+
+"@
+}
+
+# Add consolidated footer sections after all domains
+$html += "
+
+
+
+
+ $($result.Domain)
+
+ Score: $($result.Score)/100
+ $($result.Status)
+
+
+
+
+
+ $(if ($result.Recommendations.Count -gt 0) {
+ # Determine section title based on provider
+ $sectionTitle = if ($result.MXProviders -contains "Microsoft/Office 365") {
+ "Action Items & Microsoft Recommendations"
+ } else {
+ "Action Items & Recommendations From Industry Standard Resources"
+ }
+@"
+ Protocol Health Overview
+ + +
+
+
+
+
+
+
+
+
+
+
+
+ SPF Protection
+ Sender Policy Framework
+
+$(Add-SegmentedDonutChart (Get-ProtocolCheckDetails $result "SPF") "SPF")
+
+
+ $(if($result.SPFFound){"$($result.SPFCheckPercentage)% Compliant"}else{"Not Configured"})
+
+
+$((Get-ProtocolCheckDetails $result "SPF") | ForEach-Object {
+ $statusIcon = if($_.Passed) { "" } else { "" }
+ $statusClass = if($_.Passed) { "legend-passed" } else { "legend-failed" }
+ ""
+} | Out-String)
+
+ $($_.Name)
+ View Details ↓
+
+
+
+
+
+
+
+
+
+
+ DMARC Policy
+ Domain-based Message Authentication
+
+$(Add-SegmentedDonutChart (Get-ProtocolCheckDetails $result "DMARC") "DMARC")
+
+
+ $(if($result.DMARCFound){"$($result.DMARCCheckPercentage)% Compliant"}else{"Not Configured"})
+
+
+$((Get-ProtocolCheckDetails $result "DMARC") | ForEach-Object {
+ $statusIcon = if($_.Passed) { "" } else { "" }
+ $statusClass = if($_.Passed) { "legend-passed" } else { "legend-failed" }
+ ""
+} | Out-String)
+
+ $($_.Name)
+ View Details ↓
+
+
+
+
+
+
+
+
+
+ DKIM Signatures
+ DomainKeys Identified Mail
+
+$(Add-SegmentedDonutChart (Get-ProtocolCheckDetails $result "DKIM") "DKIM")
+
+
+ $(if($result.DKIMFound){"$($result.DKIMCheckPercentage)% Compliant"}else{"Not Configured"})
+
+
+$((Get-ProtocolCheckDetails $result "DKIM") | ForEach-Object {
+ $statusIcon = if($_.Passed) { "" } else { "" }
+ $statusClass = if($_.Passed) { "legend-passed" } else { "legend-failed" }
+ ""
+} | Out-String)
+
+ $($_.Name)
+ View Details ↓
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + 📧MX Record Analysis +
+ +$(if($result.MXFound) { +@" +
+
+
+
+"@
+} else {
+@"
+
+
+ $($result.MXRecords.Count)
+ MX Records
+
+
+$(if($result.MXProviders.Count -gt 0) {
+" $($result.MXAverageTTL)s
+ TTL
+
+
"
+})
+ $($result.MXProviders -join ', ')
+ Email Provider
+
+
+"@
+})
+ ❌
+ No MX Records Found
+This domain does not have MX records configured, which means it cannot receive email.
+
+
+ Security Level Comparison
+ +
+
+"@
+ })
+
+
+ $(
+ $domainURLs = Get-ProviderSpecificURLs -Providers $result.MXProviders
+ # Determine documentation section title based on provider
+ $docTitle = if ($result.MXProviders -contains "Microsoft/Office 365") {
+ "Microsoft Official Documentation"
+ } else {
+ "Industry Standard Documentation"
+ }
+@"
+ 🔧 $sectionTitle for $($result.Domain)
+-
+$(
+ foreach ($recommendation in $result.Recommendations) {
+ # Format recommendations with proper HTML links (both HTTP and HTTPS)
+ $formattedRec = $recommendation -replace "(https?://[^\s]+)", '$1'
+ "
- $formattedRec " + } +) +
+
+"@
+ )
+
+$(if($menuChoice -eq '4' -and ($result.EmailHeaderSPFResult -ne "" -or $result.EmailHeaderDKIMResult -ne "" -or $result.EmailHeaderDMARCResult -ne "")) {
+@"
+
+ 📚 $docTitle for $($result.Domain)
+Provider-specific documentation based on detected email provider: $($result.MXProviders -join ', ')
+-
+
- SPF Setup: SPF Setup Guide +
- DKIM Setup: DKIM Setup Guide +
- DMARC Setup: DMARC Setup Guide +
+
+"@
+})
+
+
+
+
+
+
+
+
+
+
+
+ Email Authentication Analysis
+Understanding how this email performed against authentication protocols
+
+
+
+
+
+
+
+ Authentication Process Breakdown
+Step-by-step analysis of email authentication
+
+
+
+
+
+
+
+ 1
+
+
+
+
+ Protocol Authentication Results
+Check if each authentication protocol passed or failed
+
+
+
+
+
+
+$(if($result.EmailHeaderAuthenticationResultsRaw) {
+@"
+
+
+
+
+
+
+
+
+ SPF
+ Sender Policy Framework
+
+
+ $(if($result.EmailHeaderSPFResult){$result.EmailHeaderSPFResult.ToUpper()}else{'UNKNOWN'})
+
+
+ $(switch ($result.EmailHeaderSPFResult.ToLower()) {
+ 'pass' { '✅ The connecting IP address is allowed to send emails and configured in the SPF record' }
+ 'fail' { '❌ The connecting IP address is not allowed to send emails and not configured in the SPF record' }
+ 'softfail' { '⚠ The connecting IP address is not allowed to send emails and not configured in the SPF record, however emails will be accepted but marked [depends on the destination email system]' }
+ 'neutral' { '❓ The SPF record specifies explicitly that nothing can be said about validity' }
+ 'none' { '❌ The domain does not have an SPF record' }
+ 'permerror' { '❌ There is incorrect syntax in the SPF record' }
+ 'temperror' { '⚠ An error occurred while doing the SPF check like a DNS timeout' }
+ default { '❓ Authentication result unclear' }
+ })
+
+
+
+
+
+
+
+
+
+ DKIM
+ Digital Signature
+
+
+ $(if($result.EmailHeaderDKIMResult){$result.EmailHeaderDKIMResult.ToUpper()}else{'UNKNOWN'})
+
+
+ $(switch ($result.EmailHeaderDKIMResult.ToLower()) {
+ 'pass' { '✅ Email signature is valid' }
+ 'fail (signature did not verify)' { '❌ One of the headers in the original DKIM signature has been modified' }
+ 'fail (body hash fail)' { '❌ Something in between the sender and Mail Server modified the body after the DKIM signature was stamped on the message' }
+ 'fail' { '❌ Email signature is invalid' }
+ default { '❓ Signature status unclear' }
+ })
+
+
+
+$(if($result.EmailHeaderAction) {
+"
+
+
+
+
+
+ DMARC
+ Policy Evaluation
+
+
+ $(if($result.EmailHeaderDMARCResult){$result.EmailHeaderDMARCResult.ToUpper()}else{'UNKNOWN'})
+
+
+ $(if($result.EmailHeaderDMARCResult -eq 'pass'){'✅ Policy evaluation passed'}
+ elseif($result.EmailHeaderDMARCResult -eq 'fail'){'❌ Policy evaluation failed'}
+ else{'❓ Policy evaluation unclear'})
+
+
+
"
+})
+$(if($result.EmailHeaderReason) {
+"
+
+
+
+
+
+ Action
+ DMARC Policy Action
+
+
+ $($result.EmailHeaderAction.ToUpper())
+
+
+ $(switch($result.EmailHeaderAction.ToLower()) {
+ 'none' { '✅ No action taken - message processed normally' }
+ 'quarantine' { '⚠ Message quarantined or marked as suspicious' }
+ 'reject' { '❌ Message rejected at SMTP level' }
+ default { '📋 Action taken based on DMARC policy' }
+ })
+
+
+
"
+})
+$(if($result.EmailHeaderCompAuth) {
+"
+
+
+
+
+
+ Reason
+ Authentication Reason Code
+
+
+ $($result.EmailHeaderReason)
+
+
+ 📋 $(
+ $reasonExplanation = Get-ReasonCodeExplanation -ReasonCode $result.EmailHeaderReason
+ if ($reasonExplanation) {
+ $reasonExplanation
+ } else {
+ "Detailed reason code for authentication result"
+ }
+ )
+
+
+
"
+})
+
+
+
+
+
+ CompAuth
+ Composite Authentication
+
+
+ $($result.EmailHeaderCompAuth)
+
+
+ 📊 Microsoft's composite authentication result
+
+
+
+"@
+})
+ + 🔍 + Additional Details +
+ + +
+
+
+
+$(if($result.EmailHeaderOffice365FilteringCorrelationId) {
+"
+ 📧
+ Complete Authentication-Results Header
+
+ $(($result.EmailHeaderAuthenticationResultsRaw -replace '&', '&' -replace '<', '<' -replace '>', '>' -replace '[^\x20-\x7E]', '' -replace '\s+', ' ').Trim())
+
+
"
+})
+
+
+$(if($result.EmailHeaderAntispamMailboxDelivery) {
+"
+ 🔧
+ Network Message ID
+
+ $($result.EmailHeaderOffice365FilteringCorrelationId)
+
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontAntispamReport) {
+"
+
+ 🛡
+ X-Microsoft-Antispam-Mailbox-Delivery
+
+ $(($result.EmailHeaderAntispamMailboxDelivery -replace '&', '&' -replace '<', '<' -replace '>', '>' -replace '[^\x20-\x7E]', '' -replace '\s+', ' ').Trim())
+
+
+
+
+ Parameter Analysis:
+
+$(if($result.EmailHeaderAntispamUCF) {
+"
+
+
+
"
+})
+
+$(if($result.EmailHeaderAntispamJMR) {
+"
+
+
+
+
+
+ UCF
+ Unified Content Filter
+
+
+ $($result.EmailHeaderAntispamUCF)
+
+
+ $(if($result.EmailHeaderAntispamUCF -eq '0'){'✅ Content filter not applied - message passed initial checks'}else{'❌ Content filter applied - security measures triggered'})
+
+
+
"
+})
+
+$(if($result.EmailHeaderAntispamDest) {
+"
+
+
+
+
+
+ JMR
+ Junk Mail Rule
+
+
+ $($result.EmailHeaderAntispamJMR)
+
+
+ $(if($result.EmailHeaderAntispamJMR -eq '0'){'✅ Junk mail rule not triggered - passed spam detection'}else{'❌ Junk mail rule triggered - potential spam detected'})
+
+
+
"
+})
+
+$(if($result.EmailHeaderAntispamOFR) {
+"
+
+
+
+
+
+ DEST
+ Message Destination
+
+
+ $($result.EmailHeaderAntispamDest)
+
+
+ $(if($result.EmailHeaderAntispamDest -eq 'I'){'✅ Delivered to Inbox - successful delivery'}
+ elseif($result.EmailHeaderAntispamDest -eq 'J'){'❌ Delivered to Junk folder - spam detected'}
+ elseif($result.EmailHeaderAntispamDest -eq 'D'){'❌ Message deleted - high-confidence spam'}
+ elseif($result.EmailHeaderAntispamDest -eq 'C'){'❓ The message was delivered to the destination'}
+ else{'❓ Unknown destination routing'})
+
+
+
"
+})
+
+
+
+
+
+ OFR
+ Organizational Filter
+
+
+ $($result.EmailHeaderAntispamOFR)
+
+
+ $(if($result.EmailHeaderAntispamOFR -eq 'None'){'✅ No organizational rules applied - standard processing'}
+ elseif($result.EmailHeaderAntispamOFR -like '*CustomRules*'){'❓ Custom organizational rules applied (e.g., transport or mail flow rules)'}
+ else{'❌ Organizational filtering applied'})
+
+
+
"
+})
+
+ 💻
+ X-Forefront-Antispam-Report-Untrusted
+
+ $(($result.EmailHeaderForefrontAntispamReport -replace '&', '&' -replace '<', '<' -replace '>', '>' -replace '[^\x20-\x7E]', '' -replace '\s+', ' ').Trim())
+
+
+
+
+ Parameter Analysis:
+
+$(if($result.EmailHeaderForefrontCIP) {
+"
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontCTRY) {
+"
+
+
+
+
+
+ CIP
+ Client IP Address
+
+
+ $($result.EmailHeaderForefrontCIP)
+
+
+ 📍 Source IP address of the connecting client
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontLANG) {
+"
+
+
+
+
+
+ CTRY
+ Country Code
+
+
+ $($result.EmailHeaderForefrontCTRY)
+
+
+ 🇺 Geographic country of origin for the sender
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontSCL) {
+"
+
+
+
+
+
+ LANG
+ Language Code
+
+
+ $($result.EmailHeaderForefrontLANG)
+
+
+ 🗣 Detected language of the email content
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontSRV) {
+"
+
+
+
+
+
+ SCL
+ Spam Confidence Level
+
+
+ $($result.EmailHeaderForefrontSCL)
+
+
+ $(if([int]$result.EmailHeaderForefrontSCL -le 1){'✅ Very low spam probability (0-1)'}
+ elseif([int]$result.EmailHeaderForefrontSCL -le 4){'✅ Low spam probability (2-4)'}
+ elseif([int]$result.EmailHeaderForefrontSCL -le 6){'❓ Medium spam probability (5-6)'}
+ elseif([int]$result.EmailHeaderForefrontSCL -le 8){'❌ High spam probability (7-8)'}
+ else{'❌ Very high spam probability'})
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontIPV) {
+"
+
+
+
+
+
+ SRV
+ Service Type
+
+
+ $($result.EmailHeaderForefrontSRV)
+
+
+ ⚙ Service or component that processed the message
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontSFV) {
+"
+
+
+
+
+
+ IPV
+ IP Version
+
+
+ $($result.EmailHeaderForefrontIPV)
+
+
+ $(switch($result.EmailHeaderForefrontIPV) {
+ 'CAL' { '✅ The message skipped spam filtering because the source IP address was in the IP Allow List' }
+ 'NLI' { 'ℹ The IP address was not found on any IP reputation list' }
+ default { '🌐 IP protocol version (IPv4/IPv6) used by sender' }
+ })
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontPTR) {
+"
+
+
+
+
+
+ SFV
+ Sender Filter Verdict
+
+
+ $($result.EmailHeaderForefrontSFV)
+
+
+ $(if($result.EmailHeaderForefrontSFV -eq 'NSPM'){'✅ Not Spam - message passed sender filtering'}
+ else{'❌ Sender filtering applied - potential spam detected'})
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontCAT) {
+"
+
+
+
+
+
+ PTR
+ Reverse DNS
+
+
+ $(if($result.EmailHeaderForefrontPTR){$result.EmailHeaderForefrontPTR}else{'Not Available'})
+
+
+ 🔄 Reverse DNS lookup result for sender IP address
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontDIR) {
+"
+
+
+
+
+
+ CAT
+ Category
+
+
+ $($result.EmailHeaderForefrontCAT)
+
+
+ $(switch ($result.EmailHeaderForefrontCAT) {
+ 'AMP' { '⚠ Anti-malware - Malicious software detected' }
+ 'BIMP' { '⚠ Brand impersonation - Impersonating known brands' }
+ 'BULK' { '📬 Bulk - Mass mailing detected' }
+ 'DIMP' { '⚠ Domain impersonation - Impersonating trusted domains' }
+ 'FTBP' { '📁 Anti-malware common attachments filter - Common attachment types filtered' }
+ 'GIMP' { '⚠ Mailbox intelligence impersonation - AI-detected impersonation attempt' }
+ 'HPHSH' { '🔴 High confidence phishing - High-risk phishing attempt' }
+ 'HPHISH' { '🔴 High confidence phishing - High-risk phishing attempt' }
+ 'HSPM' { '🔴 High confidence spam - High-risk spam content' }
+ 'INTOS' { '⚠ Intra-Organization phishing - Internal phishing attempt' }
+ 'MALW' { '🔴 Malware - Malicious software detected' }
+ 'OSPM' { '📬 Outbound spam - Outgoing spam detected' }
+ 'PHSH' { '⚠ Phishing - Phishing attempt detected' }
+ 'SAP' { '🛡 Safe Attachments - Attachment security analysis' }
+ 'SPM' { '📬 Spam - Unsolicited bulk email' }
+ 'SPOOF' { '⚠ Spoofing - Email address spoofing detected' }
+ 'UIMP' { '⚠ User impersonation - Impersonating specific users' }
+ default { "📁 $($result.EmailHeaderForefrontCAT) - Message category classification" }
+ })
+
+
+
"
+})
+
+$(if($result.EmailHeaderForefrontSFP) {
+"
+
+
+
+
+
+ DIR
+ Direction
+
+
+ $($result.EmailHeaderForefrontDIR)
+
+
+ ➡ Message flow direction (inbound/outbound)
+
+
+
"
+})
+
+
+
+
+
+ SFP
+ Sender Filter Policy
+
+
+ $($result.EmailHeaderForefrontSFP)
+
+
+ 📜 Sender filtering policy result
+
+
+
+
+
+
+
+
+ 2
+
+
+
+
+ Domain Alignment Analysis
+Verify that email domains are properly aligned
+
+
+
+
+
+
+ Domains can be aligned if MailFrom (P1) matches From (P2)
+
+
+
+
+
+
+
+
+
+
+
+
+ MailFrom (P1) - smtp.mailfrom [What is shown in the header]
+ Technical sender address
+
+ $(if($result.EmailHeaderSMTPMailFrom){$result.EmailHeaderSMTPMailFrom}else{'Not Found'})
+
+
+
+ Must Match
+
+
+
+
+
+
+
+
+
+
+ From (P2) - header.from [What mail client (Outlook) shows]
+ What users see
+
+ $(if($result.EmailHeaderHeaderFrom){$result.EmailHeaderHeaderFrom}else{'Not Found'})
+
+
+
+
+
+
+ $(if($result.EmailHeaderHeaderFrom -and $result.EmailHeaderSMTPMailFrom -and $result.EmailHeaderHeaderFrom.ToLower() -eq $result.EmailHeaderSMTPMailFrom.ToLower()){'Properly Aligned'}else{'Not Aligned'})
+ $(if($result.EmailHeaderHeaderFrom -and $result.EmailHeaderSMTPMailFrom -and $result.EmailHeaderHeaderFrom.ToLower() -eq $result.EmailHeaderSMTPMailFrom.ToLower()){'Domains match exactly'}else{if($result.EmailHeaderHeaderFrom -and $result.EmailHeaderSMTPMailFrom){'Domain mismatch detected'}else{'Missing domain information'}})
+
+
+
+
+
+
+
+
+ 3
+
+
+
+
+ DMARC Pass Evaluation
+Check DMARC Passing conditions
+
+
+
+
+
+
+
+ DMARC passes when at least ONE of these conditions is met:
+
+
+
+
+
+
+
+
+
+
+ A
+
+
+ SPF Authentication Path
+ SPF passes and From (P2) matches MailFrom (P1)
+
+
+ $(if($result.EmailHeaderCondition1Met){'✓ MET'}else{'✗ NOT MET'})
+
+
+
+
+
+
+ SPF Result: $(if($result.EmailHeaderSPFResult){$result.EmailHeaderSPFResult.ToUpper()}else{'UNKNOWN'})
+
+
+
+ Domain Alignment: From (P2) = MailFrom (P1)
+
+
+
+ OR
+
+
+
+
+
+
+
+
+ B
+
+
+ DKIM Authentication Path
+ DKIM passes and the DKIM signature (header.d) is signed by the From (P2) domain
+
+
+ $(if($result.EmailHeaderCondition2Met){'✓ MET'}else{'✗ NOT MET'})
+
+
+
+
+
+
+ DKIM Result: $(if($result.EmailHeaderDKIMResult){$result.EmailHeaderDKIMResult.ToUpper()}else{'UNKNOWN'})
+
+
+
+ Domain Alignment: DKIM signature (header.d) is signed by the From (P2) domain
+
+
+
+
+
+
+ 4
+
+
+
+ Final Authentication Result
+Overall authentication outcome
+
+
+
+
+
+
+
+
+
+
+ $(if($result.EmailHeaderDMARCPass -eq 'Yes') {
+ if($result.EmailHeaderCondition1Met -and $result.EmailHeaderCondition2Met) {
+ 'EXCELLENT: DMARC AUTHENTICATION PASSED'
+ } else {
+ 'GOOD: DMARC AUTHENTICATION PASSED'
+ }
+ } else {
+ 'DMARC AUTHENTICATION FAILED'
+ })
+
+
+ $(if($result.EmailHeaderDMARCPass -eq 'Yes') {
+ if($result.EmailHeaderCondition1Met -and $result.EmailHeaderCondition2Met) {
+ '🎯 Both SPF and DKIM authentication paths succeeded. This email has the highest level of authentication confidence and should be trusted by email systems.'
+ } else {
+ '✅ At least one authentication path (SPF or DKIM) succeeded with proper domain alignment. This email passed DMARC requirements and should be delivered normally.'
+ }
+ } else {
+ '⚠️ Neither authentication path succeeded with proper domain alignment. This email may be treated as suspicious, quarantined, or rejected by email systems depending on the domain''s DMARC policy.'
+ })
+
+
+
+
+ $(if($result.EmailHeaderDMARCPass -eq 'Yes') {
+ '✉️ Email should be delivered to inbox'
+ } else {
+ '🚫 Email may be blocked or sent to spam'
+ })
+
+