Inbound anti-spam policy does not contain allowed domains

​

What this check verifies

Microsoft Defender for Office 365 inbound anti-spam policies are evaluated for domains listed in AllowedSenderDomains. The finding identifies any policy where this list is populated rather than empty.

​

Risk

Populating AllowedSenderDomains makes messages from those domains skip spam filtering and email authentication (SPF, DKIM, DMARC), often delivered with SCL -1. Attackers can spoof such domains to phish credentials, enable BEC, and alter mailboxes, undermining confidentiality and integrity.

​

Recommendation

• Keep AllowedSenderDomains empty.
• Use narrowly scoped allow logic that requires authentication alignment and additional conditions (sender, IP, headers).
• Make any exceptions temporary and reviewed.

Apply least privilege and defense in depth to email trust decisions.

​

Remediation

​

References

• https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-hostedcontentfilterpolicy?view=exchange-ps
• https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure
• https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-about#allow-and-block-lists-in-anti-spam-policies

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_antispam_policy_inbound_no_allowed_domains. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks