M365 DNS Checkup

M365 DNS Checkup is a practical internal tool for validating customer DNS setup for Microsoft 365 and Intune.

The tool was built to help colleagues who do not work with DNS and Microsoft 365 every day. It makes it easier to:

• check customer domains quickly,
• understand what each DNS record does,
• identify missing or risky records,
• build a correct DMARC policy with guidance,
• share findings clearly with customers, partners, and support teams.

What it does

• Single-domain analysis with grouped checks for:
  • mail security (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, Autodiscover),
  • Intune/Azure AD enrollment records,
  • domain security (for example DNSSEC, CAA, NS redundancy).
• Batch mode for multiple domains with PDF export.
• DMARC wizard that helps generate a complete DMARC TXT record.
• Share and clipboard workflows to pass results into email, chat, or ticket systems.

Why this project exists

The main purpose is operational clarity and consistency.

Instead of manually checking records in many places and interpreting them from memory, this tool gives a structured view with explanations and recommended actions. That lowers onboarding effort, reduces mistakes, and speeds up customer-facing DNS reviews.

Tech overview

• Backend: Python service for DNS checks and report generation.
• Frontend: static web UI for single, batch, and DMARC workflows.
• Deployment/runtime: Docker Compose.

HTTPS deployment options

The default docker-compose.yml in this repo is intended for reverse-proxy setups (for example Traefik in front of the frontend container).

If you want to run this stack directly with HTTPS, use:

• .env.example as template for environment values,
• docker-compose.yml.example as deployment template.

This example supports two modes:

1. Let's Encrypt / ACME (automatic certificate management)
2. Custom certificate and key files

Quick start (direct HTTPS)

1. Copy env template:

# Linux/macOS
cp .env.example .env

# Windows PowerShell
Copy-Item .env.example .env

2. Set required values in .env:

• PUBLIC_DOMAIN
• ACME_EMAIL (for ACME mode)
• TLS_CERT_FILE and TLS_KEY_FILE (for custom cert mode)
• SUPPORT_BRAND and SUPPORT_EMAIL (footer branding in frontend)

3. Start one mode:

# ACME / Let's Encrypt
docker compose -f docker-compose.yml.example --profile acme up -d

# OR custom certificate
docker compose -f docker-compose.yml.example --profile custom-cert up -d

deploy/caddy/Caddyfile.acme and deploy/caddy/Caddyfile.custom define the HTTPS reverse-proxy routing used by these profiles.

Typical workflow

1. Run a domain check.
2. Expand one item at a time to review details and recommendations.
3. Use DMARC wizard to generate the target DMARC record.
4. Share or copy results to customer communication channels.

Team process

For consistent issue tracking in OneDev, see WORKFLOW.md.