Expose domain-level context for SPF / DKIM / DMARC findings in Exchange Online
@silverhack 已经在做这个了。
开始于 2026年7月17日。
评估
这个 Issue 还没有评估数据。
描述
Summary
Monkey365 currently surfaces mail-auth findings (SPF, DKIM, DMARC) without specifying which accepted domains are impacted. Adding domain-level granularity will transform raw alerts into actionable intelligence by pinpointing exactly where alignment fails.
Problem Statement
- Ambiguous remediation scope – A single tenant may host dozens of authoritative domains; without domain attribution, responders must manually correlate records.
- Inefficient triage – Security and messaging teams burn cycles querying DNS or Exchange admin center to isolate the affected namespaces.
- Risk prioritisation blind spot – Critical revenue-generating domains (e.g., invoicing.example.com) cannot be surfaced or ranked against low-impact vanity domains.
Proposed Enhancement
-
Domain discovery
- Enumerate tenant domains via Graph
/domainsand/organization/{id}/domainsAPIs. - Include accepted, authoritative, and shared namespaces.
- Enumerate tenant domains via Graph
-
Granular evaluation
- Evaluate SPF, DKIM selector presence, and DMARC policy per domain.
- Record alignment failures individually instead of aggregating at tenant level.
-
Reporting & UX updates
- For each failing check, list the specific domain(s) alongside the recommended fix.
- Provide an optional
--mail-auth-jsonswitch to output raw per-domain status for CI/CD consumption.
Acceptance Criteria
| ID | Condition | Success Metric |
|---|---|---|
| AC-1 | Scan a tenant with 3 domains, only one lacking DKIM | Report exactly 1 DKIM failure with domain name shown |
| AC-2 | Generate export with --mail-auth-json |
JSON array contains objects { domain, spf, dkim, dmarc } |
| AC-3 | Existing non-mail-auth findings unaffected | Regression suite passes |
Business Value
Domain-level insight accelerates fix velocity, reduces mean time to detect & remediate mail-spoofing risk, and enables data-driven prioritisation of high-value brands.
Additional Context
Customer feedback highlights that up to 70 % of false-positive churn in mail-auth audits stems from unclear domain attribution. Early adopters of prototype scripts saw triage time drop from ~2 hours to <15 minutes per tenant.
We’re happy to provide sample tenants and collaborate on testing strategies.
- 主要语言
- PowerShell
- 星标
- 1.4k
- 派生
- 144
- 平均合并
- 1 天 21 小时
- 30 天内合并 PR
- 1
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
silverhack/monkey365 的其他 Issue
-
bug status/needs-triage
难度 2/5 1-3 小时 新手友好度 86/100
silverhack/monkey365#200 ·
-
bug status/needs-triage
难度 2/5 1-3 小时 新手友好度 78/100
silverhack/monkey365#199 ·
-
bug status/needs-triage
难度 4/5 3-5 天 新手友好度 56/100
silverhack/monkey365#198 ·
-
documentation enhancement help wanted impact-low priority-medium question
难度 4/5 3-5 天 新手友好度 68/100
silverhack/monkey365#187 · 1 条评论 ·
-
documentation enhancement epic priority-medium
难度 5/5 一周以上 新手友好度 30/100
silverhack/monkey365#184 ·