Please confirm:
Problem Statement
If a customer does something stupid with their domain that breaks deliverability (i.e. move to new name server and not update MX records) we may not notice until the customer finally twigs something is wrong.
It's possible to get a list of all domains for all tenants, a column that has the equivalent to the 365 admin "Healthy/Service Problems" info would really help.
Benefits for MSPs
Allows the MSP to react to configuration errors quicker and notice issues before the customer. With the data pulled into CIPP, alerts could be generated.
This could be further improved with scripted DNS checks that validate additional records like DMARC and properly evaluating SPF records - had a case where customer added a second SPF record because that's what their bulk mailer told them to do - resulting
Value or Importance
This helps a MSP improve value to their customer by having the single pane of glass to quickly raise configuration errors that they may be unaware of without either the customer complaining about deliverability errors or manually checking the 365 admin portal on the tenant.
PowerShell Commands (Optional)
Currently we manually use the following script on a customer domain
param(
[Parameter(Mandatory=$true)]
[string]$DomainName
)
Write-Host "`nChecking Microsoft 365 DNS records for $DomainName" -ForegroundColor Cyan
Write-Host "------------------------------------------------------"
function Test-DnsRecord {
param (
[string]$Name,
[string]$Type,
[string]$contentCheck
)
try {
$tryResolve = Resolve-DnsName -Name $Name -Type $Type -ErrorAction Stop
$result = $tryResolve | Where-Object { $_.Type -eq $Type }
if (-not $result) {
[PSCustomObject]@{
Record = $Name
Type = $Type
Status = "Missing"
Value = ""
}
} else {
[PSCustomObject]@{
Record = $Name
Type = $Type
Status = "Found"
Value = ($result | Select-Object -ExpandProperty NameHost -ErrorAction SilentlyContinue) `
?? ($result | Select-Object -ExpandProperty Strings -ErrorAction SilentlyContinue) `
?? ($result | Select-Object -ExpandProperty NameExchange -ErrorAction SilentlyContinue)
}
}
}
catch {
[PSCustomObject]@{
Record = $Name
Type = $Type
Status = "Missing"
Value = ""
}
}
}
$checks = @(
@{ Name=$DomainName; Type="MX" }
@{ Name="autodiscover.$DomainName"; Type="CNAME" }
@{ Name=$DomainName; Type="TXT" }
@{ Name="sip.$DomainName"; Type="CNAME" }
@{ Name="lyncdiscover.$DomainName"; Type="CNAME" }
@{ Name="enterpriseregistration.$DomainName"; Type="CNAME" }
@{ Name="enterpriseenrollment.$DomainName"; Type="CNAME" }
@{ Name="selector1._domainkey.$DomainName"; Type="CNAME" }
@{ Name="selector2._domainkey.$DomainName"; Type="CNAME" }
@{ Name="_dmarc.$DomainName"; Type="TXT"}
)
$results = foreach ($check in $checks) {
Test-DnsRecord -Name $check.Name -Type $check.Type
}
$results | Format-Table -AutoSize
Write-Host "`nChecking MX Records" -ForegroundColor Yellow
$mxRecords = Resolve-DnsName -Name $DomainName -Type MX -ErrorAction SilentlyContinue |
Where-Object Type -eq "MX"
$validMx = $mxRecords | Where-Object {
$_.NameExchange -match '\.mail\.protection\.outlook\.com\.?$'
}
if ($validMx) {
Write-Host "✓ Microsoft 365 MX record found" -ForegroundColor Green
} else {
Write-Host "✗ No MX record pointing to *.mail.protection.outlook.com found" -ForegroundColor Red
}
Write-Host "`nSPF Analysis" -ForegroundColor Yellow
try {
$spf = (Resolve-DnsName -Name $DomainName -Type TXT |
Where-Object {$_.Strings -match "spf"}) |
Select-Object -ExpandProperty Strings
if ($spf -match "include:spf.protection.outlook.com") {
Write-Host "✓ Microsoft 365 SPF record detected" -ForegroundColor Green
}
else {
Write-Host "✗ SPF record does not contain include:spf.protection.outlook.com" -ForegroundColor Red
}
}
catch {
Write-Host "✗ No SPF record found" -ForegroundColor Red
}
Please confirm:
Problem Statement
If a customer does something stupid with their domain that breaks deliverability (i.e. move to new name server and not update MX records) we may not notice until the customer finally twigs something is wrong.
It's possible to get a list of all domains for all tenants, a column that has the equivalent to the 365 admin "Healthy/Service Problems" info would really help.
Benefits for MSPs
Allows the MSP to react to configuration errors quicker and notice issues before the customer. With the data pulled into CIPP, alerts could be generated.
This could be further improved with scripted DNS checks that validate additional records like DMARC and properly evaluating SPF records - had a case where customer added a second SPF record because that's what their bulk mailer told them to do - resulting
Value or Importance
This helps a MSP improve value to their customer by having the single pane of glass to quickly raise configuration errors that they may be unaware of without either the customer complaining about deliverability errors or manually checking the 365 admin portal on the tenant.
PowerShell Commands (Optional)
Currently we manually use the following script on a customer domain