Expose domain-level context for SPF / DKIM / DMARC findings in Exchange Online

Summary

Monkey365 currently surfaces mail-auth findings (SPF, DKIM, DMARC) without specifying which accepted domains are impacted. Adding domain-level granularity will transform raw alerts into actionable intelligence by pinpointing exactly where alignment fails.

Problem Statement

• Ambiguous remediation scope – A single tenant may host dozens of authoritative domains; without domain attribution, responders must manually correlate records.
• Inefficient triage – Security and messaging teams burn cycles querying DNS or Exchange admin center to isolate the affected namespaces.
• Risk prioritisation blind spot – Critical revenue-generating domains (e.g., invoicing.example.com) cannot be surfaced or ranked against low-impact vanity domains.

Proposed Enhancement

1. Domain discovery

   • Enumerate tenant domains via Graph /domains and /organization/{id}/domains APIs.
   • Include accepted, authoritative, and shared namespaces.

2. Granular evaluation

   • Evaluate SPF, DKIM selector presence, and DMARC policy per domain.
   • Record alignment failures individually instead of aggregating at tenant level.

3. Reporting & UX updates

   • For each failing check, list the specific domain(s) alongside the recommended fix.
   • Provide an optional --mail-auth-json switch to output raw per-domain status for CI/CD consumption.

Acceptance Criteria

Business Value

Domain-level insight accelerates fix velocity, reduces mean time to detect & remediate mail-spoofing risk, and enables data-driven prioritisation of high-value brands.

Additional Context

Customer feedback highlights that up to 70 % of false-positive churn in mail-auth audits stems from unclear domain attribution. Early adopters of prototype scripts saw triage time drop from ~2 hours to <15 minutes per tenant.

We’re happy to provide sample tenants and collaborate on testing strategies.