Test-MtCisDkim and Test-MtCisaDkim crash when accepted domain has no DkimSigningConfig

[Korthal-Maiyn]

Description

Test-MtCisDkim and Test-MtCisaDkim throw an unhandled error when an accepted domain
(typically *.onmicrosoft.com) has no corresponding DkimSigningConfig entry. The error
is caught by the function's catch block, which returns $null and reports the test as
Ignored with no useful diagnostic information.

Steps to reproduce

1. Ensure your tenant has a .onmicrosoft.com accepted domain where Get-DkimSigningConfig
   does not return an entry (this is the default per
   Microsoft documentation)
2. Run Test-MtCisDkim or Test-MtCisaDkim

Expected behavior

The test should either:

• Report a failure for the domain with a clear message ("No DkimSigningConfig found for
  {domain}"), or
• Skip the domain with a reason explaining that Microsoft auto-signs DKIM for
  .onmicrosoft.com domains even without an explicit config

Actual behavior

Get-MailAuthenticationRecord: Cannot bind argument to parameter 'DkimDnsName' because it
is an empty string.

The catch block fires, Add-MtTestResultDetail -SkippedBecause Error is called, and the
function returns $null. The Pester test result is Ignored with no indication of the
underlying cause.

Root cause

In Test-MtCisDkim.ps1 (line 41) and Test-MtCisaDkim.ps1 (line 40), when no
DkimSigningConfig matches the domain, $dkimSigningConfig is $null. The code then:

1. Accesses $dkimSigningConfig.RotateOnDate (null, date comparison falls through)
2. Sets $Selector to $dkimSigningConfig.SelectorBeforeRotateOnDate (null/empty)
3. For .onmicrosoft.com domains, evaluates $dkimSigningConfig."$($selector)CNAME" to
   empty string
4. Calls Get-MailAuthenticationRecord -DkimDnsName '' which throws

Suggested fix

Add a null-check on $dkimSigningConfig at the start of the foreach loop body. If no
config exists, either fail the domain with a descriptive message or skip it with a reason.

Environment

• Maester 2.1.0
• ExchangeOnlineManagement 3.9.2
• PowerShell 7.4
• Microsoft 365 Business Basic
• Tenant has two accepted domains: contoso.com (DKIM config exists) and
  contoso.onmicrosoft.com (no DKIM config, which is the Microsoft default)

Workaround

Run New-DkimSigningConfig -DomainName '<tenant>.onmicrosoft.com' -Enabled $true to
explicitly create the DKIM signing config for the .onmicrosoft.com domain. This resolves
the null-reference because the config now exists in Get-DkimSigningConfig output.