Microsoft 365 audit: protecting your email domain

Querying DNS

All three mechanisms are published in your domain’s DNS. A few queries are enough to read them, with no tenant access at all:

DOMAIN=example.ca

dig +short TXT "$DOMAIN" | grep -i "v=spf1"            # SPF
dig +short TXT "_dmarc.$DOMAIN"                        # DMARC
dig +short CNAME "selector1._domainkey.$DOMAIN"        # DKIM (Microsoft 365)
dig +short CNAME "selector2._domainkey.$DOMAIN"

On Windows, without dig:

$domain = "example.ca"
(Resolve-DnsName -Type TXT $domain).Strings | Where-Object { $_ -like "v=spf1*" }
(Resolve-DnsName -Type TXT "_dmarc.$domain").Strings

Reading the SPF record

SPF lists the servers allowed to send for your domain. For Microsoft 365 it contains at least include:spf.protection.outlook.com. What to check:

• A single SPF record. Two v=spf1 records invalidate SPF entirely.
• The ending. -all rejects unlisted senders, ~all only flags them. +all allows everyone: that is a critical finding.
• The 10 DNS lookup limit. Each include counts for at least one. Beyond ten, SPF fails.

Checking DKIM

DKIM cryptographically signs every outgoing email. In Microsoft 365, the two CNAMEs selector1 and selector2 must exist, and signing must be enabled for each custom domain:

# Official module : Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -ShowBanner:$false

Get-DkimSigningConfig | Select-Object Domain, Enabled, Status

A domain with Enabled set to False sends email signed only with the onmicrosoft.com domain, which weakens DMARC alignment.

Interpreting DMARC

DMARC tells receiving servers what to do with an email that fails SPF and DKIM, and where to send reports. The p= policy is the key element:

• p=none: monitoring only. Useful at first, but does not protect against spoofing.
• p=quarantine: non-compliant email goes to junk.
• p=reject: non-compliant email is refused. That is the goal.

We recommend adding a reporting address (rua=), reviewing the reports for a few weeks to find forgotten legitimate senders (newsletters, billing, CRM), then moving gradually to quarantine and reject.

Domains that never send email

A secondary or reserved domain with no SPF or DMARC is an ideal target for spoofing. Even if it never sends email, publish:

• an SPF record that authorizes no one: v=spf1 -all;
• a DMARC record that rejects everything: v=DMARC1; p=reject;.