STIGQter: STIG Summary: Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Exchange Global Recipient Count Limit must be set.

DISA Rule

SV-259693r961161_rule

Vulnerability Number

V-259693

Group Title

SRG-APP-000261

Rule Version

EX19-MB-000142

Severity

CAT III

CCI(s)

• CCI-001308 - Automatically update spam protection mechanisms on an organization-defined frequency.

Weight

10

Fix Recommendation

Update the EDSP to specify the global maximum message recipient count.

Set-TransportConfig -MaxRecipientEnvelopeLimit 5000

or

Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

Restart the Microsoft Exchange Information Store service.

Check Contents

Review the Email Domain Security Plan (EDSP).

Determine the global maximum message recipient count.

Open the Exchange Management Shell and enter the following command:

Get-TransportConfig | Select-Object -Property Name, Identity, MaxRecipientEnvelopeLimit

If the value of "MaxRecipientEnvelopeLimit" is not set to "5000", this is a finding.

or

If "MaxRecipientEnvelopeLimit" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.

Vulnerability Number

V-259693

Documentable

False

Rule Version

EX19-MB-000142

Severity Override Guidance

Review the Email Domain Security Plan (EDSP).

Determine the global maximum message recipient count.

Open the Exchange Management Shell and enter the following command:

Get-TransportConfig | Select-Object -Property Name, Identity, MaxRecipientEnvelopeLimit

If the value of "MaxRecipientEnvelopeLimit" is not set to "5000", this is a finding.

or

If "MaxRecipientEnvelopeLimit" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.

Check Content Reference

M

Target Key

5580