Reporting on DKIM status across multiple tenants

Question

I work at an MSP and we'd like to find a way to stay on top of our client DKIM status. We can do this one-by-one by logging in and going to the Defender admin center, of course, but that's a manual process. Is there anyway to get reporting for this? We'd like to get: list of domains in a tenant, and what the DKIM status is.

We already have GDAP set up so I can see the clients in Lighthouse from my user work account and don't have to log in with their account to do basic management.

I've looked over the Lighthouse API documentation and found that it's really great but it doesn't have access to DKIM. We could look at MS Graph because I thought it might be slightly better than using a web browser to query info but it doesn't have access to Exchange Online settings. It looks like we won't have these as a route to get info across our clients.

Answer 1

Why not just check using a 3rd party website (https://mxtoolbox.com/dkim.aspx) or looking up the DKIM record in DNS:

For Office 365/Exchange Online tenants, they all use the same conventions.

If you know the domains they send as, it will always be:

selector1._domainkey.domain.com

selector2._domainkey.domain.com

That CNAME should resolve to the 365 DKIM record.

You can query those and of one of those resolves, then its setup and working

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide