Auditing and Enforcing SPF, DKIM, and DMARC Across All Microsoft 365 Tenant Domains with PowerShell

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@lab365.in

<#
.SYNOPSIS
    Audits SPF, DKIM, and DMARC posture across all verified domains in a Microsoft 365 tenant.
.DESCRIPTION
    Enumerates all accepted domains in Exchange Online, queries Get-DkimSigningConfig,
    resolves public SPF, DKIM CNAME, and DMARC TXT records, and exports a compliance CSV report.
.NOTES
    Author: Sunil Chauhan (https://www.lab365.in)
    Requirements: ExchangeOnlineManagement, Windows PowerShell 5.1 or PowerShell 7
#>

[CmdletBinding()]
param (
    [Parameter(Mandatory = $false)]
    [string]$DnsServer = "1.1.1.1",

    [Parameter(Mandatory = $false)]
    [string]$ExportPath = ".\M365_EmailAuth_Compliance_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
)

Write-Host "==========================================================" -ForegroundColor Cyan
Write-Host "  Microsoft 365: Multi-Domain SPF / DKIM / DMARC Auditor  " -ForegroundColor Cyan
Write-Host "==========================================================" -ForegroundColor Cyan

# Retrieve all accepted domains and DKIM signing configurations
$domains = Get-AcceptedDomain
$dkimConfigs = Get-DkimSigningConfig

# Index DKIM configs by domain name
$dkimIndex = @{}
foreach ($dk in $dkimConfigs) {
    $dkimIndex[$dk.Domain] = $dk
}

$results = [System.Collections.Generic.List[PSCustomObject]]::new()

foreach ($d in $domains) {
    $domain = $d.DomainName
    Write-Host "[*] Auditing domain: $domain..." -ForegroundColor Yellow

    # 1. Check SPF Record
    $txtRecords = Resolve-DnsName -Name $domain -Type TXT -Server $DnsServer -ErrorAction SilentlyContinue |
                  Where-Object { $_.Type -eq 'TXT' }
    $spfRecords = @($txtRecords | ForEach-Object { $_.Strings -join '' } | Where-Object { $_ -match "^v=spf1\b" })

    $spfRecord = if ($spfRecords.Count -eq 1) {
        $spfRecords[0]
    } elseif ($spfRecords.Count -gt 1) {
        "MULTIPLE SPF RECORDS ($($spfRecords.Count)) - RFC Violation"
    } else {
        "Missing"
    }

    $spfStatus = if ($spfRecords.Count -gt 1) {
        "FAIL: Multiple SPF records"
    } elseif ($spfRecord -match "-all\b") {
        "PASS: HardFail (-all)"
    } elseif ($spfRecord -match "~all\b") {
        "WARN: SoftFail (~all)"
    } elseif ($spfRecord -match "\?all|\+all") {
        "FAIL: Permissive (?all/+all)"
    } else {
        "FAIL: Missing SPF"
    }

    # 2. Check DKIM Configuration & CNAMEs
    $dkimObj = $dkimIndex[$domain]
    $dkimEnabled = if ($dkimObj) { [bool]$dkimObj.Enabled } else { $false }
    $dkimKeySize = if ($dkimObj) { $dkimObj.Selector1KeySize } else { "N/A" }

    $sel1 = Resolve-DnsName -Name "selector1._domainkey.$domain" -Type CNAME -Server $DnsServer -ErrorAction SilentlyContinue |
            Where-Object { $_.Type -eq 'CNAME' }
    $sel2 = Resolve-DnsName -Name "selector2._domainkey.$domain" -Type CNAME -Server $DnsServer -ErrorAction SilentlyContinue |
            Where-Object { $_.Type -eq 'CNAME' }

    $dkimStatus = if ($dkimEnabled -and $dkimKeySize -ge 2048) {
        "PASS: Enabled ($dkimKeySize-bit)"
    } elseif ($dkimEnabled) {
        "WARN: Enabled ($dkimKeySize-bit - Rotate to 2048)"
    } elseif ($sel1 -and $sel2) {
        "ACTION NEEDED: CNAMEs published, run Enable-DkimSigningConfig"
    } else {
        "FAIL: Disabled & Missing CNAMEs"
    }

    # 3. Check DMARC Record (_dmarc.<domain>)
    $dmarcTxts = Resolve-DnsName -Name "_dmarc.$domain" -Type TXT -Server $DnsServer -ErrorAction SilentlyContinue |
                 Where-Object { $_.Type -eq 'TXT' }
    $dmarcList = @($dmarcTxts | ForEach-Object { $_.Strings -join '' } | Where-Object { $_ -match "^v=DMARC1\b" })
    $dmarcRecord = if ($dmarcList.Count -ge 1) { $dmarcList[0] } else { "Missing" }

    $dmarcPolicy = if ($dmarcRecord -match "(?i)\bp=([a-z]+)") { $matches[1].ToLower() } else { "none/missing" }

    $dmarcStatus = switch ($dmarcPolicy) {
        "reject"     { "PASS: Enforce (p=reject)" }
        "quarantine" { "PASS: Enforce (p=quarantine)" }
        "none"       { "WARN: Monitoring Only (p=none)" }
        default      { "FAIL: Missing DMARC" }
    }

    # Overall Compliance Score
    $isCompliant = ($spfStatus -like "PASS*") -and ($dkimStatus -like "PASS*") -and ($dmarcStatus -like "PASS*")

    $results.Add([PSCustomObject]@{
        Domain         = $domain
        IsDefault      = $d.Default
        SPFStatus      = $spfStatus
        DKIMStatus     = $dkimStatus
        DMARCStatus    = $dmarcStatus
        FullyCompliant = $isCompliant
        SPFRecord      = $spfRecord
        DMARCRecord    = $dmarcRecord
    })
}

Write-Host ""
$results | Format-Table Domain, SPFStatus, DKIMStatus, DMARCStatus, FullyCompliant -AutoSize
$results | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding utf8
Write-Host "[+] Compliance scorecard exported to: $ExportPath" -ForegroundColor Green

$domain = "lab365.in"

# Initialize DKIM config if not yet created, and print required CNAME values
New-DkimSigningConfig -DomainName $domain -KeySize 2048 -Enabled $false
Get-DkimSigningConfig -Identity $domain | Format-List Selector1CNAME, Selector2CNAME

# Once CNAMEs are published in DNS, enable DKIM signing
Set-DkimSigningConfig -Identity $domain -Enabled $true

# If already enabled with a legacy 1024-bit key, rotate to 2048-bit
Rotate-DkimSigningConfig -Identity $domain -KeySize 2048