCriticalityDetails
MS.EXO.3.1v1DKIM SHOULD be enabled for all domains.
Automated CheckConfigurable
WarningShould1 agency domain(s) found in violation: tqhjy.onmicrosoft.com. View DNS logs for more details.

EXO-4 Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Control IDRequirementResultCriticalityDetails
MS.EXO.4.1v1A DMARC policy SHALL be published for every second-level domain.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShallRequirement met. View DNS logs for more details.
MS.EXO.4.2v1The DMARC message rejection option SHALL be p=reject.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShallRequirement met. View DNS logs for more details.
MS.EXO.4.3v1The DMARC point of contact for aggregate reports SHALL include `reports@dmarc.cyber.dhs.gov`.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShallRequirement met. View DNS logs for more details.
MS.EXO.4.4v1An agency point of contact SHOULD be included for aggregate and failure reports.
Automated CheckConfigurable
PassShouldRequirement met. View DNS logs for more details.

EXO-5 Simple Mail Transfer Protocol Authentication

Control IDRequirementResultCriticalityDetails
MS.EXO.5.1v1SMTP AUTH SHALL be disabled.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met

EXO-6 Calendar and Contact Sharing

Control IDRequirementResultCriticalityDetails
MS.EXO.6.1v1Contact folders SHALL NOT be shared with all domains.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.EXO.6.2v1Calendar details SHALL NOT be shared with all domains.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met

EXO-7 External Sender Warnings

Control IDRequirementResultCriticalityDetails
MS.EXO.7.1v1External sender warnings SHALL be implemented.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met

EXO-13 Mailbox Auditing

Control IDRequirementResultCriticalityDetails
MS.EXO.13.1v1Mailbox auditing SHALL be enabled.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met

DNS Logs

DNS queries ScubaGear made while identifying SPF, DKIM, and DMARC records. Note: if DNS queries unexepectedly return 0 txt records, it may be a sign the system-default resolver is unable to resolve the domain names (e.g., due to a split horizon setup).

SPF

Query NameQuery MethodSummaryAnswers
​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned 3 txt records​v​​=​​s​​p​​f​​1​​ ​​i​​n​​c​​l​​u​​d​​e​​:​​s​​p​​f​​.​​p​​r​​o​​t​​e​​c​​t​​i​​o​​n​​.​​o​​u​​t​​l​​o​​o​​k​​.​​c​​o​​m​​ ​​-​​a​​l​​l​
​m​​s​​c​​i​​d​​=​​d​​/​​1​​e​​0​​7​​1​​K​​O​​h​​k​​m​​P​​8​​A​​a​​n​​r​​5​​s​​N​​g​​U​​q​​y​​T​​B​​r​​v​​r​​M​​x​​5​​n​​K​​S​​s​​w​​P​​x​​u​​5​​Z​​s​​q​​L​​0​​b​​d​​A​​g​​V​​o​​3​​m​​7​​f​​5​​V​​Y​​u​​+​​i​​n​​b​​K​​A​​5​​Y​​v​​i​​U​​P​​z​​z​​/​​S​​x​​N​​S​​0​​p​​l​​o​​J​​Q​​=​​=​
​g​​o​​o​​g​​l​​e​​-​​s​​i​​t​​e​​-​​v​​e​​r​​i​​f​​i​​c​​a​​t​​i​​o​​n​​=​​J​​a​​X​​O​​I​​P​​U​​L​​i​​5​​g​​G​​a​​D​​3​​c​​z​​r​​M​​v​​C​​6​​-​​U​​8​​7​​T​​b​​y​​4​​q​​Y​​E​​4​​x​​3​​O​​g​​L​​G​​T​​K​​k​
​t​​q​​h​​j​​y​​.​​m​​a​​i​​l​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned 1 txt records​v​​=​​s​​p​​f​​1​​ ​​i​​n​​c​​l​​u​​d​​e​​:​​o​​u​​t​​l​​o​​o​​k​​.​​c​​o​​m​​ ​​-​​a​​l​​l​

DKIM

Query NameQuery MethodSummaryAnswers
​s​​e​​l​​e​​c​​t​​o​​r​​1​​.​​_​​d​​o​​m​​a​​i​​n​​k​​e​​y​​.​​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned NXDomain
​s​​e​​l​​e​​c​​t​​o​​r​​1​​.​​_​​d​​o​​m​​a​​i​​n​​k​​e​​y​​.​​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​DoHQuery returned NXDomain
​s​​e​​l​​e​​c​​t​​o​​r​​2​​.​​_​​d​​o​​m​​a​​i​​n​​k​​e​​y​​.​​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned NXDomain
​s​​e​​l​​e​​c​​t​​o​​r​​2​​.​​_​​d​​o​​m​​a​​i​​n​​k​​e​​y​​.​​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​DoHQuery returned NXDomain
​s​​e​​l​​e​​c​​t​​o​​r​​1​​-​​t​​q​​h​​j​​y​​-​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​-​​c​​o​​m​​.​​_​​d​​o​​m​​a​​i​​n​​k​​e​​y​​.​​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned 1 txt records​v​​=​​D​​K​​I​​M​​1​​;​​ ​​k​​=​​r​​s​​a​​;​​ ​​p​​=​​M​​I​​I​​B​​I​​j​​A​​N​​B​​g​​k​​q​​h​​k​​i​​G​​9​​w​​0​​B​​A​​Q​​E​​F​​A​​A​​O​​C​​A​​Q​​8​​A​​M​​I​​I​​B​​C​​g​​K​​C​​A​​Q​​E​​A​​o​​h​​o​​P​​D​​h​​G​​T​​o​​R​​O​​8​​y​​7​​a​​c​​a​​W​​L​​2​​w​​1​​5​​w​​s​​C​​m​​w​​a​​b​​x​​g​​T​​w​​O​​D​​r​​o​​2​​c​​1​​B​​e​​R​​Y​​X​​f​​n​​U​​M​​S​​t​​I​​C​​o​​3​​w​​4​​Z​​r​​Y​​D​​t​​G​​Z​​D​​S​​A​​7​​h​​m​​0​​x​​7​​O​​H​​u​​j​​F​​1​​C​​o​​Q​​n​​X​​i​​B​​m​​r​​Q​​1​​5​​4​​w​​t​​o​​m​​P​​y​​x​​3​​O​​p​​/​​V​​C​​6​​+​​b​​9​​d​​i​​4​​z​​1​​5​​X​​B​​v​​h​​X​​h​​/​​f​​L​​B​​U​​d​​E​​J​​6​​w​​s​​y​​b​​M​​L​​m​​Q​​+​​W​​P​​Q​​A​​6​​v​​s​​M​​3​​U​​N​​5​​C​​v​​5​​r​​l​​2​​S​​y​​l​​F​​o​​M​​/​​/​​e​​L​​m​​w​​5​​R​​6​​N​​m​​M​​I​​j​​3​​G​​Q​​g​​9​​b​​+​​v​​Q​​l​​2​​c​​K​​N​​X​​q​​I​​I​​2​​g​​Z​​r​​B​​0​​7​​P​​6​​x​​t​​2​​w​​W​​1​​V​​A​​/​​L​​P​​j​​d​​R​​F​​U​​E​​y​​s​​9​​Y​​z​​B​​g​​O​​q​​M​​5​​3​​V​​a​​O​​D​​W​​D​​X​​D​​I​​v​​U​​H​​/​​n​​P​​R​​V​​A​​t​​O​​E​​s​​V​​1​​9​​u​​6​​6​​j​​y​​z​​Z​​n​​z​​c​​z​​9​​a​​7​​A​​T​​x​​i​​z​​i​​x​​7​​D​​n​​y​​S​​z​​I​​3​​k​​o​​V​​l​​O​​G​​i​​/​​+​​d​​L​​x​​8​​F​​Y​​I​​A​​Z​​/​​7​​5​​w​​k​​H​​1​​O​​/​​g​​H​​8​​/​​n​​4​​C​​6​​6​​u​​w​​R​​m​​/​​P​​M​​W​​+​​4​​J​​z​​V​​w​​L​​Y​​+​​Q​​I​​D​​A​​Q​​A​​B​​;​

DMARC

Query NameQuery MethodSummaryAnswers
​_​​d​​m​​a​​r​​c​​.​​t​​q​​h​​j​​y​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned 2 txt records​v​​=​​D​​M​​A​​R​​C​​1​​;​​p​​=​​r​​e​​j​​e​​c​​t​​;​​p​​c​​t​​=​​1​​0​​0​​;​​ ​​r​​u​​a​​=​​m​​a​​i​​l​​t​​o​​:​​d​​m​​a​​r​​c​​-​​r​​e​​p​​o​​r​​t​​s​​@​​e​​x​​a​​m​​p​​l​​e​​.​​c​​o​​m​
​v​​=​​D​​M​​A​​R​​C​​1​​;​​p​​=​​r​​e​​j​​e​​c​​t​​;​​p​​c​​t​​=​​1​​0​​0​​;​​ ​​r​​u​​a​​=​​m​​a​​i​​l​​t​​o​​:​​d​​m​​a​​r​​c​​-​​r​​e​​p​​o​​r​​t​​s​​@​​e​​x​​a​​m​​p​​l​​e​​.​​c​​o​​m​
​_​​d​​m​​a​​r​​c​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​traditionalQuery returned NXDomain
​_​​d​​m​​a​​r​​c​​.​​o​​n​​m​​i​​c​​r​​o​​s​​o​​f​​t​​.​​c​​o​​m​DoHQuery returned NXDomain
​_​​d​​m​​a​​r​​c​​.​​c​​o​​m​traditionalQuery returned NXDomain
​_​​d​​m​​a​​r​​c​​.​​c​​o​​m​DoHQuery returned NXDomain