SPF Records Geconfigureerd

<# .SYNOPSIS SPF Records Configuration .DESCRIPTION Ensures SPF (Sender Policy Framework) records are configured for all domains. SPF prevents email spoofing by defining authorized mail servers. .NOTES Filename: spf-records.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\spf-records.ps1 -Monitoring Check SPF records for all domains #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement, DnsClient [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SPF Records Configuration" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS SPF Records Configuration .DESCRIPTION Ensures SPF (Sender Policy Framework) records are configured for all domains. SPF prevents email spoofing by defining authorized mail servers. .NOTES Filename: spf-records.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\spf-records.ps1 -Monitoring Check SPF records for all domains #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement, DnsClient [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SPF Records Configuration" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Getting accepted domains..." -ForegroundColor Gray $domains = Get-AcceptedDomain | Where-Object { $_.DomainType -ne 'InternalRelay' } $result = @{ isCompliant = $true totalDomains = $domains.Count withSPF = 0 withoutSPF = 0 weakSPF = 0 } Write-Host "Checking SPF records for $($domains.Count) domains...`n" -ForegroundColor Cyan foreach ($domain in $domains) { try { $spfRecord = Resolve-DnsName -Name $domain.DomainName -Type TXT -ErrorAction SilentlyContinue $spfText = $spfRecord | Where-Object { $_.Strings -like "v=spf1*" } | Select-Object -First 1 if ($spfText) { $result.withSPF++ # Check SPF strength $spfString = $spfText.Strings if ($spfString -like "*-all") { Write-Host " [OK] $($domain.DomainName): SPF CONFIGURED (Strict -all)" -ForegroundColor Green Write-Host " $spfString" -ForegroundColor Gray } elseif ($spfString -like "*~all") { Write-Host " ⚠️ $($domain.DomainName): SPF CONFIGURED (Soft fail ~all)" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray Write-Host " Recommendation: Change ~all to -all for stronger protection" -ForegroundColor Yellow $result.weakSPF++ } elseif ($spfString -like "*?all" -or $spfString -like "*+all") { Write-Host " [FAIL] $($domain.DomainName): SPF TOO PERMISSIVE" -ForegroundColor Red Write-Host " $spfString" -ForegroundColor Gray $result.isCompliant = $false $result.weakSPF++ } else { Write-Host " ⚠️ $($domain.DomainName): SPF exists but no 'all' mechanism" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray $result.weakSPF++ } } else { $result.withoutSPF++ $result.isCompliant = $false Write-Host " [FAIL] $($domain.DomainName): NO SPF RECORD" -ForegroundColor Red } } catch { Write-Host " ⚠️ $($domain.DomainName): Could not check DNS" -ForegroundColor Yellow } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total domains: $($result.totalDomains)" -ForegroundColor White Write-Host " With SPF: $($result.withSPF)" -ForegroundColor Green Write-Host " Without SPF: $($result.withoutSPF)" -ForegroundColor $( if ($result.withoutSPF -gt 0) { "Red" } else { "Green" } ) Write-Host " Weak SPF: $($result.weakSPF)" -ForegroundColor $( if ($result.weakSPF -gt 0) { "Yellow" } else { "Green" } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ SPF records must be configured in DNS" -ForegroundColor Yellow Write-Host "`nSteps to configure SPF:" -ForegroundColor Cyan Write-Host " 1. For each domain, create/update TXT record:" -ForegroundColor Gray Write-Host " Name: yourdomain.com (root)" -ForegroundColor Gray Write-Host " Type: TXT" -ForegroundColor Gray Write-Host " Value: v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 2. SPF Mechanisms:" -ForegroundColor Cyan Write-Host " • v=spf1 - SPF version 1" -ForegroundColor Gray Write-Host " • include:spf.protection.outlook.com - Microsoft 365" -ForegroundColor Gray Write-Host " • ip4:x.x.x.x - Specific IP (if needed)" -ForegroundColor Gray Write-Host " • -all - Fail others (STRICT)" -ForegroundColor Green Write-Host " • ~all - Soft fail (PERMISSIVE)" -ForegroundColor Yellow Write-Host "`n 3. Example SPF record:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 4. If you have other mail servers:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com include:mailgun.org -all" -ForegroundColor Gray Write-Host "`n 5. Verify with:" -ForegroundColor Cyan Write-Host " Resolve-DnsName -Name yourdomain.com -Type TXT" -ForegroundColor Gray Write-Host "`n⚠️ IMPORTANT: Only ONE SPF record per domain!" -ForegroundColor Yellow Write-Host "Multiple SPF records will break email!" -ForegroundColor Red exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check SPF records" -ForegroundColor Gray Write-Host " -Remediation Show configuration steps" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Getting accepted domains..." -ForegroundColor Gray $domains = Get-AcceptedDomain | Where-Object { $_.DomainType -ne 'InternalRelay' } $result = @{ isCompliant = $true totalDomains = $domains.Count withSPF = 0 withoutSPF = 0 weakSPF = 0 } Write-Host "Checking SPF records for $($domains.Count) domains...`n" -ForegroundColor Cyan foreach ($domain in $domains) { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS SPF Records Configuration .DESCRIPTION Ensures SPF (Sender Policy Framework) records are configured for all domains. SPF prevents email spoofing by defining authorized mail servers. .NOTES Filename: spf-records.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\spf-records.ps1 -Monitoring Check SPF records for all domains #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement, DnsClient [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SPF Records Configuration" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Getting accepted domains..." -ForegroundColor Gray $domains = Get-AcceptedDomain | Where-Object { $_.DomainType -ne 'InternalRelay' } $result = @{ isCompliant = $true totalDomains = $domains.Count withSPF = 0 withoutSPF = 0 weakSPF = 0 } Write-Host "Checking SPF records for $($domains.Count) domains...`n" -ForegroundColor Cyan foreach ($domain in $domains) { try { $spfRecord = Resolve-DnsName -Name $domain.DomainName -Type TXT -ErrorAction SilentlyContinue $spfText = $spfRecord | Where-Object { $_.Strings -like "v=spf1*" } | Select-Object -First 1 if ($spfText) { $result.withSPF++ # Check SPF strength $spfString = $spfText.Strings if ($spfString -like "*-all") { Write-Host " [OK] $($domain.DomainName): SPF CONFIGURED (Strict -all)" -ForegroundColor Green Write-Host " $spfString" -ForegroundColor Gray } elseif ($spfString -like "*~all") { Write-Host " ⚠️ $($domain.DomainName): SPF CONFIGURED (Soft fail ~all)" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray Write-Host " Recommendation: Change ~all to -all for stronger protection" -ForegroundColor Yellow $result.weakSPF++ } elseif ($spfString -like "*?all" -or $spfString -like "*+all") { Write-Host " [FAIL] $($domain.DomainName): SPF TOO PERMISSIVE" -ForegroundColor Red Write-Host " $spfString" -ForegroundColor Gray $result.isCompliant = $false $result.weakSPF++ } else { Write-Host " ⚠️ $($domain.DomainName): SPF exists but no 'all' mechanism" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray $result.weakSPF++ } } else { $result.withoutSPF++ $result.isCompliant = $false Write-Host " [FAIL] $($domain.DomainName): NO SPF RECORD" -ForegroundColor Red } } catch { Write-Host " ⚠️ $($domain.DomainName): Could not check DNS" -ForegroundColor Yellow } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total domains: $($result.totalDomains)" -ForegroundColor White Write-Host " With SPF: $($result.withSPF)" -ForegroundColor Green Write-Host " Without SPF: $($result.withoutSPF)" -ForegroundColor $( if ($result.withoutSPF -gt 0) { "Red" } else { "Green" } ) Write-Host " Weak SPF: $($result.weakSPF)" -ForegroundColor $( if ($result.weakSPF -gt 0) { "Yellow" } else { "Green" } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ SPF records must be configured in DNS" -ForegroundColor Yellow Write-Host "`nSteps to configure SPF:" -ForegroundColor Cyan Write-Host " 1. For each domain, create/update TXT record:" -ForegroundColor Gray Write-Host " Name: yourdomain.com (root)" -ForegroundColor Gray Write-Host " Type: TXT" -ForegroundColor Gray Write-Host " Value: v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 2. SPF Mechanisms:" -ForegroundColor Cyan Write-Host " • v=spf1 - SPF version 1" -ForegroundColor Gray Write-Host " • include:spf.protection.outlook.com - Microsoft 365" -ForegroundColor Gray Write-Host " • ip4:x.x.x.x - Specific IP (if needed)" -ForegroundColor Gray Write-Host " • -all - Fail others (STRICT)" -ForegroundColor Green Write-Host " • ~all - Soft fail (PERMISSIVE)" -ForegroundColor Yellow Write-Host "`n 3. Example SPF record:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 4. If you have other mail servers:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com include:mailgun.org -all" -ForegroundColor Gray Write-Host "`n 5. Verify with:" -ForegroundColor Cyan Write-Host " Resolve-DnsName -Name yourdomain.com -Type TXT" -ForegroundColor Gray Write-Host "`n⚠️ IMPORTANT: Only ONE SPF record per domain!" -ForegroundColor Yellow Write-Host "Multiple SPF records will break email!" -ForegroundColor Red exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check SPF records" -ForegroundColor Gray Write-Host " -Remediation Show configuration steps" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { $spfRecord = Resolve-DnsName -Name $domain.DomainName -Type TXT -ErrorAction SilentlyContinue $spfText = $spfRecord | Where-Object { $_.Strings -like "v=spf1*" } | Select-Object -First 1 if ($spfText) { $result.withSPF++ # Check SPF strength $spfString = $spfText.Strings if ($spfString -like "*-all") { Write-Host " [OK] $($domain.DomainName): SPF CONFIGURED (Strict -all)" -ForegroundColor Green Write-Host " $spfString" -ForegroundColor Gray } elseif ($spfString -like "*~all") { Write-Host " ⚠️ $($domain.DomainName): SPF CONFIGURED (Soft fail ~all)" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray Write-Host " Recommendation: Change ~all to -all for stronger protection" -ForegroundColor Yellow $result.weakSPF++ } elseif ($spfString -like "*?all" -or $spfString -like "*+all") { Write-Host " [FAIL] $($domain.DomainName): SPF TOO PERMISSIVE" -ForegroundColor Red Write-Host " $spfString" -ForegroundColor Gray $result.isCompliant = $false $result.weakSPF++ } else { Write-Host " ⚠️ $($domain.DomainName): SPF exists but no 'all' mechanism" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray $result.weakSPF++ } } else { $result.withoutSPF++ $result.isCompliant = $false Write-Host " [FAIL] $($domain.DomainName): NO SPF RECORD" -ForegroundColor Red } } catch { Write-Host " ⚠️ $($domain.DomainName): Could not check DNS" -ForegroundColor Yellow } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total domains: $($result.totalDomains)" -ForegroundColor White Write-Host " With SPF: $($result.withSPF)" -ForegroundColor Green Write-Host " Without SPF: $($result.withoutSPF)" -ForegroundColor $( if ($result.withoutSPF -gt 0) { "Red" } else { "Green" } ) Write-Host " Weak SPF: $($result.weakSPF)" -ForegroundColor $( if ($result.weakSPF -gt 0) { "Yellow" } else { "Green" } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS SPF Records Configuration .DESCRIPTION Ensures SPF (Sender Policy Framework) records are configured for all domains. SPF prevents email spoofing by defining authorized mail servers. .NOTES Filename: spf-records.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\spf-records.ps1 -Monitoring Check SPF records for all domains #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement, DnsClient [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SPF Records Configuration" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Getting accepted domains..." -ForegroundColor Gray $domains = Get-AcceptedDomain | Where-Object { $_.DomainType -ne 'InternalRelay' } $result = @{ isCompliant = $true totalDomains = $domains.Count withSPF = 0 withoutSPF = 0 weakSPF = 0 } Write-Host "Checking SPF records for $($domains.Count) domains...`n" -ForegroundColor Cyan foreach ($domain in $domains) { try { $spfRecord = Resolve-DnsName -Name $domain.DomainName -Type TXT -ErrorAction SilentlyContinue $spfText = $spfRecord | Where-Object { $_.Strings -like "v=spf1*" } | Select-Object -First 1 if ($spfText) { $result.withSPF++ # Check SPF strength $spfString = $spfText.Strings if ($spfString -like "*-all") { Write-Host " [OK] $($domain.DomainName): SPF CONFIGURED (Strict -all)" -ForegroundColor Green Write-Host " $spfString" -ForegroundColor Gray } elseif ($spfString -like "*~all") { Write-Host " ⚠️ $($domain.DomainName): SPF CONFIGURED (Soft fail ~all)" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray Write-Host " Recommendation: Change ~all to -all for stronger protection" -ForegroundColor Yellow $result.weakSPF++ } elseif ($spfString -like "*?all" -or $spfString -like "*+all") { Write-Host " [FAIL] $($domain.DomainName): SPF TOO PERMISSIVE" -ForegroundColor Red Write-Host " $spfString" -ForegroundColor Gray $result.isCompliant = $false $result.weakSPF++ } else { Write-Host " ⚠️ $($domain.DomainName): SPF exists but no 'all' mechanism" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray $result.weakSPF++ } } else { $result.withoutSPF++ $result.isCompliant = $false Write-Host " [FAIL] $($domain.DomainName): NO SPF RECORD" -ForegroundColor Red } } catch { Write-Host " ⚠️ $($domain.DomainName): Could not check DNS" -ForegroundColor Yellow } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total domains: $($result.totalDomains)" -ForegroundColor White Write-Host " With SPF: $($result.withSPF)" -ForegroundColor Green Write-Host " Without SPF: $($result.withoutSPF)" -ForegroundColor $( if ($result.withoutSPF -gt 0) { "Red" } else { "Green" } ) Write-Host " Weak SPF: $($result.weakSPF)" -ForegroundColor $( if ($result.weakSPF -gt 0) { "Yellow" } else { "Green" } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ SPF records must be configured in DNS" -ForegroundColor Yellow Write-Host "`nSteps to configure SPF:" -ForegroundColor Cyan Write-Host " 1. For each domain, create/update TXT record:" -ForegroundColor Gray Write-Host " Name: yourdomain.com (root)" -ForegroundColor Gray Write-Host " Type: TXT" -ForegroundColor Gray Write-Host " Value: v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 2. SPF Mechanisms:" -ForegroundColor Cyan Write-Host " • v=spf1 - SPF version 1" -ForegroundColor Gray Write-Host " • include:spf.protection.outlook.com - Microsoft 365" -ForegroundColor Gray Write-Host " • ip4:x.x.x.x - Specific IP (if needed)" -ForegroundColor Gray Write-Host " • -all - Fail others (STRICT)" -ForegroundColor Green Write-Host " • ~all - Soft fail (PERMISSIVE)" -ForegroundColor Yellow Write-Host "`n 3. Example SPF record:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 4. If you have other mail servers:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com include:mailgun.org -all" -ForegroundColor Gray Write-Host "`n 5. Verify with:" -ForegroundColor Cyan Write-Host " Resolve-DnsName -Name yourdomain.com -Type TXT" -ForegroundColor Gray Write-Host "`n⚠️ IMPORTANT: Only ONE SPF record per domain!" -ForegroundColor Yellow Write-Host "Multiple SPF records will break email!" -ForegroundColor Red exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check SPF records" -ForegroundColor Gray Write-Host " -Remediation Show configuration steps" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ SPF records must be configured in DNS" -ForegroundColor Yellow Write-Host "`nSteps to configure SPF:" -ForegroundColor Cyan Write-Host " 1. For each domain, create/update TXT record:" -ForegroundColor Gray Write-Host " Name: yourdomain.com (root)" -ForegroundColor Gray Write-Host " Type: TXT" -ForegroundColor Gray Write-Host " Value: v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 2. SPF Mechanisms:" -ForegroundColor Cyan Write-Host " • v=spf1 - SPF version 1" -ForegroundColor Gray Write-Host " • include:spf.protection.outlook.com - Microsoft 365" -ForegroundColor Gray Write-Host " • ip4:x.x.x.x - Specific IP (if needed)" -ForegroundColor Gray Write-Host " • -all - Fail others (STRICT)" -ForegroundColor Green Write-Host " • ~all - Soft fail (PERMISSIVE)" -ForegroundColor Yellow Write-Host "`n 3. Example SPF record:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 4. If you have other mail servers:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com include:mailgun.org -all" -ForegroundColor Gray Write-Host "`n 5. Verify with:" -ForegroundColor Cyan Write-Host " Resolve-DnsName -Name yourdomain.com -Type TXT" -ForegroundColor Gray Write-Host "`n⚠️ IMPORTANT: Only ONE SPF record per domain!" -ForegroundColor Yellow Write-Host "Multiple SPF records will break email!" -ForegroundColor Red exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS SPF Records Configuration .DESCRIPTION Ensures SPF (Sender Policy Framework) records are configured for all domains. SPF prevents email spoofing by defining authorized mail servers. .NOTES Filename: spf-records.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\spf-records.ps1 -Monitoring Check SPF records for all domains #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement, DnsClient [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SPF Records Configuration" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Getting accepted domains..." -ForegroundColor Gray $domains = Get-AcceptedDomain | Where-Object { $_.DomainType -ne 'InternalRelay' } $result = @{ isCompliant = $true totalDomains = $domains.Count withSPF = 0 withoutSPF = 0 weakSPF = 0 } Write-Host "Checking SPF records for $($domains.Count) domains...`n" -ForegroundColor Cyan foreach ($domain in $domains) { try { $spfRecord = Resolve-DnsName -Name $domain.DomainName -Type TXT -ErrorAction SilentlyContinue $spfText = $spfRecord | Where-Object { $_.Strings -like "v=spf1*" } | Select-Object -First 1 if ($spfText) { $result.withSPF++ # Check SPF strength $spfString = $spfText.Strings if ($spfString -like "*-all") { Write-Host " [OK] $($domain.DomainName): SPF CONFIGURED (Strict -all)" -ForegroundColor Green Write-Host " $spfString" -ForegroundColor Gray } elseif ($spfString -like "*~all") { Write-Host " ⚠️ $($domain.DomainName): SPF CONFIGURED (Soft fail ~all)" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray Write-Host " Recommendation: Change ~all to -all for stronger protection" -ForegroundColor Yellow $result.weakSPF++ } elseif ($spfString -like "*?all" -or $spfString -like "*+all") { Write-Host " [FAIL] $($domain.DomainName): SPF TOO PERMISSIVE" -ForegroundColor Red Write-Host " $spfString" -ForegroundColor Gray $result.isCompliant = $false $result.weakSPF++ } else { Write-Host " ⚠️ $($domain.DomainName): SPF exists but no 'all' mechanism" -ForegroundColor Yellow Write-Host " $spfString" -ForegroundColor Gray $result.weakSPF++ } } else { $result.withoutSPF++ $result.isCompliant = $false Write-Host " [FAIL] $($domain.DomainName): NO SPF RECORD" -ForegroundColor Red } } catch { Write-Host " ⚠️ $($domain.DomainName): Could not check DNS" -ForegroundColor Yellow } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total domains: $($result.totalDomains)" -ForegroundColor White Write-Host " With SPF: $($result.withSPF)" -ForegroundColor Green Write-Host " Without SPF: $($result.withoutSPF)" -ForegroundColor $( if ($result.withoutSPF -gt 0) { "Red" } else { "Green" } ) Write-Host " Weak SPF: $($result.weakSPF)" -ForegroundColor $( if ($result.weakSPF -gt 0) { "Yellow" } else { "Green" } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ SPF records must be configured in DNS" -ForegroundColor Yellow Write-Host "`nSteps to configure SPF:" -ForegroundColor Cyan Write-Host " 1. For each domain, create/update TXT record:" -ForegroundColor Gray Write-Host " Name: yourdomain.com (root)" -ForegroundColor Gray Write-Host " Type: TXT" -ForegroundColor Gray Write-Host " Value: v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 2. SPF Mechanisms:" -ForegroundColor Cyan Write-Host " • v=spf1 - SPF version 1" -ForegroundColor Gray Write-Host " • include:spf.protection.outlook.com - Microsoft 365" -ForegroundColor Gray Write-Host " • ip4:x.x.x.x - Specific IP (if needed)" -ForegroundColor Gray Write-Host " • -all - Fail others (STRICT)" -ForegroundColor Green Write-Host " • ~all - Soft fail (PERMISSIVE)" -ForegroundColor Yellow Write-Host "`n 3. Example SPF record:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com -all" -ForegroundColor Gray Write-Host "`n 4. If you have other mail servers:" -ForegroundColor Cyan Write-Host " v=spf1 include:spf.protection.outlook.com include:mailgun.org -all" -ForegroundColor Gray Write-Host "`n 5. Verify with:" -ForegroundColor Cyan Write-Host " Resolve-DnsName -Name yourdomain.com -Type TXT" -ForegroundColor Gray Write-Host "`n⚠️ IMPORTANT: Only ONE SPF record per domain!" -ForegroundColor Yellow Write-Host "Multiple SPF records will break email!" -ForegroundColor Red exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check SPF records" -ForegroundColor Gray Write-Host " -Remediation Show configuration steps" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check SPF records" -ForegroundColor Gray Write-Host " -Remediation Show configuration steps" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }