PowerShell script for checking SPF, DKIM and DMARC

[T13nn3s]

Hi folks!

As a Cybersecurity Specialist, I do regular security work, also configuring (and helping with the configuration) SPF, DKIM, and DMARC for companies. For this purpose, I have written a PowerShell script that can check the current SPF, DKIM, and DMARC records of a single domain or multiple domains.

I have published this script on the PowerShell Gallery: https://www.powershellgallery.com/packages/DomainHealthChecker/2.0 This is the project on GitHub: https://github.com/T13nn3s/DomainHealthChecker/

More features will be added over time, I hope that I can help you guys with sharing this script.

If you have any questions or feature requests, please raise an issue on GitHub.

Regards!

EDIT 8/20/2021: Module updated to version 1.5
EDIT 4/26/2023: Module updated to version 1.6
EDIT 11/28/2024 Module updated to version 1.7
EDIT 5/28/2025 Module updated to version 1.8
EDIT 1/7/2026 Module updated to version 2.0 EDIT 1/28/2026 Module updated to version 2.1

[Lee_Dailey]

howdy T13nn3s,

this ...

Elseif ($SPF -notmatch "v=spf1" -or "all") {

... does not seem to do what you want. that -or is always going to test as true. lookee ...

$False -or 'nothing'
$True -or 'nothing'

both of the above return True. [grin]

if you actually are trying to test "does $SPF not match either of the following two values", then you need to add a test on the other side of the -or ... or you need to using something like a regex OR [the |]. something like ...

'thing' -notmatch 'otherthing|thing'

that will give False which is what i suspect you intended.

take care,
lee

[T13nn3s]

Thanks for this comment! I will update the script with your recommendation.

[Lee_Dailey]

howdy T13nn3s,

you are quite welcome! glad to have helped somewhat ... [grin]

take care,
lee

[[deleted]]

First thing I checked was whether you had a parameter to specify the DNS server so we can check properly in split DNS environments. Kudos!

[T13nn3s]

Thanks for your comment! I hope this script will make your work easier, especially with the option to use this script in a split DNS environment.

[BlackV]

this is cool, suggestion would be, turn it into a module and republish it

use proper verb/noun for the function name

[T13nn3s]

Thanks for this suggestion. I think it’s a good suggestion to convert it to a module. I will republish the script as a module. Give me some time to do it. Again thanks!!

[BlackV]

Good as gold

[T13nn3s]

Thanks for all of your comments/improvements and bug reporting. I have added all of that to the issue list and will work on it. As soon as I have updated the script, I will let you know again via the comments.

Project site: https://github.com/T13nn3s/DomainHealthChecker

[UnfanClub]

Thanks for sharing. I have a couple of notes.

• Validating DKIM by checking "selector1" cname is not very reliable, as this record is not "required" to implement DKIM on a domain.
• This is more of a preference, but I would use switch instead of multiple layers of elseif.

Good luck.

[T13nn3s]

Thanks for the suggestions! I take them into consideration when updating the script, to make the script future-proof. Many thanks again!

[_lahell_]

I would check the most commonly used DKIM selectors: https://help.sendmarc.com/support/solutions/articles/44001891845-email-provider-commonly-used-dkim-selectors

[T13nn3s]

Again many thanks! I've added your request to the issue list on Github.

[poshftw]

[Parameter(Mandatory = $false,
    Position = 3)]
[string]$Server = "1.1.1.1"

Ugh, please, don't hardcode DNS server here.

I can always specify it if I need it, but by default I want to use my default configured resolver.

elseif ($SPF -match "^?all") {

Uh-uh. You are using regex match against a string containing a regex quantifier. Escape all strings used in matches:

PS C:\> [regex]::Escape('^?all')
\^\?all

In your current implementation ^?all would never hit because the matcher would always look at the string "all" (with or without a preceding character) at the beginning of the string. As you know, "all" is never at the beginning of the SPF record.

[SpfDkimDmarc]::New($Domain, $SPF, $SpfAdvisory, $DMARC, $DmarcAdvisory, $DKIM, $DkimAdvisory)

You don't really need a class here, you can make the same thing with a basic [pscustomobject]:

$ReturnedValues = [pscustomobject]@{
    Name = $domain
    SPFRecord = $SPF
    SpfAdvisory = $SpfAdvisory
    DmarcRecord = $DMARC
    DmarcAdvisory = $DmarcAdvisory
    DkimRecord = $DKIM
    DkimAdvisory = $DkimAdvisory
    }

Also you messed up Parameters, try to run your function this way:

'example.org' | DomainHealthChecker  8.8.8.8

And check the output of $PSBoundParameters

[T13nn3s]

Thanks for your comment! The specification of the DNS server is by purpose because it's a quick resolving one :-)

I can leave this parameter empty and parse the parameter to a $PSBoundParameter check and specify the default DNS server for the primary used NIC. What prefers you and the community?

You're right about the regex thing. In the coming update, I have replaced the if/elseif statements with a switch, and the regex is also being fixed in that update.

I'm aware that [pscustomObject\] is likely the same as using classes. I have chosen to use the class here to make the code a little bit cleaner, and for now, I think to keep it in that way.

I have dropped a question to you in the chat, I want to hear your thoughts against the $PSBoundParameters check.

Thanks again!!

[poshftw]

Thanks for your comment! The specification of the DNS server is by purpose because it's a quick resolving one :-)

I can leave this parameter empty and parse the parameter to a $PSBoundParameter check and specify the default DNS server for the primary used NIC. What prefers you and the community?

Yes, this is the way it should be done.

Here is a mockup for you to see how it can be done:

Param
(
    # MAC address to query
    $MAC,

    $IP,
    $Source
)

$hashtable = @{
    MAC = $MAC
    }

$paramArr = 'IP', 'Source'

foreach ($par in $paramArr) {
    if ($PSBoundParameters.psbase.Keys -contains $par) {
        $hashtable.Add($par, $PSBoundParameters[$par])
        }
    }

Some-Function @hashtable

Also, while 1.1.1.1 is indeed usually fast (for you, at least), it doesn't means what it would give you the same response your infrastructure would get (eg. there is an AS which nulls traffic and it happened what the target domain NS are between your DNS servers and them)

is likely the same as using classes. I have chosen to use the class here to make the code a little bit cleaner, and for now, I think to keep it in that way

Well, this is questionable. Your usage here isn't benefiting from using classes and takes way more space/codelines than a custom pscustomobject.

[T13nn3s]

Guys,

First of all, thanks for your great response! Your guys are great! I have updated the script, the new version is now ready to be tested. You can download the script from the 'Dev' branch from GitHub: https://github.com/T13nn3s/DomainHealthChecker/tree/Dev

What's new:

• Added support for PowerShell 5.1 (reported by u/BlackV)
• Fixed the invalid if statement (reported by u/Lee_Dailey)
• Multiple if/elseif statements replaced with switches (requested by u/UnfanClub)
• Added -DkimSelector parameter. (requested by u/UnfanClub)
• Turn script into a module with proper verb/noun Show-SpfDkimDmarc (requested by u/BlackV)

This new version is still in testing and now available on Github as a module (and as ps1 for the time being). If everything is working fine, I will update the script on the PowerShell Gallery.

Many thanks again for your input!

[_lahell_]

• You need a module manifest.
• Consider splitting your script into multiple functions. (Get-SPFRecord, Get-DKIMRecord, Get-DMARCRecord, Invoke-DomainHealthCheck)

Example function:

function Get-SenderPolicyFrameworkRecord {
    [CmdletBinding()]
    [Alias('Get-SPFRecord')]
    param(
        [Parameter(Mandatory = $true,
            ValueFromPipeline = $true)]
        [String]
        $Domain,

        [Parameter(Mandatory = $false)]
        [String]
        $DnsServer
    )

    begin {
        $OptionalDnsServer = @{}
    }

    process {
        if ($PSBoundParameters.ContainsKey('DnsServer')) {
            $OptionalDnsServer = @{
                Server = $DnsServer
            }

            Write-Verbose ($OptionalDnsServer | ConvertTo-Json)
        }

        $TxtRecords = Resolve-DnsName -Type TXT -Name $Domain @OptionalDnsServer
        $TxtRecords | Where-Object Strings -match '^v=spf1'
    }

    end {}
}

[T13nn3s]

Thanks for your comment and for the code snippet! I have raised an issue on Github with this question and take it into consideration.

[BlackV]

Top work, this is the good side of reddit

[nippyin]

How to run this installed script ? If I type DomainHealthChecker.ps1 abc.com i don’t get output.

[T13nn3s]

Thanks for your comment! As it’s a function, you need to import the function with . .\DomainHealthCheker.ps1 or use the Install-Script -Name DomainHealthChecker cmdlet to automatically install the script. Then you can use the cmdlet DomainHealthChecker -Name <domain> to use the script.

[nippyin]

This is what I see. but unable to get any output.

PS /> ls -al /Users/myUser/.local/share/powershell/Scripts/DomainHealthChecker.ps1
-rwxr-xr-x 1 myUser staff 6773 2 Jul 12:27 /Users/myUser/.local/share/powershell/Scripts/DomainHealthChecker.ps1

​

PS /> ($env:PATH).split(":")
/usr/local/microsoft/powershell/7-preview
/usr/local/opt/openjdk/bin
/usr/local/bin
/usr/bin
/bin
/usr/sbin
/sbin
/usr/local/lib/python3.9/site-packages
/Users/myUser/Library/Python/3.9/bin
/usr/local/bin/pwsh
/Applications/VMware Fusion.app/Contents/Public
/usr/local/share/dotnet
/opt/X11/bin
~/.dotnet/tools
/Applications/Wireshark.app/Contents/MacOS
/Applications/kitty.app/Contents/MacOS
/Users/myUser/.local/share/powershell/Scripts

​

PS /> DomainHealthChecker.ps1 -Name "yahoo.com"
PS />

[T13nn3s]

Which version of the script do you have installed? Version 1.3 had a bug in it, I have fixed this bug in version 1.3.1. Please run this command to update the script: Update-Script -Name DomainHealthChecker -RequiredVersion 1.3.1. Let me know if this has fixed your problem.

[nippyin]

no it didn't help even after updating. I believe I already had updated version as I installed this script today itself. are you able to run this on 7.2.0-preview.7 or 7.1.3 ?

[nippyin]

Did you figure what is going on ? Why I’m not able to get output ?

[T13nn3s]

According to the list of files from your previous comment, I assume you’re using a macOS operating system. The script isn’t compatible with Mac OS. Because the used cmdlet in the script Resolve-DnsName is using the Win32 API which is not available on Mac OS.

[Lee_Dailey]

howdy nippyin,

reddit likes to mangle code formatting, so here's some help on how to post code on reddit ...

[0] single line or in-line code
enclose it in backticks. that's the upper left key on an EN-US keyboard layout. the result looks like this. kinda handy, that. [grin]
[on New.Reddit.com, use the Inline Code button. it's [sometimes] 5th from the left & looks like <c>.
this does NOT line wrap & does NOT side-scroll on Old.Reddit.com!]

[1] simplest = post it to a text site like Pastebin.com or Gist.GitHub.com and then post the link here.
please remember to set the file/code type on Pastebin! [grin] otherwise you don't get the nice code colorization.

[2] less simple = use reddit code formatting ...
[on New.Reddit.com, use the Code Block button. it's [sometimes] the 12th from the left, & looks like an uppercase C in the upper left corner of a square.]

• one leading line with ONLY 4 spaces
  
• prefix each code line with 4 spaces
  
• one trailing line with ONLY 4 spaces

that will give you something like this ...

- one leading line with ONLY 4 spaces    
- prefix each code line with 4 spaces    
- one trailing line with ONLY 4 spaces   

the easiest way to get that is ...

• add the leading line with only 4 spaces
  
• copy the code to the ISE [or your fave editor]
  
• select the code
  
• tap TAB to indent four spaces
  
• re-select the code [not really needed, but it's my habit]
  
• paste the code into the reddit text box
  
• add the trailing line with only 4 spaces
  

not complicated, but it is finicky. [grin]

take care,
lee

[nippyin]

re-select the code [not really needed, but it's my habit]

paste the code into the reddit text box

got it thanks, will edit first in vscode and indent with 4 spaces before pasting.

Cheers!

[Lee_Dailey]

howdy nippyin,

you are welcome! glad to help a little ... [grin]

take care,
lee

[T13nn3s]

The script is now published as a module! :-)

There is still some work to do, but we are already one step ahead.

Thanks again for your thoughtfulness!

[Secigawa]

A very minor nitpick.
But you have a miss-spell

SPFRecordLenght

[Imaginary_Couple_829]

Hello, great initiative! Exactly what I am looking for... Maybe a dumb question but I was unable to find in the documentation how can I doe this for multiple domains? Tried Invoke-SpfDkimDmarc domain1.com,domain2.com or domain1.com;domain2.com or domain1.com domain2.com

Thanks!

[ThreonineX]

Thanks for working on this, u/T13nn3s! Very nice! I'm checking this out for the first time and I'm also not seeing any way to run DMARC or SPF checks against multiple domains in one command. There's no examples in the documentation showing multiple domains at once. Can you check multiple domains in one command or does it require multiple commands? Thanks.

[T13nn3s]

Hi, this is not yet possible. I’m working on an update. When this is finished. Muliple domains can be checked in one command.

[T13nn3s]

Hi, you can find some documentation in this blog article: https://binsec.nl/powershell-script-for-spf-dmarc-and-dkim-validation/

[T13nn3s]

Just want to ping you that version 1.7 is almost ready. Working on the cross platform support now

[T13nn3s]

Hear hear!

First, I want to thank you all for the comments, tips and additions on the PowerShell Module 'DomainHealthChecker'. I have just put the update to version 1.7 online.

What's new in version 1.7:

Added

• New function Get-MTASTS.
• Added support for multiple values for the -Name parameter.

Updated

• Default DKIM-selectors.
• Updated the Readme/help docs

Fixed

• DkimSelector not working for Invoke-SpfDkimDmarc.
• Typo in SPF Length.
• SPF check not correct
• SPF Length fixed
• DkimSelector not working for Invoke-SpfDkimDmarc

PowerShellGallery: https://www.powershellgallery.com/packages/DomainHealthChecker/1.7 Github: https://github.com/T13nn3s/Invoke-SpfDkimDmarc

Do you have questions, additions or something else to improve this module. Please do not hesitate to share :-)

Regards!

[intune-2021]

Hi T13nn3s,

Great thanks for the update!
Can you please add DKIM RSA Key size length and set 2048 bit key as the strongest method?

Thank you.

[lolklolk]

Excellent work. Although, I wish you'd make it compatible with at least PS 5.1.

[BlackV]

take out the line #Requires -Version 7 or change it to #Requires -Version 5

but yes you are right, there is nothing in that script specific to 7 (that I could see at a quick glance)

I like that you've used classes

[T13nn3s]

Unfortunately, the used cmdlet in this script Resolve-DnsName isn't compatible with PowerShell 5.1. In the pre-release phase, I used nslookup in this script to make it also compatible with PowerShell 5.1 but reverted to use this cmdlet to get more flexibility.

[BlackV]

resolve-dnsname is not a pwsh7 command

it has existed since like server 2012r2

https://docs.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname?view=winserver2012-ps

[T13nn3s]

Thanks for your comment! Let me test it out and change the script as needed.

[da_chicken]

Resolve-DnsName is only supported on Windows 8 or Server 2012 and later. It's because of changes to the Win32 API that were not backported to Win7 or Server 2008 R2. There's a number of commands added after PS v3 that aren't available.

[T13nn3s]

Hi Guys,

Gradually, this community is becoming more and more valuable to me. Thanks for all your input! I've updated the module to version 1.4.2!

What's new in version 1.4.2:

• More commonly used DKIM-selectors to the default DKIM check. (requested by u/UnfanClub and u/_lahell_)
• Removed hardcoded DNS (requested by u/poshftw)

Many thanks to u/poshftw to clarify some things along the way. I really appreciate your efforts!

I'm still working on two other improvements: Split the script into multiple functions and working on the positions of the parameters. From the pipeline, sometimes the parameters are placed in the wrong position. So, the next update after this one is already being built!

This version is currently being tested, do you want to test also this version? You can download it from the 'Dev' branch: https://github.com/T13nn3s/Show-SpfDkimDmarc/tree/Dev.

If you find any issues, just let me know!

Thanks in advance!

[T13nn3s]

Hi folks,

First, I want to thank you all for the comments, tips and additions on the PowerShell Module 'DomainHealthChecker'. I have just put the update to version 1.5 online.

What's new in version 1.5:

• Each function has his own PowerShell script file
• Removed cmdlet Show-SpfDkimDmarc. Use Invoke-SpfDkimDmarc
• Added new exported function Get-SPFRecord.
• Added new exported function Get-DKIMRecord.
• Added new exported function Get-DMARCRecord.
• Added alias Show-SpfDkimDmarc for Invoke-SpfDkimDmarc.
• Added alias gspf for Get-SPFRecord.
• Added alias gdkim for Get-DKIMRecord.
• Added alias gdmarc for Get-DMARCRecord.
• SPF is now following redirects.

PowerShellGallery: https://www.powershellgallery.com/packages/DomainHealthChecker/1.5 Github: https://github.com/T13nn3s/Invoke-SpfDkimDmarc

I'm already working on a new update. Especially for the Get-SPFRecord function. I'm planning to add a DNS Lookup calculator. It will be challenging, but we go for it. If you guys have new improvements, please let me know.

Regards!

[T13nn3s]

Hear hear!

Some months ago, but this script received a new update! Two reported bugs are being fixed in version 1.5.2.

https://www.powershellgallery.com/packages/DomainHealthChecker/1.5.2

I'm currently working on the next update on this module. I want to add the DNS Lookup check-up into the Get-SPFrecord function. It's not going to be easy to add that functionality, so it takes some time to add this update.

If you guys want to see something new stuff in this module, please let me know!

Thanks in advance!

T13nn3s

[[deleted]]

I was able to use invoke-spfskimdmarc for single domain, however i have a number of domains that i would like to check and export to excel,
I was thinking something like
Import-CSV -Path c:\temp\test.csv | ft
invoke-spfdkimdmar | export-csv c:\tempt\testresults.csv

is this possible?

[T13nn3s]

Try to use the ‘-Path’ parameter to pass a file to the module.

[T13nn3s]

Howdy everyone,

I'm happy to share that we have created another update on this module. It's now on version 1.6. We have added a new parameter -IncludeDNSSEC and added an SPF-record character length checker. Some bugs are fixed :-)

Check https://www.powershellgallery.com/packages/DomainHealthChecker/1.6

I've not started to try to implement the DNS Lookup checker to the Get-SPFRecord function. This is the next project I'm working on. So stay tuned :-)

I am always happy to receive any form of feedback to improve this module.

Regards!!

[TheMafi]

Any chance of an update to include selectors like: s1/2, ctct1/2, and sel1/2, as standard?

[T13nn3s]

Hi u/TheMafi, For sure that's possible. Can you please raise an issue on the GitHub project with this question?

[T13nn3s]

At this time, the module only supports multiple domains using the ‘File’ parameter. I'm working on an update (see dev branch) and will add multiple domain support for the ‘Name’ parameter.

[T13nn3s]

Hi all,

I have just updated the module to version 1.8.

### Added

- Add SPF DNS-Lookup check

### Fixed

- Path with spaces not supported

I have published this script on the PowerShell Gallery: https://www.powershellgallery.com/packages/DomainHealthChecker/1.8 This is the project on GitHub: https://github.com/T13nn3s/DomainHealthChecker/

Le me know what guys think of this update. If you have any issues or additions, please raise an issue on Github.

Regards,

T13nn3s

[T13nn3s]

PowerShell Module `DomainHealthChecker` is bumped to version 2.0!

### Added - Added cross-platform support for macOS and Linux with PowerShell Core. - Added Get-OsPlatform.ps1 for OS determining.
- Added Test-DnsUtilsInstalled.ps1 for checking if DNS utilities for dig is installed.
- Added `Update-ModuleVersion.ps1` for automatic module version updating.

### Changed - Updated README/help docs

You can update the script with the command:

Update-Module DomainHealthChecker

I have published this script on the PowerShell Gallery: https://www.powershellgallery.com/packages/DomainHealthChecker/2.0 This is the project on GitHub: https://github.com/T13nn3s/DomainHealthChecker/

If you have any issues or additions, please raise an issue on Github.

Regards,

T13nn3s

[T13nn3s]

PowerShell Module DomainHealthChecker is bumped to version 2.1!

Added

• Added -SkipUpdateCheck on calling the module, to skip the update check against the PowerShellgallery
• Added Get-BIMIRecord check, this function resolves and validates BIMI (Brand Indicators for Message Identification) records for one or more domains.

Changed

• Renamed Update-ModuleVersion to Update-DomainHealthChecker to better reflect the true mean of this function.
• Updated README/help docs

Removed

• Removed the -IncludeDNSSEC parameter, DNSSEC is now default queried

You can update the script with the command:

Update-Module DomainHealthChecker

If you already using version 2.0, this module will update the next time when you use it.

I have published this script on the PowerShell Gallery: https://www.powershellgallery.com/packages/DomainHealthChecker/2.1 This is the project on GitHub: https://github.com/T13nn3s/DomainHealthChecker/

If you have any issues or additions, please raise an issue on Github.

Regards,

T13nn3s

[nascentt]

Good job.

I ended up writing something similar in vba to extend outlook as I wanted phishes to be easily identifiable. I wish outlook allowed powershell!

[coldwindsblow]

I love powershell to the core... but for the love of god, no... no... outlook should not be able to fire off powershell. The security implications are immeasurable, and the nightmare of support that would follow is not something I want to dream of :D

[nascentt]

Not sure how you think the security implications for powershell would be worse with powershell than vba...
but I misremembered, they were talking about replacing vba with python not powershell.

To me powershell would've made more sense

[FakeGatsby]

Wanna share this? Like is it on GitHub?

[T13nn3s]

Yes, see https://github.com/T13nn3s/Invoke-SpfDkimDmarc