From 3d9aece3d7fcb87a2ad3079be8f8282b3a139ebc Mon Sep 17 00:00:00 2001 From: Haris Habib Date: Sat, 25 Jul 2026 23:01:16 +1000 Subject: [PATCH 1/3] fix(tests): resolve missing DKIM config exceptions --- powershell/public/cis/Test-MtCisDkim.ps1 | 13 ++++++++++++- powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 | 13 ++++++++++++- website/contributors/contributors.yml | 6 ++++++ 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/powershell/public/cis/Test-MtCisDkim.ps1 b/powershell/public/cis/Test-MtCisDkim.ps1 index 3fbf57653..6b89182df 100644 --- a/powershell/public/cis/Test-MtCisDkim.ps1 +++ b/powershell/public/cis/Test-MtCisDkim.ps1 @@ -1,4 +1,4 @@ -function Test-MtCisDkim { +function Test-MtCisDkim { <# .SYNOPSIS Checks state of DKIM for all EXO domains @@ -42,6 +42,17 @@ $_.domain -eq $domain.domainname } + if (-not $dkimSigningConfig) { + $dkimRecord = [PSCustomObject]@{ + domain = $domain.DomainName + pass = if ($domain.SendingFromDomainDisabled) { 'Skipped' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Passed' } else { 'Failed' } + reason = if ($domain.SendingFromDomainDisabled) { 'Parked domain' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Microsoft auto-signs DKIM for onmicrosoft.com domains' } else { 'No DkimSigningConfig found for domain' } + dkimRecord = $null + } + $dkimRecords += $dkimRecord + continue + } + if ((Get-Date) -gt $dkimSigningConfig.RotateOnDate) { if ($Selector -ne $dkimSigningConfig.SelectorAfterRotateOnDate) { Write-Verbose "Using DKIM $($dkimSigningConfig.SelectorAfterRotateOnDate) based on EXO config" diff --git a/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 b/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 index 8bc94b05b..ec059c9a4 100644 --- a/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 +++ b/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 @@ -1,4 +1,4 @@ -function Test-MtCisaDkim { +function Test-MtCisaDkim { <# .SYNOPSIS Checks state of DKIM for all EXO domains @@ -40,6 +40,17 @@ $dkimSigningConfig = $dkimSigningConfigs | Where-Object {` $_.domain -eq $domain.domainname } + + if (-not $dkimSigningConfig) { + $dkimRecord = [PSCustomObject]@{ + domain = $domain.DomainName + pass = if ($domain.SendingFromDomainDisabled) { 'Skipped' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Passed' } else { 'Failed' } + reason = if ($domain.SendingFromDomainDisabled) { 'Parked domain' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Microsoft auto-signs DKIM for onmicrosoft.com domains' } else { 'No DkimSigningConfig found for domain' } + dkimRecord = $null + } + $dkimRecords += $dkimRecord + continue + } if ((Get-Date) -gt $dkimSigningConfig.RotateOnDate) { if ($Selector -ne $dkimSigningConfig.SelectorAfterRotateOnDate) { Write-Verbose "Using DKIM $($dkimSigningConfig.SelectorAfterRotateOnDate) based on EXO config" diff --git a/website/contributors/contributors.yml b/website/contributors/contributors.yml index 327ff082f..c2e9caef9 100644 --- a/website/contributors/contributors.yml +++ b/website/contributors/contributors.yml @@ -30,6 +30,12 @@ alexandair: name: Aleksandar Nikolić title: Microsoft MVP +amlhive-tech: + name: Haris Habib + company: AMLHIVE + emails: + - tech@amlhive.com.au + amandaw33: andremieth: From 1a2489fc0cf3a876a71b7d97d2f3533c8f6be47c Mon Sep 17 00:00:00 2001 From: Merill Fernando Date: Sat, 1 Aug 2026 10:26:28 +1000 Subject: [PATCH 2/3] fix: identify initial domain for automatic DKIM --- powershell/public/cis/Test-MtCisDkim.ps1 | 6 +-- .../public/cisa/exchange/Test-MtCisaDkim.ps1 | 6 +-- .../tests/functions/Test-MtDkim.Tests.ps1 | 50 +++++++++++++++++++ 3 files changed, 56 insertions(+), 6 deletions(-) create mode 100644 powershell/tests/functions/Test-MtDkim.Tests.ps1 diff --git a/powershell/public/cis/Test-MtCisDkim.ps1 b/powershell/public/cis/Test-MtCisDkim.ps1 index 6b89182df..f47970d47 100644 --- a/powershell/public/cis/Test-MtCisDkim.ps1 +++ b/powershell/public/cis/Test-MtCisDkim.ps1 @@ -1,4 +1,4 @@ -function Test-MtCisDkim { +function Test-MtCisDkim { <# .SYNOPSIS Checks state of DKIM for all EXO domains @@ -45,8 +45,8 @@ function Test-MtCisDkim { if (-not $dkimSigningConfig) { $dkimRecord = [PSCustomObject]@{ domain = $domain.DomainName - pass = if ($domain.SendingFromDomainDisabled) { 'Skipped' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Passed' } else { 'Failed' } - reason = if ($domain.SendingFromDomainDisabled) { 'Parked domain' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Microsoft auto-signs DKIM for onmicrosoft.com domains' } else { 'No DkimSigningConfig found for domain' } + pass = if ($domain.SendingFromDomainDisabled) { 'Skipped' } elseif ($domain.InitialDomain -eq $true) { 'Passed' } else { 'Failed' } + reason = if ($domain.SendingFromDomainDisabled) { 'Parked domain' } elseif ($domain.InitialDomain -eq $true) { 'Microsoft auto-signs DKIM for the initial onmicrosoft.com domain' } else { 'No DkimSigningConfig found for domain' } dkimRecord = $null } $dkimRecords += $dkimRecord diff --git a/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 b/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 index ec059c9a4..d25901815 100644 --- a/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 +++ b/powershell/public/cisa/exchange/Test-MtCisaDkim.ps1 @@ -1,4 +1,4 @@ -function Test-MtCisaDkim { +function Test-MtCisaDkim { <# .SYNOPSIS Checks state of DKIM for all EXO domains @@ -44,8 +44,8 @@ function Test-MtCisaDkim { if (-not $dkimSigningConfig) { $dkimRecord = [PSCustomObject]@{ domain = $domain.DomainName - pass = if ($domain.SendingFromDomainDisabled) { 'Skipped' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Passed' } else { 'Failed' } - reason = if ($domain.SendingFromDomainDisabled) { 'Parked domain' } elseif ($domain.DomainName -like '*.onmicrosoft.com') { 'Microsoft auto-signs DKIM for onmicrosoft.com domains' } else { 'No DkimSigningConfig found for domain' } + pass = if ($domain.SendingFromDomainDisabled) { 'Skipped' } elseif ($domain.InitialDomain -eq $true) { 'Passed' } else { 'Failed' } + reason = if ($domain.SendingFromDomainDisabled) { 'Parked domain' } elseif ($domain.InitialDomain -eq $true) { 'Microsoft auto-signs DKIM for the initial onmicrosoft.com domain' } else { 'No DkimSigningConfig found for domain' } dkimRecord = $null } $dkimRecords += $dkimRecord diff --git a/powershell/tests/functions/Test-MtDkim.Tests.ps1 b/powershell/tests/functions/Test-MtDkim.Tests.ps1 new file mode 100644 index 000000000..cd7484b23 --- /dev/null +++ b/powershell/tests/functions/Test-MtDkim.Tests.ps1 @@ -0,0 +1,50 @@ +BeforeAll { + Import-Module "$PSScriptRoot/../../Maester.psd1" -Force +} + +Describe 'DKIM checks with no signing configuration' -ForEach @( + @{ CommandName = 'Test-MtCisDkim' } + @{ CommandName = 'Test-MtCisaDkim' } +) { + BeforeEach { + Mock -ModuleName Maester Test-MtConnection { return $true } + Mock -ModuleName Maester Add-MtTestResultDetail { } + Mock -ModuleName Maester Get-MailAuthenticationRecord { + throw 'DNS lookup should not be attempted without a DKIM signing configuration' + } + } + + It ' passes the initial onmicrosoft.com domain' { + Mock -ModuleName Maester Get-MtExo { + if ($Request -eq 'AcceptedDomain') { + return [PSCustomObject]@{ + DomainName = 'contoso.onmicrosoft.com' + InitialDomain = $true + SendingFromDomainDisabled = $false + } + } + + return @() + } + + & $CommandName | Should -BeTrue + Should -Invoke Get-MailAuthenticationRecord -ModuleName Maester -Exactly 0 + } + + It ' fails a secondary onmicrosoft.com domain' { + Mock -ModuleName Maester Get-MtExo { + if ($Request -eq 'AcceptedDomain') { + return [PSCustomObject]@{ + DomainName = 'secondary.onmicrosoft.com' + InitialDomain = $false + SendingFromDomainDisabled = $false + } + } + + return @() + } + + & $CommandName | Should -BeFalse + Should -Invoke Get-MailAuthenticationRecord -ModuleName Maester -Exactly 0 + } +} From ad04a266fdece42fed1d1eddd3838299c062ad6d Mon Sep 17 00:00:00 2001 From: Merill Fernando Date: Sat, 1 Aug 2026 11:19:24 +1000 Subject: [PATCH 3/3] test: cover missing DKIM configuration outcomes --- .../tests/functions/Test-MtDkim.Tests.ps1 | 80 ++++++++++++++----- 1 file changed, 59 insertions(+), 21 deletions(-) diff --git a/powershell/tests/functions/Test-MtDkim.Tests.ps1 b/powershell/tests/functions/Test-MtDkim.Tests.ps1 index cd7484b23..5e8c8498d 100644 --- a/powershell/tests/functions/Test-MtDkim.Tests.ps1 +++ b/powershell/tests/functions/Test-MtDkim.Tests.ps1 @@ -14,37 +14,75 @@ Describe 'DKIM checks with no signing configuration' -ForEach @( } } - It ' passes the initial onmicrosoft.com domain' { - Mock -ModuleName Maester Get-MtExo { - if ($Request -eq 'AcceptedDomain') { - return [PSCustomObject]@{ - DomainName = 'contoso.onmicrosoft.com' - InitialDomain = $true - SendingFromDomainDisabled = $false - } - } - - return @() + It ' returns for ' -ForEach @( + @{ + DomainName = 'contoso.onmicrosoft.com' + InitialDomain = $true + IsCoexistenceDomain = $false + SendingFromDomainDisabled = $false + ExpectedOutcome = 'passed' + ExpectedResult = $true } - - & $CommandName | Should -BeTrue - Should -Invoke Get-MailAuthenticationRecord -ModuleName Maester -Exactly 0 - } - - It ' fails a secondary onmicrosoft.com domain' { + @{ + DomainName = 'secondary.onmicrosoft.com' + InitialDomain = $false + IsCoexistenceDomain = $false + SendingFromDomainDisabled = $false + ExpectedOutcome = 'failed' + ExpectedResult = $false + } + @{ + DomainName = 'parked.example' + InitialDomain = $false + IsCoexistenceDomain = $false + SendingFromDomainDisabled = $true + ExpectedOutcome = 'skipped' + ExpectedResult = $null + } + @{ + DomainName = 'contoso.mail.onmicrosoft.com' + InitialDomain = $false + IsCoexistenceDomain = $true + SendingFromDomainDisabled = $false + ExpectedOutcome = 'failed' + ExpectedResult = $false + } + @{ + DomainName = 'contoso.mail.onmicrosoft.com' + InitialDomain = $false + IsCoexistenceDomain = $true + SendingFromDomainDisabled = $true + ExpectedOutcome = 'skipped' + ExpectedResult = $null + } + @{ + DomainName = 'contoso.com' + InitialDomain = $false + IsCoexistenceDomain = $false + SendingFromDomainDisabled = $false + ExpectedOutcome = 'failed' + ExpectedResult = $false + } + ) { Mock -ModuleName Maester Get-MtExo { if ($Request -eq 'AcceptedDomain') { return [PSCustomObject]@{ - DomainName = 'secondary.onmicrosoft.com' - InitialDomain = $false - SendingFromDomainDisabled = $false + DomainName = $DomainName + InitialDomain = $InitialDomain + IsCoexistenceDomain = $IsCoexistenceDomain + SendingFromDomainDisabled = $SendingFromDomainDisabled } } return @() } - & $CommandName | Should -BeFalse + $result = & $CommandName + if ($null -eq $ExpectedResult) { + $result | Should -BeNullOrEmpty + } else { + $result | Should -Be $ExpectedResult + } Should -Invoke Get-MailAuthenticationRecord -ModuleName Maester -Exactly 0 } }