Recipients of sent email must be unable to be added to the safe senders list.

From Microsoft Outlook 2013 STIG

Part of DTOO224 - Email Recipient to Safe Sender List

Associated with: CCI-000366

SV-53885r1_rule Recipients of sent email must be unable to be added to the safe senders list.

Vulnerability discussion

Users could send email messages to request that they be taken off a mailing list. If the email recipient is then automatically added to the Safe Senders List, future e mail messages from that address will no longer be sent to the users Junk email folder, even if it would otherwise be considered junk.By default, recipients of outgoing messages are not added automatically to individual users' Safe Senders Lists. However, users can change this configuration in the Outlook user interface.

Check content

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Outlook Options -> Preferences -> Junk E-mail "Add e-mail recipients to users' Safe Senders Lists" is set to "Disabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\15.0\outlook\options\mail Criteria: If the value JunkMailTrustOutgoingRecipients is REG_DWORD = 0, this is not a finding.

Fix text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Outlook Options -> Preferences -> Junk E-mail "Add e-mail recipients to users' Safe Senders Lists" to "Disabled".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.