Expose domain-level context for SPF / DKIM / DMARC findings in Exchange Online
@silverhack ci sta già lavorando.
Dal 17/7/2026.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
Summary
Monkey365 currently surfaces mail-auth findings (SPF, DKIM, DMARC) without specifying which accepted domains are impacted. Adding domain-level granularity will transform raw alerts into actionable intelligence by pinpointing exactly where alignment fails.
Problem Statement
- Ambiguous remediation scope – A single tenant may host dozens of authoritative domains; without domain attribution, responders must manually correlate records.
- Inefficient triage – Security and messaging teams burn cycles querying DNS or Exchange admin center to isolate the affected namespaces.
- Risk prioritisation blind spot – Critical revenue-generating domains (e.g., invoicing.example.com) cannot be surfaced or ranked against low-impact vanity domains.
Proposed Enhancement
-
Domain discovery
- Enumerate tenant domains via Graph
/domainsand/organization/{id}/domainsAPIs. - Include accepted, authoritative, and shared namespaces.
- Enumerate tenant domains via Graph
-
Granular evaluation
- Evaluate SPF, DKIM selector presence, and DMARC policy per domain.
- Record alignment failures individually instead of aggregating at tenant level.
-
Reporting & UX updates
- For each failing check, list the specific domain(s) alongside the recommended fix.
- Provide an optional
--mail-auth-jsonswitch to output raw per-domain status for CI/CD consumption.
Acceptance Criteria
| ID | Condition | Success Metric |
|---|---|---|
| AC-1 | Scan a tenant with 3 domains, only one lacking DKIM | Report exactly 1 DKIM failure with domain name shown |
| AC-2 | Generate export with --mail-auth-json |
JSON array contains objects { domain, spf, dkim, dmarc } |
| AC-3 | Existing non-mail-auth findings unaffected | Regression suite passes |
Business Value
Domain-level insight accelerates fix velocity, reduces mean time to detect & remediate mail-spoofing risk, and enables data-driven prioritisation of high-value brands.
Additional Context
Customer feedback highlights that up to 70 % of false-positive churn in mail-auth audits stems from unclear domain attribution. Early adopters of prototype scripts saw triage time drop from ~2 hours to <15 minutes per tenant.
We’re happy to provide sample tenants and collaborate on testing strategies.
- Lingua principale
- PowerShell
- Stelle
- 1.4k
- Fork
- 144
- Merge medio
- 1g 21h
- PR unite (30g)
- 1
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di silverhack/monkey365
-
bug status/needs-triage
Difficoltà 2/5 1-3 ore Idoneità per principianti 86/100
silverhack/monkey365#200 ·
-
bug status/needs-triage
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
silverhack/monkey365#199 ·
-
bug status/needs-triage
Difficoltà 4/5 3-5 giorni Idoneità per principianti 56/100
silverhack/monkey365#198 ·
-
documentation enhancement help wanted impact-low priority-medium question
Difficoltà 4/5 3-5 giorni Idoneità per principianti 68/100
silverhack/monkey365#187 · 1 commento ·
-
documentation enhancement epic priority-medium
Difficoltà 5/5 Più di una settimana Idoneità per principianti 30/100
silverhack/monkey365#184 ·