How to Find Active Mail Routing Domains

Question

We are starting an SPF/DKIM and DMARC project shortly and I need to find which of our over 200 accepted domains in Exchange online are actively routing mail within the last 60 days so we only make the changes to the domains we need to.

I can pull a list of all accepted domains but how do I find which domains have received inbound email within the last 60 days? I was thinking a message trace but you cannot do a wildcard message trace for all domains or even a per domain basis I don't think.

What's the best way of me gathering this information?

Thanks in advance!

Answer 1

Actually you can use wildcard to see which domains senders are using . ( Sending domains are the ones you care about for this)
*@yourdomain.com

You can do one at a time though.

so in the gui:

https://admin.exchange.microsoft.com/#/messagetrace

or with Exo Powershell:

Get-MessageTrace  -StartDate 1/19/2022 -SenderAddress *@yourdomain -EndDate 01/20/2022  

Note you can only search 10 days back using this command.

If you want longer with powershell:
https://learn.microsoft.com/en-us/powershell/module/exchange/get-historicalsearch?view=exchange-ps

The Poral GUI may be the easiest solution :)