Enabling Inbound SMTP DANE with DNSSEC in Exchange Online Using PowerShell

Enable-SmtpDaneInbound -DomainName "lab365.in" -NotifyEmail "[email protected]"

Get-SmtpDaneInboundStatus -DomainName "lab365.in" | Format-List

<#
.SYNOPSIS
    Audits all verified domains in Exchange Online for DNSSEC and Inbound SMTP DANE status.
.DESCRIPTION
    Checks MX records, DNSSEC status (Get-DnssecStatusForVerifiedDomain), and
    SMTP DANE status (Get-SmtpDaneInboundStatus) across all accepted domains.
.NOTES
    Author: Sunil Chauhan (https://www.lab365.in)
    Requirements: ExchangeOnlineManagement
#>

[CmdletBinding()]
param (
    [string]$ExportPath = ".\EXO_DANE_DNSSEC_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
)

Write-Host "==========================================================" -ForegroundColor Cyan
Write-Host "  Exchange Online: DNSSEC & Inbound SMTP DANE Auditor     " -ForegroundColor Cyan
Write-Host "==========================================================" -ForegroundColor Cyan

$acceptedDomains = Get-AcceptedDomain | Where-Object { $_.DomainName -notlike "*.onmicrosoft.com" }
$report = [System.Collections.Generic.List[PSCustomObject]]::new()

foreach ($d in $acceptedDomains) {
    $domainName = $d.DomainName
    Write-Host "[*] Checking domain: $domainName..." -ForegroundColor Yellow

    # Resolve public MX
    $mxRecords = Resolve-DnsName -Name $domainName -Type MX -ErrorAction SilentlyContinue |
                 Where-Object { $_.QueryType -eq 'MX' } |
                 Sort-Object Preference
    $primaryMx = if ($mxRecords) { $mxRecords[0].NameExchange } else { "No MX Found" }
    $usesModernMx = $primaryMx -like "*.mx.microsoft"

    # Query EXO DNSSEC & DANE status
    $dnssec = Get-DnssecStatusForVerifiedDomain -DomainName $domainName -ErrorAction SilentlyContinue
    $dane   = Get-SmtpDaneInboundStatus -DomainName $domainName -ErrorAction SilentlyContinue

    $dnssecState = if ($dnssec) { [string]$dnssec.DnssecFeatureStatus } else { "NotConfigured" }
    $daneState   = if ($dane)   { [string]$dane.SmtpDaneStatus }        else { "Disabled" }

    $recommendation = if ($daneState -eq "Enabled") {
        "Compliant: DNSSEC + Inbound DANE Active"
    } elseif ($usesModernMx -and $dnssecState -eq "Enabled") {
        "Ready for DANE: Run Enable-SmtpDaneInbound"
    } elseif ($primaryMx -like "*.mail.protection.outlook.com") {
        "Legacy MX: Run Enable-DnssecForVerifiedDomain & migrate to *.mx.microsoft"
    } else {
        "3rd-Party MX or Unconfigured ($primaryMx)"
    }

    $report.Add([PSCustomObject]@{
        DomainName        = $domainName
        DomainType        = $d.DomainType
        PrimaryMX         = $primaryMx
        UsesModernMx      = $usesModernMx
        ExoDnssecStatus   = $dnssecState
        InboundDaneStatus = $daneState
        Recommendation    = $recommendation
    })
}

$report | Format-Table DomainName, PrimaryMX, ExoDnssecStatus, InboundDaneStatus, Recommendation -AutoSize
$report | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding utf8
Write-Host "[+] Audit report saved to: $ExportPath" -ForegroundColor Green