Rules/MAIL-002.dkim-enabled.psd1
|
@{ Id = 'MAIL-002' Title = 'DKIM selectors are published for every custom domain' Area = 'EmailAuthDns' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (DKIM signing)' 'https://learn.microsoft.com/defender-office-365/email-authentication-dkim-configure' ) Rationale = 'DKIM cryptographically ties outgoing mail to the domain; DMARC alignment depends on it. Microsoft 365 uses the selector1/selector2 CNAME pair.' Remediation = 'Enable DKIM signing per domain in Microsoft Defender and publish both selector CNAME records.' Test = { param($Snapshot) $domains = @($Snapshot.EmailAuthDns | Where-Object { -not $_.isOnMicrosoft }) if ($domains.Count -eq 0) { return New-TLRuleResult -Status Pass -Evidence 'Only *.onmicrosoft.com domains are verified - DKIM is signed by Microsoft automatically.' } $bad = @($domains | Where-Object { -not ($_.dkim.selector1 -and $_.dkim.selector2) }) if ($bad.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($bad | ForEach-Object { "$($_.domain): selector CNAMEs missing" }) } else { New-TLRuleResult -Status Pass -Evidence @($domains | ForEach-Object { "$($_.domain): both selectors published" }) } } } |