STIGQter: STIG Summary: Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 30 Jan 2025:

Exchange internet-facing send connectors must specify a Smart Host.

DISA Rule

SV-259593r961101_rule

Vulnerability Number

V-259593

Group Title

SRG-APP-000213

Rule Version

EX19-ED-000095

Severity

CAT II

CCI(s)

• CCI-001178 - Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.

Weight

10

Fix Recommendation

Open the Exchange Management Shell and enter the following command:

Set-SendConnector <'IdentityName'> -SmartHosts <'IP Address of Smart Host'> -DNSRoutingEnabled $false

Note: The <IdentityName> value must be in quotes.

Repeat the procedure for each send connector.

Check Contents

Note: This is not applicable for SIPR enclaves.

Review the Email Domain Security Plan (EDSP).

Determine the internet-facing connectors.

Open the Exchange Management Shell and enter the following command:

Get-SendConnector | Select-Object -Property Name, Identity, SmartHosts, DNSRoutingEnabled

For each send connector, if the value of "SmartHosts" does not return the Smart Host IP Address and the value for "DNSRoutingEnabled" is not set to "False", this is a finding.

Vulnerability Number

V-259593

Documentable

False

Rule Version

EX19-ED-000095

Severity Override Guidance

Note: This is not applicable for SIPR enclaves.

Review the Email Domain Security Plan (EDSP).

Determine the internet-facing connectors.

Open the Exchange Management Shell and enter the following command:

Get-SendConnector | Select-Object -Property Name, Identity, SmartHosts, DNSRoutingEnabled

For each send connector, if the value of "SmartHosts" does not return the Smart Host IP Address and the value for "DNSRoutingEnabled" is not set to "False", this is a finding.

Check Content Reference

M

Target Key

5579