Created by Claude - please verify

Inbound transport security - DNS and HTTPS are resolved from the web server (split-horizon DNS can show internal answers).

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ View-Only Configuration) Outbound DNS and HTTPS from the web server — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: Get-AcceptedDomain · Resolve-DnsName _mta-sts / _smtp._tls TXT, MX · https://mta-sts.{domain}/.well-known/mta-sts.txt · Get-SmtpDaneInboundStatus

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

MTA-STS, TLS-RPT & SMTP DANE per Domain

SPF, DKIM and DMARC protect who sends; MTA-STS and DANE protect the connection. Without them, senders fall back to opportunistic TLS and an attacker on the network path can downgrade or intercept mail to you. TLS-RPT tells you when that happens. MailDomainAuthentication covers SPF/DKIM/DMARC.