Harden Exchange Online Mail Flow with DKIM, DMARC, and Anti-Spam in PowerShell
Enable DKIM, enforce DMARC, tune anti-spam, audit transport rules and connectors, and shut down external auto-forwarding with one repeatable Exchange Online workflow.
Email is still the number one way attackers get into Microsoft 365 tenants. Spoofed senders, missing DKIM, weak anti-spam policies, and quietly configured external forwarding rules are some of the most common findings in any security review.
The fixes are well understood, but they live across several Exchange Online surfaces — authentication records, anti-spam policies, transport rules, and connectors. Doing them by hand, tenant after tenant, is slow and easy to get wrong.
A repeatable PowerShell workflow lets you apply the same hardened mail-flow baseline everywhere and prove it with message trace and audit reports. PSForge helps you assemble that workflow from ready-made Exchange Online tasks.
Why mail-flow security drifts
Most tenants start with default mail-flow settings and never revisit them. DKIM is often left disabled, DMARC is never published, and anti-spam policies stay on their out-of-the-box thresholds.
Meanwhile, transport rules and inbound connectors accumulate over time — added for a migration, a vendor integration, or a one-off exception — and nobody removes them. Attackers also love auto-forwarding rules because they exfiltrate mail silently.
What a hardened baseline looks like
A strong baseline enables DKIM signing for every accepted domain, publishes and enforces DMARC, and applies anti-spam and quarantine policies that match your risk tolerance.
It also audits every transport rule and mail-flow connector, blocks or allows only the domains you trust, and actively detects and disables forwarding to external domains. Finally, it verifies the result with message trace evidence.
Start in report mode Publish DMARC at p=none and review aggregate reports before moving to quarantine or reject. The same applies to new transport rules — run them in test mode first so you do not break legitimate mail.
How PSForge helps
Instead of remembering every Exchange Online cmdlet and parameter, you assemble the workflow from built-in tasks, generate clean PowerShell, and tailor it to each tenant.
Because the workflow is repeatable, you can apply the identical baseline across every client or business unit and re-run the audit pieces on a schedule.
- Consistent authentication (DKIM/DMARC) across all domains
- Tuned anti-spam and quarantine handling
- Clean, audited transport rules and connectors
- Early detection of malicious external forwarding
Example mail-flow hardening workflow
- Enable DKIM signing for each accepted domain
- Configure DKIM and DMARC settings and publish records
- Apply a tuned anti-spam policy
- Audit and clean up transport rules
- Review inbound mail-flow connectors
- Detect and disable forwarding to external domains
- Generate a message trace report to confirm delivery
Example ongoing review
- Re-run external forwarding detection weekly
- Review quarantined messages for false positives
- Confirm DMARC aggregate reports trend toward full enforcement
Final thoughts
Mail-flow hardening is one of the highest-impact things you can do in Microsoft 365, and it is exactly the kind of multi-step task that benefits from a repeatable workflow.
Build it once in PSForge, generate the PowerShell, and apply the same baseline to every tenant you manage.