Email Authentication per Domain (SPF / DKIM / DMARC)

The question it answers: Which accepted domains lack SPF, DKIM or an enforced DMARC policy, so mail claiming to come from them can be spoofed?

Large mailbox providers reject or junk mail from domains without SPF, DKIM and an enforced DMARC policy - and without them anyone can send mail that appears to come from your domain. One row per accepted domain, including domains you never send from (they need ‘v=spf1 -all’ and p=reject to stop spoofing).

Note

Recommended end state: one SPF record ending in -all or ~all, DKIM enabled in Exchange Online, DMARC p=quarantine or p=reject.

At a glance

Where in the app	Exchange Online › Mail Security Posture › SPF / DKIM / DMARC
Workload	Exchange Online
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.posture.mail-domain-authentication

Columns

Column	Key	Type
Domain	Domain	Text
Findings	FindingsString	Status
DMARC policy	DmarcPolicy	Text
DKIM	DkimText	Text
SPF	Spf	Text
DMARC record	DmarcRecord	Text
MX	MxRecords	Text

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-AcceptedDomain
• Get-DkimSigningConfig
• Resolve-DnsName TXT / MX (on the host)

Through the API and MCP

GET /ir-api/v1/reports/exchange.posture.mail-domain-authentication?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.posture.mail-domain-authentication. The client needs the Read grant for Exchange Online. See Using the API.