Get-ORCAReport stalls at - Getting MX Reports for all domains

[dcaddick]

Hi Cam,

Awesome tool BTW, but currently checking on large Edu tenant and getting stalled at:
Getting MX Reports for all domains - consistently stopping here for 30 - 50 mins plus

12/14/2020 15:23:50 Getting Anti-Spam Settings
12/14/2020 15:23:53 Getting Tenant Settings
12/14/2020 15:23:54 Getting Anti Phish Settings
12/14/2020 15:23:55 Getting Anti-Malware Settings
12/14/2020 15:23:56 Getting Transport Rules
12/14/2020 15:23:58 Getting ATP Policies
12/14/2020 15:23:59 Getting Accepted Domains
12/14/2020 15:24:00 Getting DKIM Configuration
12/14/2020 15:24:01 Getting Connectors
12/14/2020 15:24:01 Getting MX Reports for all domains

Tried running Get-ORCAReport -Collections Get-AcceptedDomain more or less to try "something" and it seemed to get past it - but now reporting that ATP is not installed in Tenant?

12/14/2020 15:50:17 Performing ORCA Version check...
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - Anti-Spam Policy Rules
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - Safety Tips
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - Phish Action
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - Bulk Complaint Level
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - High Confidence Spam Action
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - Allowed Senders
12/14/2020 15:50:26 Analysis - Anti-Spam Policies - Bulk Action
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - IP Allow Lists
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - Domain Whitelisting
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - Quarantine retention period
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - Outbound spam filter policy settings
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - High Confidence Phish Action
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - Mark Bulk as Spam
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - Spam Action
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - Advanced Spam Filter (ASF)
12/14/2020 15:50:27 Analysis - Anti-Spam Policies - End-user Spam notifications
12/14/2020 15:50:27 Analysis - Connectors - Domains
12/14/2020 15:50:27 Analysis - Connectors - Enhanced Filtering Configuration
12/14/2020 15:50:27 Analysis - DKIM - Signing Configuration
12/14/2020 15:50:27 Analysis - DKIM - DNS Records
12/14/2020 15:50:27 Analysis - Malware Filter Policy - Malware Filter Policy Policy Rules
12/14/2020 15:50:27 Analysis - Malware Filter Policy - Internal Sender Notifications
12/14/2020 15:50:27 Analysis - Malware Filter Policy - Common Attachment Type Filter
12/14/2020 15:50:27 Analysis - Malware Filter Policy - External Sender Notifications
12/14/2020 15:50:27 Analysis - Tenant Settings - Unified Audit Log
12/14/2020 15:50:27 Analysis - Transport Rules - Domain Whitelisting
12/14/2020 15:50:27 Analysis - Zero Hour Autopurge - Zero Hour Autopurge Enabled for Malware
12/14/2020 15:50:27 Analysis - Zero Hour Autopurge - Zero Hour Autopurge Enabled for Phish
12/14/2020 15:50:27 Analysis - Zero Hour Autopurge - Zero Hour Autopurge Enabled for Spam
12/14/2020 15:50:27 Analysis - Zero Hour Autopurge - Supported filter policy action
12/14/2020 15:50:27 Generating Output
12/14/2020 15:50:27 Output - HTML
12/14/2020 15:50:28 Complete! Output is in C:\Users......
ORCA--202012141550.zip

[dcaddick]

Just checked in other parts of the Admin console - this customer has 149 different domains (Schools) - guessing this might be a limitation somewhere?

[cammurray]

Hey @dcaddick - yeh, the speed of ORCA for tenants with a large amount of domains went down drastically after the addition of the enhanced filtering/skip listing check. This is because that check needs to know if the MX is pointed to EOP or a third-party, and it uses the Get-MxRecordReport command to do that, which can take a minute or so per domain.

We could, either:

1. Have an option to disable the check
2. Instead of using the Get-MxRecordReport command, poll the MX records directly on the client. The issue here though is that quite a few customers have split DNS configured with an internal zone for their domains (so the MX record on the polling client may not be accurate). This is the least favorite option because it will generate false positives.

[cammurray]

Closing this out, because it's expected that the Get-MXReport will take a long time when there are a large qty. of domains - and it's outside the control of ORCA (that's something to do with Exchange Online itself). The MX reports are required for SPF, DKIM, Enhanced Filtering checks, etc, so it's not something I think we want to bypass.