Expose domain-level context for SPF / DKIM / DMARC findings in Exchange Online
@silverhack arbeitet bereits daran.
Seit 17.7.2026.
Bewertung
Dieses Issue wurde noch nicht bewertet.
Beschreibung
Summary
Monkey365 currently surfaces mail-auth findings (SPF, DKIM, DMARC) without specifying which accepted domains are impacted. Adding domain-level granularity will transform raw alerts into actionable intelligence by pinpointing exactly where alignment fails.
Problem Statement
- Ambiguous remediation scope – A single tenant may host dozens of authoritative domains; without domain attribution, responders must manually correlate records.
- Inefficient triage – Security and messaging teams burn cycles querying DNS or Exchange admin center to isolate the affected namespaces.
- Risk prioritisation blind spot – Critical revenue-generating domains (e.g., invoicing.example.com) cannot be surfaced or ranked against low-impact vanity domains.
Proposed Enhancement
-
Domain discovery
- Enumerate tenant domains via Graph
/domainsand/organization/{id}/domainsAPIs. - Include accepted, authoritative, and shared namespaces.
- Enumerate tenant domains via Graph
-
Granular evaluation
- Evaluate SPF, DKIM selector presence, and DMARC policy per domain.
- Record alignment failures individually instead of aggregating at tenant level.
-
Reporting & UX updates
- For each failing check, list the specific domain(s) alongside the recommended fix.
- Provide an optional
--mail-auth-jsonswitch to output raw per-domain status for CI/CD consumption.
Acceptance Criteria
| ID | Condition | Success Metric |
|---|---|---|
| AC-1 | Scan a tenant with 3 domains, only one lacking DKIM | Report exactly 1 DKIM failure with domain name shown |
| AC-2 | Generate export with --mail-auth-json |
JSON array contains objects { domain, spf, dkim, dmarc } |
| AC-3 | Existing non-mail-auth findings unaffected | Regression suite passes |
Business Value
Domain-level insight accelerates fix velocity, reduces mean time to detect & remediate mail-spoofing risk, and enables data-driven prioritisation of high-value brands.
Additional Context
Customer feedback highlights that up to 70 % of false-positive churn in mail-auth audits stems from unclear domain attribution. Early adopters of prototype scripts saw triage time drop from ~2 hours to <15 minutes per tenant.
We’re happy to provide sample tenants and collaborate on testing strategies.
- Vorherrschende Sprache
- PowerShell
- Sterne
- 1.4k
- Forks
- 144
- Ø Merge
- 1 T. 21 Std.
- Gemergte PRs (30 T.)
- 1
Entwicklungsumgebung
- Kein Dockerfile und keine Docker-Compose-Datei
- Hat eine Pull-Request-Vorlage
- Beitragsleitfaden lesen
Erste Schritte
- Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
- Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
- Forken Sie das Repository und arbeiten Sie in einem Branch.
- Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.
Mehr aus silverhack/monkey365
-
bug status/needs-triage
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 86/100
silverhack/monkey365#200 ·
-
bug status/needs-triage
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100
silverhack/monkey365#199 ·
-
bug status/needs-triage
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 56/100
silverhack/monkey365#198 ·
-
documentation enhancement help wanted impact-low priority-medium question
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 68/100
silverhack/monkey365#187 · 1 Kommentar ·
-
documentation enhancement epic priority-medium
Schwierigkeit 5/5 Über eine Woche Anfängerfreundlichkeit 30/100
silverhack/monkey365#184 ·