diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..fa98f14
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: UTC
+    target-branch: develop
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: build
+      include: scope
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..83c9c12
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
diff --git a/.github/workflows/pester.yml b/.github/workflows/pester.yml
new file mode 100644
index 0000000..2423051
--- /dev/null
+++ b/.github/workflows/pester.yml
@@ -0,0 +1,139 @@
+name: Pester
+
+on:
+  pull_request:
+    paths:
+      - "**/*.ps1"
+      - "**/*.psm1"
+      - "**/*.psd1"
+      - "Tests/**"
+      - ".github/workflows/pester.yml"
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - "**/*.ps1"
+      - "**/*.psm1"
+      - "**/*.psd1"
+      - "Tests/**"
+      - ".github/workflows/pester.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  PESTER_VERSION: '5.7.1'
+
+jobs:
+  test:
+    name: Run Pester tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            www.powershellgallery.com:443
+
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Validate pinned Pester version
+        shell: pwsh
+        run: |
+          Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
+          $null = Find-Module -Name 'Pester' -RequiredVersion '${{ env.PESTER_VERSION }}' -Repository PSGallery -ErrorAction Stop
+          Write-Host "Using pinned Pester version ${{ env.PESTER_VERSION }}"
+
+      - name: Cache Pester module
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        with:
+          path: ~/.local/share/powershell/Modules/Pester
+          key: pester-${{ runner.os }}-${{ env.PESTER_VERSION }}
+          restore-keys: |
+            pester-${{ runner.os }}-
+
+      - name: Install Pester
+        shell: pwsh
+        run: |
+          $moduleName = 'Pester'
+          $requiredVersion = [Version]$env:PESTER_VERSION
+
+          $installed = Get-Module -ListAvailable -Name $moduleName | Where-Object { $_.Version -eq $requiredVersion }
+          if (-not $installed) {
+              Install-Module -Name $moduleName -RequiredVersion $requiredVersion.ToString() -Scope CurrentUser -Force -AllowClobber
+          }
+
+          Get-Module -ListAvailable -Name $moduleName | Where-Object { $_.Version -eq $requiredVersion } |
+              Select-Object -First 1 |
+              Format-List Name, Version, ModuleBase
+
+      - name: Run Pester tests
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $resultsPath = Join-Path -Path $PWD -ChildPath 'Output/TestResults'
+          if (-not (Test-Path -Path $resultsPath)) {
+              New-Item -ItemType Directory -Path $resultsPath -Force | Out-Null
+          }
+
+          if (-not (Test-Path -Path 'Tests')) {
+              Write-Host 'No Pester tests found (Tests folder missing). Skipping.'
+              exit 0
+          }
+
+          $testFiles = Get-ChildItem -Path 'Tests' -Filter '*.ps1' -File -Recurse -ErrorAction SilentlyContinue
+          if (-not $testFiles) {
+              Write-Host 'No Pester test files found under Tests. Skipping.'
+              exit 0
+          }
+
+          $requiredVersion = [Version]$env:PESTER_VERSION
+          Import-Module -Name Pester -RequiredVersion $requiredVersion.ToString() -Force
+
+          $config = [PesterConfiguration]::Default
+          $config.Run.Path = 'Tests'
+          $config.Run.PassThru = $true
+          $config.Output.Verbosity = 'Detailed'
+          $config.TestResult.Enabled = $true
+          $config.TestResult.OutputFormat = 'JUnitXml'
+          $config.TestResult.OutputPath = Join-Path -Path $resultsPath -ChildPath 'PesterResults.xml'
+          $coverageTargets = @(
+              'DomainSecurityAuditor.psm1'
+              'Public'
+              'Private'
+              'Examples'
+          ) | Where-Object { Test-Path -Path $_ }
+          if ($coverageTargets) {
+              $config.CodeCoverage.Enabled = $true
+              $config.CodeCoverage.OutputFormat = 'JaCoCo'
+              $config.CodeCoverage.OutputPath = Join-Path -Path $resultsPath -ChildPath 'PesterCoverage.xml'
+              $config.CodeCoverage.Path = $coverageTargets
+          }
+          else {
+              $config.CodeCoverage.Enabled = $false
+              Write-Host 'No coverage targets found; skipping code coverage.'
+          }
+
+          $result = Invoke-Pester -Configuration $config
+          $result | Format-List -Property *
+
+          if ($result.FailedCount -gt 0) {
+              throw "Pester reported $($result.FailedCount) failed tests."
+          }
+
+      - name: Upload Pester results
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: pester-results
+          path: Output/TestResults/*.xml
+          retention-days: 14
+          if-no-files-found: warn
diff --git a/.github/workflows/psscriptanalyzer.yml b/.github/workflows/psscriptanalyzer.yml
new file mode 100644
index 0000000..c9448f9
--- /dev/null
+++ b/.github/workflows/psscriptanalyzer.yml
@@ -0,0 +1,105 @@
+name: PSScriptAnalyzer
+
+on:
+  pull_request:
+    paths:
+      - "**/*.ps1"
+      - "**/*.psm1"
+      - "**/*.psd1"
+      - "PSScriptAnalyzerSettings.psd1"
+      - ".github/workflows/psscriptanalyzer.yml"
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - "**/*.ps1"
+      - "**/*.psm1"
+      - "**/*.psd1"
+      - "PSScriptAnalyzerSettings.psd1"
+      - ".github/workflows/psscriptanalyzer.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Run PSScriptAnalyzer
+    runs-on: ubuntu-latest
+    env:
+      PSSA_VERSION: "1.24.0"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            www.powershellgallery.com:443
+
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Cache PowerShell modules
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        with:
+          path: ~/.local/share/powershell/Modules/PSScriptAnalyzer
+          key: pssa-${{ runner.os }}-${{ env.PSSA_VERSION }}-${{ hashFiles('PSScriptAnalyzerSettings.psd1') }}
+          restore-keys: |
+            pssa-${{ runner.os }}-
+
+      - name: Install PSScriptAnalyzer
+        shell: pwsh
+        run: |
+          $moduleName = 'PSScriptAnalyzer'
+          $requiredVersion = [Version]'${{ env.PSSA_VERSION }}'
+
+          $installed = Get-Module -ListAvailable -Name $moduleName | Where-Object { $_.Version -eq $requiredVersion }
+          if (-not $installed) {
+              Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
+              Install-Module -Name $moduleName -RequiredVersion $requiredVersion.ToString() -Scope CurrentUser -Force -AllowClobber
+          }
+
+          Get-Module -ListAvailable -Name $moduleName | Where-Object { $_.Version -eq $requiredVersion } |
+              Select-Object -First 1 |
+              Format-List Name, Version, ModuleBase
+
+      - name: Analyze PowerShell scripts
+        shell: pwsh
+        run: |
+          $settingsPath = Join-Path $PWD 'PSScriptAnalyzerSettings.psd1'
+          if (-not (Test-Path $settingsPath)) {
+              Write-Error "Settings file not found at $settingsPath"
+              exit 1
+          }
+
+          $paths = @(
+              'DomainSecurityAuditor.psm1'
+              'DomainSecurityAuditor.psd1'
+              'Public'
+              'Private'
+              'Examples'
+              'Tests'
+          ) | Where-Object { Test-Path $_ }
+
+          if (-not $paths) {
+              Write-Error 'No PowerShell paths found to analyze'
+              exit 1
+          }
+
+          $ErrorActionPreference = 'Stop'
+          $results = @()
+          foreach ($p in $paths) {
+              $results += Invoke-ScriptAnalyzer -Path $p -Recurse -Settings $settingsPath
+          }
+
+          if ($results) {
+              $results | Format-Table RuleName, Severity, ScriptName, Line, Message -AutoSize
+              Write-Host "`nTotal issues: $($results.Count)"
+              exit 1
+          }
+          Write-Host 'No issues found.'
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
new file mode 100644
index 0000000..489e733
--- /dev/null
+++ b/.github/workflows/scorecards.yml
@@ -0,0 +1,81 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches: ["develop"]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+      # To allow GraphQL ListCommits to work
+      issues: read
+      pull-requests: read
+      # To detect SAST tools
+      checks: read
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        with:
+          sarif_file: results.sarif
diff --git a/.gitignore b/.gitignore
index 07a8bec..db5a4bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,11 @@ Desktop.ini
 .vscode-server/
 *.code-workspace.user
 
+# ----------------------------
+# Tooling
+# ----------------------------
+.claude/
+
 # ----------------------------
 # PowerShell
 # ----------------------------
@@ -61,6 +66,7 @@ codecoverage*.xml
 # Build Artifacts
 # ----------------------------
 Output/*
+!Output/.gitkeep
 build/
 dist/
 *.nupkg
@@ -78,6 +84,8 @@ Reports/*.xml
 # ----------------------------
 *.log
 logs/*
+Logs/*
+!Logs/.gitkeep
 
 # ----------------------------
 # CI/CD (GitHub Actions)
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..cba0860
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,10 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
diff --git a/AGENTS.md b/AGENTS.md
index c32f025..a11d3a0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,141 @@
+## CLI Tooling & Fast Search (Agent Standards)
+
+These standards apply whenever an agent interacts with the **DomainSecurityAuditor** repo via a shell (local or remote). The goal is: **fast, safe, Rust-first tooling**.
+
+### Content Search (ripgrep)
+
+- **Always** use [`rg` (ripgrep)](https://github.com/BurntSushi/ripgrep) for project-wide search.
+- **Do not** use `grep` or `egrep` for repository searches.
+- Respect ignore files by default (`.gitignore`, `.ignore`, `.rgignore`).
+
+**Usage patterns:**
+
+- Search for a pattern:
+  - `rg "pattern"`
+- Search with context:
+  - `rg -n -A 3 -B 3 "pattern"`
+- Limit by language:
+  - `rg -t powershell "function"`
+- List tracked/non-ignored files:
+  - `rg --files`
+
+**Safety constraints for agents:**
+
+- **Never** use these flags in automated/agent contexts:
+  - `--pre`
+  - `-z` / `--search-zip`
+  - `--hostname-bin`
+- Avoid writing shell commands that feed untrusted input directly into `rg` arguments without quoting.
+- Cap interactive reads from `rg` output to ~250 lines unless a larger range is explicitly required.
+
+### File Discovery (fd)
+
+Prefer [`fd`](https://github.com/sharkdp/fd) (or `fdfind` on Debian/Ubuntu) instead of `find`:
+
+- On Debian/Ubuntu/WSL, install and alias once:
+
+  ```bash
+  sudo apt update && sudo apt install -y fd-find
+  echo 'alias fd=fdfind' >> ~/.bashrc
+  ```
+
+**Usage patterns:**
+
+- Find files/directories by name:
+  - `fd name`
+- Restrict search scope:
+  - `fd name src`
+- Match by extension:
+  - `fd . ps1`  # all *.ps1 files under current dir
+
+**Safety when chaining commands:**
+
+- When piping `fd` output into other commands (especially anything that deletes or modifies files), **always** use null-delimited output and `xargs -0`, and terminate argument lists with `--`:
+
+  ```bash
+  fd -0 pattern | xargs -0 rm --      # safe deletion
+  fd -0 '.ps1' | xargs -0 dos2unix -- # safe batch edits
+  ```
+
+- Agents must **not** emit patterns that could be interpreted as options (e.g., filenames beginning with `-`) without using the `-0` / `xargs -0 --` pattern.
+
+### JSON Processing (jaq / jq)
+
+Prefer a **Rust** JSON processor for performance and memory safety.
+
+- Primary tool: [`jaq`](https://github.com/01mf02/jaq) (Rust reimplementation of the jq language).
+- Fallback: `jq` (only if `jaq` is not available in the environment).
+
+**Usage patterns (valid for both `jaq` and `jq`):**
+
+- Extract a field:
+
+  ```bash
+  jaq '.key' file.json
+  ```
+
+- Map an array to a simpler object list:
+
+  ```bash
+  jaq '.items[] | { id, name }' file.json
+  ```
+
+- Pretty-print JSON from stdin:
+
+  ```bash
+  some-command | jaq '.'
+  ```
+
+**Standards:**
+
+- Use `jaq`/`jq` for **all** JSON parsing and transformation; agents must **not** parse JSON with grep/regex when a structured approach is possible.
+- When emitting JSON from PowerShell into the CLI, prefer `ConvertTo-Json -Depth N | jaq '...'` over ad-hoc string manipulation.
+- If `jaq` is unavailable:
+  - Agents may fall back to `jq` but should treat it as a compatibility mode, not the preferred long-term default.
+
+### Tool Installation Guidance (For Local Dev / CI Images)
+
+For environments you control (WSL Ubuntu, dev containers, CI images), ensure these packages are available:
+
+- **Debian/Ubuntu/WSL:**
+
+  ```bash
+  sudo apt update && sudo apt install -y ripgrep fd-find jq
+
+  # Optional: install jaq via cargo if not packaged:
+  # cargo install jaq
+  ```
+
+  Add to shell profile:
+
+  ```bash
+  alias fd=fdfind
+  ```
+
+- **macOS (Homebrew):**
+
+  ```bash
+  brew install ripgrep fd jq jaq
+  ```
+
+### Agent Command Mapping Rules
+
+When the agent needs to:
+
+- **Search text in the repo:**
+  - Use `rg "pattern"` (with optional `-n -A 3 -B 3`).
+- **List or locate files:**
+  - Use `fd name` (or `fd pattern path`).
+  - Use `rg --files` only when a raw file list is required.
+- **Inspect or transform JSON:**
+  - Use `jaq` first; fall back to `jq` only if `jaq` is unavailable.
+- **Avoid completely:**
+  - `grep`, `egrep`, and raw `find` for repo-wide operations.
+  - Dangerous ripgrep flags (`--pre`, `-z`, `--search-zip`, `--hostname-bin`) in automated flows.
+
 ### Module & Script Structure
 
-- Use modular, reusable functions with PowerShell-approved verbs in names; exported entry points (e.g., `Invoke-DomainSecurityBaseline`) belong in the module's `Public\` folder and call private helpers.
+- Use modular, reusable functions with PowerShell-approved verbs in names; exported entry points (e.g., `Invoke-DomainSecurityAuditor`) belong in the module's `Public\` folder and call private helpers.
 - Keep the DomainSecurityAuditor layout consistent: `Public\`, `Private\`, `Tests\`, `Examples\`, `Output\`, and `Logs\`. Wrapper scripts stored in `Examples\` must only import the module and call exported commands.
 - Maintain a `DomainSecurityAuditor.psd1` manifest with accurate metadata, `RootModule`, and `RequiredModules` so consumers understand the supported entry points.
 - Parameterize scripts with defaults, type validation, and safe fallbacks.
@@ -9,7 +144,7 @@
 - Log all major actions to `Logs\` and optionally output reports to `Output\`.
 - Log filenames must be timestamped and follow pruning/retention rules.
 - Reuse logic via functions to avoid duplication.
-- Detect required dependencies (DomainDetective, PSWriteHTML, Pester, PSScriptAnalyzer) via a helper such as `Test-DSADependency`. Attempt installation by default and declare the same modules in the `.psd1` `RequiredModules`. If the `-SkipDependencies` switch is specified, short-circuit from the exported entry point after logging which dependencies were skipped.
+- Detect required dependencies (DomainDetective, Pester, PSScriptAnalyzer) via a helper such as `Test-DSADependency`. Attempt installation by default and declare the same modules in the `.psd1` `RequiredModules`. If the `-SkipDependencies` switch is specified, short-circuit from the exported entry point after logging which dependencies were skipped.
 - Comply with **PSScriptAnalyzer** rules.
 - Use **Pester 5+** for unit-testable logic; keep tests in `Tests\`, import the DomainSecurityAuditor module once per file, and rely on `InModuleScope` to exercise private helpers.
 - Avoid long paths — keep script and output paths under **180 characters**.
@@ -40,8 +175,12 @@ Stop-Transcript
   - Honor the repo's `.editorconfig` conventions for indentation, casing, and trailing whitespace so that automated formatters and IDEs produce identical diffs.
   - Before submitting, run **PSScriptAnalyzer** using the workspace settings file (`./PSScriptAnalyzerSettings.psd1`) to ensure local results match CI (`Invoke-ScriptAnalyzer -Settings .\PSScriptAnalyzerSettings.psd1`).
   - If default IDE/editor behavior changes, update the corresponding configuration files in the repo so analyzer settings remain aligned across tooling.
+- **Pre-commit validation**
+  - Before committing any code, run `Invoke-ScriptAnalyzer -Path . -Settings .\PSScriptAnalyzerSettings.psd1` and `Invoke-Pester` (matching the workflow configuration) and ensure both pass. If either fails, fix the root cause before committing.
+- **GitHub Actions**
+  - All workflows must use `step-security/harden-runner` to harden runners before executing jobs.
 
-- Every exported module command must expose a `-DryRun` (or `SupportsShouldProcess`) switch and a `-ShowProgress` switch so behavior remains consistent when called directly or via wrapper scripts.
+- Every exported module command must expose a `-ShowProgress` switch so behavior remains consistent when called directly or via wrapper scripts.
 - Provide usage examples, either in comment-based help or a README-adjacent example block.
 - Use descriptive, self-explanatory variable names — avoid single-letter or ambiguous loop/control variables.
 - Add inline comments explaining non-obvious logic.
@@ -60,7 +199,7 @@ Stop-Transcript
 Anytime functionality, report baselines, or remediation guidance changes, complete the following before opening a PR:
 
 1. **README Alignment** — Update `README.md` so the documented goals, workflows, and examples reflect the latest behavior.
-2. **Example Report Refresh** — Regenerate `Examples/domain_compliance_report.html` (or its successor artifact) so screenshots and sample data match the current report schema and recommendations.
+2. **Example Report Refresh** — Regenerate `Examples/domain_security_auditor_report.html` (or its successor artifact) so screenshots and sample data match the current report schema and recommendations.
 3. **Pester Coverage** — Add or adjust Pester tests to cover new behaviors, updated baselines, or regression fixes. Keep coverage under `Tests\` and ensure new assertions run in CI.
 4. **Reference-Backed Guidance** — When modifying tests or recommendations, cite the same caliber of authoritative sources referenced in the README (e.g., RFCs, M3AAWG, dmarc.org, Microsoft Learn). Surface those references in code comments, test descriptions, or report content so downstream consumers understand the rationale.
 
@@ -102,7 +241,7 @@ These conventions keep DomainSecurityAuditor contributions predictable for audit
 .DESCRIPTION
     <Detailed description of module scope, key entry points, and integration paths>
 .REQUIRES
-    Modules: DomainDetective, PSWriteHTML, Pester, PSScriptAnalyzer
+    Modules: DomainDetective, Pester, PSScriptAnalyzer
 .NOTES
     Module: DomainSecurityAuditor
     Author: <Author Name>
@@ -129,13 +268,16 @@ Resources:
     <Describe the parameter; repeat for each parameter>
 .PARAMETER SkipDependencies
     Bypass automatic module installation; logs missing dependencies and exits early.
-.PARAMETER DryRun
-    Simulate the action without making changes.
+.PARAMETER SkipReportLaunch
+    Prevents automatic launching of the generated compliance report.
 .PARAMETER ShowProgress
     Toggle `Write-Progress` output.
 .EXAMPLE
-    Invoke-DomainSecurityBaseline -Domain "example.com" -DryRun
-    Runs baseline tests without persisting artifacts.
+    Invoke-DomainSecurityAuditor -Domain "example.com"
+    Runs baseline tests and writes an HTML report to the default output folder.
+.EXAMPLE
+    Invoke-DomainSecurityAuditor -InputFile ".\domains.csv" -SkipReportLaunch
+    Processes every domain listed in the CSV and suppresses auto-launching the HTML report (CI-friendly).
 .OUTPUTS
     PSCustomObject describing compliance results.
 .NOTES
diff --git a/Configs/Baseline.Default.psd1 b/Configs/Baseline.Default.psd1
new file mode 100644
index 0000000..9d5dacb
--- /dev/null
+++ b/Configs/Baseline.Default.psd1
@@ -0,0 +1,1785 @@
+@{
+    Name = 'Baseline Email Security'
+    Version = '1.0'
+    Profiles = @{
+        SendingOnly = @{
+            Description = 'Domains that originate mail but do not host inbound mailboxes.'
+            Checks = @(
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    References = @(
+                        'RFC 5321 section 5',
+                        'M3AAWG Operational Guidance'
+                    )
+                    ExpectedValue = 1
+                    Expectation = 'Inbound-capable domains must publish MX records.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Critical'
+                    Area = 'MX'
+                    Id = 'MXPresence'
+                    Target = 'Records.MXRecordCount'
+                    Remediation = 'Publish MX records pointing to the organization''s inbound infrastructure.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'M3AAWG Operational Guidance'
+                    )
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'MX TTLs between 1 and 24 hours aid change control.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'MX'
+                    Id = 'MXTtl'
+                    Target = 'Records.MXMinimumTtl'
+                    Remediation = 'Adjust MX TTL to fall within the recommended range.'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish an SPF TXT record to define authorized senders.'
+                    Remediation = 'Create a single SPF record (v=spf1 ...) for the domain and manage changes centrally.'
+                    Severity = 'Critical'
+                    Area = 'SPF'
+                    Id = 'SPFPresence'
+                    References = @(
+                        'RFC 7208',
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFRecord'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = '1'
+                    Expectation = 'Only one SPF record should exist per RFC 7208.'
+                    Remediation = 'Consolidate multiple SPF TXT records into a single entry.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFRecordMultiplicity'
+                    References = @(
+                        'RFC 7208 section 3.1'
+                    )
+                    Target = 'Records.SPFRecordCount'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 10
+                    Expectation = 'SPF processing must stay within the 10 DNS lookup ceiling.'
+                    Remediation = 'Reduce includes/redirects by flattening or delegating per RFC 7208 section 4.6.4.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFLookupLimit'
+                    References = @(
+                        'RFC 7208 section 4.6.4'
+                    )
+                    Target = 'Records.SPFLookupCount'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        '-all',
+                        '~all'
+                    )
+                    Expectation = 'SPF should conclude with -all or ~all to provide deterministic policy enforcement.'
+                    Remediation = 'Update the SPF record terminal mechanism to -all after validating authorized senders (or ~all during phased rollout).'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFTerminalMechanism'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTerminalMechanism'
+                },
+                @{
+                    Condition = 'MustBeFalse'
+                    Enforcement = 'Required'
+                    Expectation = 'Avoid unsafe mechanisms such as ptr per RFC 7208 guidance.'
+                    Remediation = 'Remove ptr or other deprecated mechanisms to prevent unpredictable resolution chains.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFUnsafeMechanisms'
+                    References = @(
+                        'RFC 7208 section 5.7'
+                    )
+                    Target = 'Records.SPFHasPtrMechanism'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = 255
+                    Expectation = 'Keep SPF strings within 255 characters to avoid DNS truncation.'
+                    Remediation = 'Shorten mechanisms/includes or break records into multiple quoted strings.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFRecordLength'
+                    References = @(
+                        'RFC 7208 section 3.2'
+                    )
+                    Target = 'Records.SPFRecordLength'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'SPF TTL should balance agility with cache efficiency (1-24 hours).'
+                    Remediation = 'Adjust TXT record TTL to between 3600 and 86400 seconds.'
+                    Severity = 'Low'
+                    Area = 'SPF'
+                    Id = 'SPFTtl'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'At least one DKIM selector should exist for active senders.'
+                    Remediation = 'Generate 2048-bit DKIM keys per platform and publish selectors.'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorPresence'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMSelectors'
+                },
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 1024
+                    Expectation = 'DKIM keys must be >=1024 bits (2048 preferred).'
+                    Remediation = 'Rotate weak DKIM keys with 2048-bit RSA entries.'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMKeyStrength'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMMinKeyLength'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 0
+                    Expectation = 'Selectors should resolve cleanly without invalid/weak keys.'
+                    Remediation = 'Repair or remove DKIM selectors flagged as invalid or <1024 bits.'
+                    Severity = 'Medium'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorHealth'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMWeakSelectors'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 604800
+                    }
+                    Expectation = 'DKIM records should retain TTLs between 1 hour and 7 days.'
+                    Remediation = 'Adjust selector TTLs to balance agility and cache stability.'
+                    Severity = 'Low'
+                    Area = 'DKIM'
+                    Id = 'DKIMTtl'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMMinimumTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'A DMARC TXT record must be present at _dmarc.<domain>.'
+                    Remediation = 'Publish DMARC (v=DMARC1; p=quarantine/reject; rua=mailto:reports@domain).'
+                    Severity = 'Critical'
+                    Area = 'DMARC'
+                    Id = 'DMARCPresence'
+                    References = @(
+                        'RFC 7489',
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRecord'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        'quarantine',
+                        'reject'
+                    )
+                    Expectation = 'Active domains should enforce p=quarantine or p=reject.'
+                    Remediation = 'Tighten DMARC to quarantine/reject after monitoring aligned traffic.'
+                    Severity = 'High'
+                    Area = 'DMARC'
+                    Id = 'DMARCPolicyStrength'
+                    References = @(
+                        'RFC 7489',
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCPolicy'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'DMARC must include at least one RUA reporting address.'
+                    Remediation = 'Add rua=mailto:dmarc@domain to capture aggregate telemetry.'
+                    Severity = 'Medium'
+                    Area = 'DMARC'
+                    Id = 'DMARCRuaPresence'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRuaAddresses'
+                },
+                @{
+                    Condition = 'MustBeEmpty'
+                    Enforcement = 'Recommended'
+                    Expectation = 'Avoid RUF forensic feeds unless mandated; they add privacy/risk.'
+                    Remediation = 'Remove ruf= values unless the workflow explicitly requires forensic data.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCRufOmission'
+                    References = @(
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCRufAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'DMARC TTLs between 1 and 24 hours ease change control.'
+                    Remediation = 'Adjust DMARC TXT TTL accordingly.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCTtl'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCTtl'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish the _mta-sts TXT bootstrap record.'
+                    Remediation = 'Create the _mta-sts subdomain TXT pointing to the HTTPS policy file.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPresence'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSRecordPresent'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'The HTTPS policy file should be reachable and parseable.'
+                    Remediation = 'Verify policy hosting, TLS certificate, and JSON syntax for the MTA-STS policy file.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPolicyValid'
+                    References = @(
+                        'RFC 8461'
+                    )
+                    Target = 'Records.MTASTSPolicyValid'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 'enforce'
+                    Expectation = 'Operate MTA-STS in enforce mode (not testing) once vetted.'
+                    Remediation = 'Update the policy file mode to enforce after validating delivery.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSMode'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSMode'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'MTA-STS TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust the TXT TTL to balance agility and cache efficiency.'
+                    Severity = 'Low'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSTtl'
+                    References = @(
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSTtl'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish _smtp._tls TXT for TLS Reporting.'
+                    Remediation = 'Create v=TLSRPTv1; rua=mailto:tls@domain at _smtp._tls.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTPresence'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTRecordPresent'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'At least one reporting mailbox should be defined.'
+                    Remediation = 'Add rua mailbox destinations to the TLS-RPT record.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTAddresses'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'TLS-RPT TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust TTL for TLS-RPT to improve manageability.'
+                    Severity = 'Low'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTTtl'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTTtl'
+                }
+            )
+            Name = 'Sending Only'
+        }
+        Parked = @{
+            Description = 'Domains not actively sending or receiving mail.'
+            Checks = @(
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Parked domains should publish a null MX (0 .).'
+                    Remediation = 'Add a null MX to signal that the domain does not accept mail.'
+                    Severity = 'High'
+                    Area = 'MX'
+                    Id = 'MXNullForParked'
+                    References = @(
+                        'RFC 7504'
+                    )
+                    Target = 'Records.MXHasNull'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish an SPF TXT record to define authorized senders.'
+                    Remediation = 'Create a single SPF record (v=spf1 ...) for the domain and manage changes centrally.'
+                    Severity = 'Critical'
+                    Area = 'SPF'
+                    Id = 'SPFPresence'
+                    References = @(
+                        'RFC 7208',
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFRecord'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = '1'
+                    Expectation = 'Only one SPF record should exist per RFC 7208.'
+                    Remediation = 'Consolidate multiple SPF TXT records into a single entry.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFRecordMultiplicity'
+                    References = @(
+                        'RFC 7208 section 3.1'
+                    )
+                    Target = 'Records.SPFRecordCount'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 10
+                    Expectation = 'SPF processing must stay within the 10 DNS lookup ceiling.'
+                    Remediation = 'Reduce includes/redirects by flattening or delegating per RFC 7208 section 4.6.4.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFLookupLimit'
+                    References = @(
+                        'RFC 7208 section 4.6.4'
+                    )
+                    Target = 'Records.SPFLookupCount'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        '-all',
+                        '~all'
+                    )
+                    Expectation = 'SPF should conclude with -all or ~all to provide deterministic policy enforcement.'
+                    Remediation = 'Update the SPF record terminal mechanism to -all after validating authorized senders (or ~all during phased rollout).'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFTerminalMechanism'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTerminalMechanism'
+                },
+                @{
+                    Condition = 'MustBeFalse'
+                    Enforcement = 'Required'
+                    Expectation = 'Avoid unsafe mechanisms such as ptr per RFC 7208 guidance.'
+                    Remediation = 'Remove ptr or other deprecated mechanisms to prevent unpredictable resolution chains.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFUnsafeMechanisms'
+                    References = @(
+                        'RFC 7208 section 5.7'
+                    )
+                    Target = 'Records.SPFHasPtrMechanism'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = 255
+                    Expectation = 'Keep SPF strings within 255 characters to avoid DNS truncation.'
+                    Remediation = 'Shorten mechanisms/includes or break records into multiple quoted strings.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFRecordLength'
+                    References = @(
+                        'RFC 7208 section 3.2'
+                    )
+                    Target = 'Records.SPFRecordLength'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'SPF TTL should balance agility with cache efficiency (1-24 hours).'
+                    Remediation = 'Adjust TXT record TTL to between 3600 and 86400 seconds.'
+                    Severity = 'Low'
+                    Area = 'SPF'
+                    Id = 'SPFTtl'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTtl'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        '-all'
+                    )
+                    Expectation = 'Parked domains should hard-fail with -all.'
+                    Remediation = 'Set the SPF record to v=spf1 -all for unused domains.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFTerminalParked'
+                    References = @(
+                        'RFC 7208',
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTerminalMechanism'
+                },
+                @{
+                    Condition = 'MustBeEmpty'
+                    Enforcement = 'Required'
+                    Expectation = 'Parked domains should not include sending providers.'
+                    Remediation = 'Remove SendGrid/Microsoft/etc. includes from parked SPF records.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFIncludesParked'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFIncludes'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Recommended'
+                    Expectation = 'Configure an empty wildcard SPF record (e.g., *.domain) to return v=spf1 -all.'
+                    Remediation = 'Publish a wildcard TXT record with v=spf1 -all for parked domains.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFWildcardParked'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFWildcardConfigured'
+                },
+                @{
+                    Condition = 'MustExist'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Expectation = 'At least one DKIM selector should exist for active senders.'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorPresence'
+                    Target = 'Records.DKIMSelectors'
+                    Remediation = 'Generate 2048-bit DKIM keys per platform and publish selectors.'
+                },
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    ExpectedValue = 1024
+                    Expectation = 'DKIM keys must be >=1024 bits (2048 preferred).'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMKeyStrength'
+                    Target = 'Records.DKIMMinKeyLength'
+                    Remediation = 'Rotate weak DKIM keys with 2048-bit RSA entries.'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    ExpectedValue = 0
+                    Expectation = 'Selectors should resolve cleanly without invalid/weak keys.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorHealth'
+                    Target = 'Records.DKIMWeakSelectors'
+                    Remediation = 'Repair or remove DKIM selectors flagged as invalid or <1024 bits.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 604800
+                    }
+                    Expectation = 'DKIM records should retain TTLs between 1 hour and 7 days.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'DKIM'
+                    Id = 'DKIMTtl'
+                    Target = 'Records.DKIMMinimumTtl'
+                    Remediation = 'Adjust selector TTLs to balance agility and cache stability.'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'A DMARC TXT record must be present at _dmarc.<domain>.'
+                    Remediation = 'Publish DMARC (v=DMARC1; p=quarantine/reject; rua=mailto:reports@domain).'
+                    Severity = 'Critical'
+                    Area = 'DMARC'
+                    Id = 'DMARCPresence'
+                    References = @(
+                        'RFC 7489',
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRecord'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        'quarantine',
+                        'reject'
+                    )
+                    Expectation = 'Active domains should enforce p=quarantine or p=reject.'
+                    Remediation = 'Tighten DMARC to quarantine/reject after monitoring aligned traffic.'
+                    Severity = 'High'
+                    Area = 'DMARC'
+                    Id = 'DMARCPolicyStrength'
+                    References = @(
+                        'RFC 7489',
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCPolicy'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'DMARC must include at least one RUA reporting address.'
+                    Remediation = 'Add rua=mailto:dmarc@domain to capture aggregate telemetry.'
+                    Severity = 'Medium'
+                    Area = 'DMARC'
+                    Id = 'DMARCRuaPresence'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRuaAddresses'
+                },
+                @{
+                    Condition = 'MustBeEmpty'
+                    Enforcement = 'Recommended'
+                    Expectation = 'Avoid RUF forensic feeds unless mandated; they add privacy/risk.'
+                    Remediation = 'Remove ruf= values unless the workflow explicitly requires forensic data.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCRufOmission'
+                    References = @(
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCRufAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'DMARC TTLs between 1 and 24 hours ease change control.'
+                    Remediation = 'Adjust DMARC TXT TTL accordingly.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCTtl'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCTtl'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        'reject'
+                    )
+                    Expectation = 'Parked domains should publish DMARC p=reject.'
+                    Remediation = 'Set DMARC policy to reject to block spoofing of unused space.'
+                    Severity = 'High'
+                    Area = 'DMARC'
+                    Id = 'DMARCPolicyParked'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCPolicy'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Expectation = 'Publish the _mta-sts TXT bootstrap record.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPresence'
+                    Target = 'Records.MTASTSRecordPresent'
+                    Remediation = 'Create the _mta-sts subdomain TXT pointing to the HTTPS policy file.'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    References = @(
+                        'RFC 8461'
+                    )
+                    Expectation = 'The HTTPS policy file should be reachable and parseable.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPolicyValid'
+                    Target = 'Records.MTASTSPolicyValid'
+                    Remediation = 'Verify policy hosting, TLS certificate, and JSON syntax for the MTA-STS policy file.'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    ExpectedValue = 'enforce'
+                    Expectation = 'Operate MTA-STS in enforce mode (not testing) once vetted.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSMode'
+                    Target = 'Records.MTASTSMode'
+                    Remediation = 'Update the policy file mode to enforce after validating delivery.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'M3AAWG TLS Guidance'
+                    )
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'MTA-STS TXT TTL should be 1-7 days.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSTtl'
+                    Target = 'Records.MTASTSTtl'
+                    Remediation = 'Adjust the TXT TTL to balance agility and cache efficiency.'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Expectation = 'Publish _smtp._tls TXT for TLS Reporting.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTPresence'
+                    Target = 'Records.TLSRPTRecordPresent'
+                    Remediation = 'Create v=TLSRPTv1; rua=mailto:tls@domain at _smtp._tls.'
+                },
+                @{
+                    Condition = 'MustExist'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Expectation = 'At least one reporting mailbox should be defined.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTAddresses'
+                    Target = 'Records.TLSRPTAddresses'
+                    Remediation = 'Add rua mailbox destinations to the TLS-RPT record.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'TLS-RPT TXT TTL should be 1-7 days.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTTtl'
+                    Target = 'Records.TLSRPTTtl'
+                    Remediation = 'Adjust TTL for TLS-RPT to improve manageability.'
+                }
+            )
+            Name = 'Parked'
+        }
+        ReceivingOnly = @{
+            Description = 'Domains that accept inbound mail but are not expected to send.'
+            Checks = @(
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 1
+                    Expectation = 'Inbound-capable domains must publish MX records.'
+                    Remediation = 'Publish MX records pointing to the organization''s inbound infrastructure.'
+                    Severity = 'Critical'
+                    Area = 'MX'
+                    Id = 'MXPresence'
+                    References = @(
+                        'RFC 5321 section 5',
+                        'M3AAWG Operational Guidance'
+                    )
+                    Target = 'Records.MXRecordCount'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'MX TTLs between 1 and 24 hours aid change control.'
+                    Remediation = 'Adjust MX TTL to fall within the recommended range.'
+                    Severity = 'Low'
+                    Area = 'MX'
+                    Id = 'MXTtl'
+                    References = @(
+                        'M3AAWG Operational Guidance'
+                    )
+                    Target = 'Records.MXMinimumTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    References = @(
+                        'RFC 7208',
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Expectation = 'Publish an SPF TXT record to define authorized senders.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Critical'
+                    Area = 'SPF'
+                    Id = 'SPFPresence'
+                    Target = 'Records.SPFRecord'
+                    Remediation = 'Create a single SPF record (v=spf1 ...) for the domain and manage changes centrally.'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    References = @(
+                        'RFC 7208 section 3.1'
+                    )
+                    ExpectedValue = '1'
+                    Expectation = 'Only one SPF record should exist per RFC 7208.'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFRecordMultiplicity'
+                    Target = 'Records.SPFRecordCount'
+                    Remediation = 'Consolidate multiple SPF TXT records into a single entry.'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    References = @(
+                        'RFC 7208 section 4.6.4'
+                    )
+                    ExpectedValue = 10
+                    Expectation = 'SPF processing must stay within the 10 DNS lookup ceiling.'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFLookupLimit'
+                    Target = 'Records.SPFLookupCount'
+                    Remediation = 'Reduce includes/redirects by flattening or delegating per RFC 7208 section 4.6.4.'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    ExpectedValue = @(
+                        '-all',
+                        '~all'
+                    )
+                    Expectation = 'SPF should conclude with -all or ~all to provide deterministic policy enforcement.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFTerminalMechanism'
+                    Target = 'Records.SPFTerminalMechanism'
+                    Remediation = 'Update the SPF record terminal mechanism to -all after validating authorized senders (or ~all during phased rollout).'
+                },
+                @{
+                    Condition = 'MustBeFalse'
+                    References = @(
+                        'RFC 7208 section 5.7'
+                    )
+                    Expectation = 'Avoid unsafe mechanisms such as ptr per RFC 7208 guidance.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFUnsafeMechanisms'
+                    Target = 'Records.SPFHasPtrMechanism'
+                    Remediation = 'Remove ptr or other deprecated mechanisms to prevent unpredictable resolution chains.'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    References = @(
+                        'RFC 7208 section 3.2'
+                    )
+                    ExpectedValue = 255
+                    Expectation = 'Keep SPF strings within 255 characters to avoid DNS truncation.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFRecordLength'
+                    Target = 'Records.SPFRecordLength'
+                    Remediation = 'Shorten mechanisms/includes or break records into multiple quoted strings.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'SPF TTL should balance agility with cache efficiency (1-24 hours).'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'SPF'
+                    Id = 'SPFTtl'
+                    Target = 'Records.SPFTtl'
+                    Remediation = 'Adjust TXT record TTL to between 3600 and 86400 seconds.'
+                },
+                @{
+                    Condition = 'MustExist'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Expectation = 'At least one DKIM selector should exist for active senders.'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorPresence'
+                    Target = 'Records.DKIMSelectors'
+                    Remediation = 'Generate 2048-bit DKIM keys per platform and publish selectors.'
+                },
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    ExpectedValue = 1024
+                    Expectation = 'DKIM keys must be >=1024 bits (2048 preferred).'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMKeyStrength'
+                    Target = 'Records.DKIMMinKeyLength'
+                    Remediation = 'Rotate weak DKIM keys with 2048-bit RSA entries.'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    ExpectedValue = 0
+                    Expectation = 'Selectors should resolve cleanly without invalid/weak keys.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorHealth'
+                    Target = 'Records.DKIMWeakSelectors'
+                    Remediation = 'Repair or remove DKIM selectors flagged as invalid or <1024 bits.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 604800
+                    }
+                    Expectation = 'DKIM records should retain TTLs between 1 hour and 7 days.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'DKIM'
+                    Id = 'DKIMTtl'
+                    Target = 'Records.DKIMMinimumTtl'
+                    Remediation = 'Adjust selector TTLs to balance agility and cache stability.'
+                },
+                @{
+                    Condition = 'MustExist'
+                    References = @(
+                        'RFC 7489',
+                        'dmarc.org Deployment Guide'
+                    )
+                    Expectation = 'A DMARC TXT record must be present at _dmarc.<domain>.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Critical'
+                    Area = 'DMARC'
+                    Id = 'DMARCPresence'
+                    Target = 'Records.DMARCRecord'
+                    Remediation = 'Publish DMARC (v=DMARC1; p=quarantine/reject; rua=mailto:reports@domain).'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    References = @(
+                        'RFC 7489',
+                        'M3AAWG DMARC Deployment'
+                    )
+                    ExpectedValue = @(
+                        'quarantine',
+                        'reject'
+                    )
+                    Expectation = 'Active domains should enforce p=quarantine or p=reject.'
+                    Enforcement = 'Recommended'
+                    Severity = 'High'
+                    Area = 'DMARC'
+                    Id = 'DMARCPolicyStrength'
+                    Target = 'Records.DMARCPolicy'
+                    Remediation = 'Tighten DMARC to quarantine/reject after monitoring aligned traffic.'
+                },
+                @{
+                    Condition = 'MustExist'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Expectation = 'DMARC must include at least one RUA reporting address.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Medium'
+                    Area = 'DMARC'
+                    Id = 'DMARCRuaPresence'
+                    Target = 'Records.DMARCRuaAddresses'
+                    Remediation = 'Add rua=mailto:dmarc@domain to capture aggregate telemetry.'
+                },
+                @{
+                    Condition = 'MustBeEmpty'
+                    References = @(
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Expectation = 'Avoid RUF forensic feeds unless mandated; they add privacy/risk.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCRufOmission'
+                    Target = 'Records.DMARCRufAddresses'
+                    Remediation = 'Remove ruf= values unless the workflow explicitly requires forensic data.'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'DMARC TTLs between 1 and 24 hours ease change control.'
+                    Enforcement = 'Recommended'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCTtl'
+                    Target = 'Records.DMARCTtl'
+                    Remediation = 'Adjust DMARC TXT TTL accordingly.'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish the _mta-sts TXT bootstrap record.'
+                    Remediation = 'Create the _mta-sts subdomain TXT pointing to the HTTPS policy file.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPresence'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSRecordPresent'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'The HTTPS policy file should be reachable and parseable.'
+                    Remediation = 'Verify policy hosting, TLS certificate, and JSON syntax for the MTA-STS policy file.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPolicyValid'
+                    References = @(
+                        'RFC 8461'
+                    )
+                    Target = 'Records.MTASTSPolicyValid'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 'enforce'
+                    Expectation = 'Operate MTA-STS in enforce mode (not testing) once vetted.'
+                    Remediation = 'Update the policy file mode to enforce after validating delivery.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSMode'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSMode'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'MTA-STS TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust the TXT TTL to balance agility and cache efficiency.'
+                    Severity = 'Low'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSTtl'
+                    References = @(
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSTtl'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish _smtp._tls TXT for TLS Reporting.'
+                    Remediation = 'Create v=TLSRPTv1; rua=mailto:tls@domain at _smtp._tls.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTPresence'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTRecordPresent'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'At least one reporting mailbox should be defined.'
+                    Remediation = 'Add rua mailbox destinations to the TLS-RPT record.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTAddresses'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'TLS-RPT TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust TTL for TLS-RPT to improve manageability.'
+                    Severity = 'Low'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTTtl'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTTtl'
+                }
+            )
+            Name = 'Receiving Only'
+        }
+        Default = @{
+            Description = 'Fallback profile when classification cannot be determined.'
+            Checks = @(
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish an SPF TXT record to define authorized senders.'
+                    Remediation = 'Create a single SPF record (v=spf1 ...) for the domain and manage changes centrally.'
+                    Severity = 'Critical'
+                    Area = 'SPF'
+                    Id = 'SPFPresence'
+                    References = @(
+                        'RFC 7208',
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFRecord'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = '1'
+                    Expectation = 'Only one SPF record should exist per RFC 7208.'
+                    Remediation = 'Consolidate multiple SPF TXT records into a single entry.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFRecordMultiplicity'
+                    References = @(
+                        'RFC 7208 section 3.1'
+                    )
+                    Target = 'Records.SPFRecordCount'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 10
+                    Expectation = 'SPF processing must stay within the 10 DNS lookup ceiling.'
+                    Remediation = 'Reduce includes/redirects by flattening or delegating per RFC 7208 section 4.6.4.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFLookupLimit'
+                    References = @(
+                        'RFC 7208 section 4.6.4'
+                    )
+                    Target = 'Records.SPFLookupCount'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        '-all',
+                        '~all'
+                    )
+                    Expectation = 'SPF should conclude with -all or ~all to provide deterministic policy enforcement.'
+                    Remediation = 'Update the SPF record terminal mechanism to -all after validating authorized senders (or ~all during phased rollout).'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFTerminalMechanism'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTerminalMechanism'
+                },
+                @{
+                    Condition = 'MustBeFalse'
+                    Enforcement = 'Required'
+                    Expectation = 'Avoid unsafe mechanisms such as ptr per RFC 7208 guidance.'
+                    Remediation = 'Remove ptr or other deprecated mechanisms to prevent unpredictable resolution chains.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFUnsafeMechanisms'
+                    References = @(
+                        'RFC 7208 section 5.7'
+                    )
+                    Target = 'Records.SPFHasPtrMechanism'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = 255
+                    Expectation = 'Keep SPF strings within 255 characters to avoid DNS truncation.'
+                    Remediation = 'Shorten mechanisms/includes or break records into multiple quoted strings.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFRecordLength'
+                    References = @(
+                        'RFC 7208 section 3.2'
+                    )
+                    Target = 'Records.SPFRecordLength'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'SPF TTL should balance agility with cache efficiency (1-24 hours).'
+                    Remediation = 'Adjust TXT record TTL to between 3600 and 86400 seconds.'
+                    Severity = 'Low'
+                    Area = 'SPF'
+                    Id = 'SPFTtl'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'A DMARC TXT record must be present at _dmarc.<domain>.'
+                    Remediation = 'Publish DMARC (v=DMARC1; p=quarantine/reject; rua=mailto:reports@domain).'
+                    Severity = 'Critical'
+                    Area = 'DMARC'
+                    Id = 'DMARCPresence'
+                    References = @(
+                        'RFC 7489',
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRecord'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        'quarantine',
+                        'reject'
+                    )
+                    Expectation = 'Active domains should enforce p=quarantine or p=reject.'
+                    Remediation = 'Tighten DMARC to quarantine/reject after monitoring aligned traffic.'
+                    Severity = 'High'
+                    Area = 'DMARC'
+                    Id = 'DMARCPolicyStrength'
+                    References = @(
+                        'RFC 7489',
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCPolicy'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'DMARC must include at least one RUA reporting address.'
+                    Remediation = 'Add rua=mailto:dmarc@domain to capture aggregate telemetry.'
+                    Severity = 'Medium'
+                    Area = 'DMARC'
+                    Id = 'DMARCRuaPresence'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRuaAddresses'
+                },
+                @{
+                    Condition = 'MustBeEmpty'
+                    Enforcement = 'Recommended'
+                    Expectation = 'Avoid RUF forensic feeds unless mandated; they add privacy/risk.'
+                    Remediation = 'Remove ruf= values unless the workflow explicitly requires forensic data.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCRufOmission'
+                    References = @(
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCRufAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'DMARC TTLs between 1 and 24 hours ease change control.'
+                    Remediation = 'Adjust DMARC TXT TTL accordingly.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCTtl'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCTtl'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish _smtp._tls TXT for TLS Reporting.'
+                    Remediation = 'Create v=TLSRPTv1; rua=mailto:tls@domain at _smtp._tls.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTPresence'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTRecordPresent'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'At least one reporting mailbox should be defined.'
+                    Remediation = 'Add rua mailbox destinations to the TLS-RPT record.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTAddresses'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'TLS-RPT TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust TTL for TLS-RPT to improve manageability.'
+                    Severity = 'Low'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTTtl'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTTtl'
+                }
+            )
+            Name = 'Default'
+        }
+        SendingAndReceiving = @{
+            Description = 'Domains that both send and receive messages.'
+            Checks = @(
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 1
+                    Expectation = 'Inbound-capable domains must publish MX records.'
+                    Remediation = 'Publish MX records pointing to the organization''s inbound infrastructure.'
+                    Severity = 'Critical'
+                    Area = 'MX'
+                    Id = 'MXPresence'
+                    References = @(
+                        'RFC 5321 section 5',
+                        'M3AAWG Operational Guidance'
+                    )
+                    Target = 'Records.MXRecordCount'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'MX TTLs between 1 and 24 hours aid change control.'
+                    Remediation = 'Adjust MX TTL to fall within the recommended range.'
+                    Severity = 'Low'
+                    Area = 'MX'
+                    Id = 'MXTtl'
+                    References = @(
+                        'M3AAWG Operational Guidance'
+                    )
+                    Target = 'Records.MXMinimumTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish an SPF TXT record to define authorized senders.'
+                    Remediation = 'Create a single SPF record (v=spf1 ...) for the domain and manage changes centrally.'
+                    Severity = 'Critical'
+                    Area = 'SPF'
+                    Id = 'SPFPresence'
+                    References = @(
+                        'RFC 7208',
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFRecord'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = '1'
+                    Expectation = 'Only one SPF record should exist per RFC 7208.'
+                    Remediation = 'Consolidate multiple SPF TXT records into a single entry.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFRecordMultiplicity'
+                    References = @(
+                        'RFC 7208 section 3.1'
+                    )
+                    Target = 'Records.SPFRecordCount'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 10
+                    Expectation = 'SPF processing must stay within the 10 DNS lookup ceiling.'
+                    Remediation = 'Reduce includes/redirects by flattening or delegating per RFC 7208 section 4.6.4.'
+                    Severity = 'High'
+                    Area = 'SPF'
+                    Id = 'SPFLookupLimit'
+                    References = @(
+                        'RFC 7208 section 4.6.4'
+                    )
+                    Target = 'Records.SPFLookupCount'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        '-all',
+                        '~all'
+                    )
+                    Expectation = 'SPF should conclude with -all or ~all to provide deterministic policy enforcement.'
+                    Remediation = 'Update the SPF record terminal mechanism to -all after validating authorized senders (or ~all during phased rollout).'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFTerminalMechanism'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTerminalMechanism'
+                },
+                @{
+                    Condition = 'MustBeFalse'
+                    Enforcement = 'Required'
+                    Expectation = 'Avoid unsafe mechanisms such as ptr per RFC 7208 guidance.'
+                    Remediation = 'Remove ptr or other deprecated mechanisms to prevent unpredictable resolution chains.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFUnsafeMechanisms'
+                    References = @(
+                        'RFC 7208 section 5.7'
+                    )
+                    Target = 'Records.SPFHasPtrMechanism'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = 255
+                    Expectation = 'Keep SPF strings within 255 characters to avoid DNS truncation.'
+                    Remediation = 'Shorten mechanisms/includes or break records into multiple quoted strings.'
+                    Severity = 'Medium'
+                    Area = 'SPF'
+                    Id = 'SPFRecordLength'
+                    References = @(
+                        'RFC 7208 section 3.2'
+                    )
+                    Target = 'Records.SPFRecordLength'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'SPF TTL should balance agility with cache efficiency (1-24 hours).'
+                    Remediation = 'Adjust TXT record TTL to between 3600 and 86400 seconds.'
+                    Severity = 'Low'
+                    Area = 'SPF'
+                    Id = 'SPFTtl'
+                    References = @(
+                        'M3AAWG Email Authentication Best Practices'
+                    )
+                    Target = 'Records.SPFTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'At least one DKIM selector should exist for active senders.'
+                    Remediation = 'Generate 2048-bit DKIM keys per platform and publish selectors.'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorPresence'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMSelectors'
+                },
+                @{
+                    Condition = 'GreaterThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 1024
+                    Expectation = 'DKIM keys must be >=1024 bits (2048 preferred).'
+                    Remediation = 'Rotate weak DKIM keys with 2048-bit RSA entries.'
+                    Severity = 'High'
+                    Area = 'DKIM'
+                    Id = 'DKIMKeyStrength'
+                    References = @(
+                        'RFC 6376',
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMMinKeyLength'
+                },
+                @{
+                    Condition = 'LessThanOrEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 0
+                    Expectation = 'Selectors should resolve cleanly without invalid/weak keys.'
+                    Remediation = 'Repair or remove DKIM selectors flagged as invalid or <1024 bits.'
+                    Severity = 'Medium'
+                    Area = 'DKIM'
+                    Id = 'DKIMSelectorHealth'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMWeakSelectors'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 604800
+                    }
+                    Expectation = 'DKIM records should retain TTLs between 1 hour and 7 days.'
+                    Remediation = 'Adjust selector TTLs to balance agility and cache stability.'
+                    Severity = 'Low'
+                    Area = 'DKIM'
+                    Id = 'DKIMTtl'
+                    References = @(
+                        'M3AAWG DKIM Deployment Guide'
+                    )
+                    Target = 'Records.DKIMMinimumTtl'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'A DMARC TXT record must be present at _dmarc.<domain>.'
+                    Remediation = 'Publish DMARC (v=DMARC1; p=quarantine/reject; rua=mailto:reports@domain).'
+                    Severity = 'Critical'
+                    Area = 'DMARC'
+                    Id = 'DMARCPresence'
+                    References = @(
+                        'RFC 7489',
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRecord'
+                },
+                @{
+                    Condition = 'MustBeOneOf'
+                    Enforcement = 'Required'
+                    ExpectedValue = @(
+                        'quarantine',
+                        'reject'
+                    )
+                    Expectation = 'Active domains should enforce p=quarantine or p=reject.'
+                    Remediation = 'Tighten DMARC to quarantine/reject after monitoring aligned traffic.'
+                    Severity = 'High'
+                    Area = 'DMARC'
+                    Id = 'DMARCPolicyStrength'
+                    References = @(
+                        'RFC 7489',
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCPolicy'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'DMARC must include at least one RUA reporting address.'
+                    Remediation = 'Add rua=mailto:dmarc@domain to capture aggregate telemetry.'
+                    Severity = 'Medium'
+                    Area = 'DMARC'
+                    Id = 'DMARCRuaPresence'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCRuaAddresses'
+                },
+                @{
+                    Condition = 'MustBeEmpty'
+                    Enforcement = 'Recommended'
+                    Expectation = 'Avoid RUF forensic feeds unless mandated; they add privacy/risk.'
+                    Remediation = 'Remove ruf= values unless the workflow explicitly requires forensic data.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCRufOmission'
+                    References = @(
+                        'M3AAWG DMARC Deployment'
+                    )
+                    Target = 'Records.DMARCRufAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 3600
+                        Max = 86400
+                    }
+                    Expectation = 'DMARC TTLs between 1 and 24 hours ease change control.'
+                    Remediation = 'Adjust DMARC TXT TTL accordingly.'
+                    Severity = 'Low'
+                    Area = 'DMARC'
+                    Id = 'DMARCTtl'
+                    References = @(
+                        'dmarc.org Deployment Guide'
+                    )
+                    Target = 'Records.DMARCTtl'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish the _mta-sts TXT bootstrap record.'
+                    Remediation = 'Create the _mta-sts subdomain TXT pointing to the HTTPS policy file.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPresence'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSRecordPresent'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'The HTTPS policy file should be reachable and parseable.'
+                    Remediation = 'Verify policy hosting, TLS certificate, and JSON syntax for the MTA-STS policy file.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSPolicyValid'
+                    References = @(
+                        'RFC 8461'
+                    )
+                    Target = 'Records.MTASTSPolicyValid'
+                },
+                @{
+                    Condition = 'MustEqual'
+                    Enforcement = 'Required'
+                    ExpectedValue = 'enforce'
+                    Expectation = 'Operate MTA-STS in enforce mode (not testing) once vetted.'
+                    Remediation = 'Update the policy file mode to enforce after validating delivery.'
+                    Severity = 'Medium'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSMode'
+                    References = @(
+                        'RFC 8461',
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSMode'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'MTA-STS TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust the TXT TTL to balance agility and cache efficiency.'
+                    Severity = 'Low'
+                    Area = 'MTA-STS'
+                    Id = 'MTASTSTtl'
+                    References = @(
+                        'M3AAWG TLS Guidance'
+                    )
+                    Target = 'Records.MTASTSTtl'
+                },
+                @{
+                    Condition = 'MustBeTrue'
+                    Enforcement = 'Required'
+                    Expectation = 'Publish _smtp._tls TXT for TLS Reporting.'
+                    Remediation = 'Create v=TLSRPTv1; rua=mailto:tls@domain at _smtp._tls.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTPresence'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTRecordPresent'
+                },
+                @{
+                    Condition = 'MustExist'
+                    Enforcement = 'Required'
+                    Expectation = 'At least one reporting mailbox should be defined.'
+                    Remediation = 'Add rua mailbox destinations to the TLS-RPT record.'
+                    Severity = 'Medium'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTAddresses'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTAddresses'
+                },
+                @{
+                    Condition = 'BetweenInclusive'
+                    Enforcement = 'Recommended'
+                    ExpectedValue = @{
+                        Min = 86400
+                        Max = 604800
+                    }
+                    Expectation = 'TLS-RPT TXT TTL should be 1-7 days.'
+                    Remediation = 'Adjust TTL for TLS-RPT to improve manageability.'
+                    Severity = 'Low'
+                    Area = 'TLS-RPT'
+                    Id = 'TLSRPTTtl'
+                    References = @(
+                        'RFC 8460'
+                    )
+                    Target = 'Records.TLSRPTTtl'
+                }
+            )
+            Name = 'Sending and Receiving'
+        }
+    }
+}
diff --git a/Configs/ReferenceLinks.psd1 b/Configs/ReferenceLinks.psd1
new file mode 100644
index 0000000..2de659c
--- /dev/null
+++ b/Configs/ReferenceLinks.psd1
@@ -0,0 +1,8 @@
+@{
+    'dmarc.org Deployment Guide'              = 'https://dmarc.org/resources/deployment/'
+    'M3AAWG Email Authentication Best Practices' = 'https://www.m3aawg.org/published-documents/m3aawg-email-authentication-best-practices'
+    'M3AAWG DKIM Deployment Guide'            = 'https://www.m3aawg.org/published-documents/m3aawg-dkim-deployment-document'
+    'M3AAWG DMARC Deployment'                 = 'https://www.m3aawg.org/published-documents/m3aawg-dmarc-deployment'
+    'M3AAWG TLS Guidance'                     = 'https://www.m3aawg.org/published-documents/m3aawg-tls-best-practices'
+    'M3AAWG Operational Guidance'             = 'https://www.m3aawg.org/published-documents'
+}
diff --git a/DomainSecurityAuditor.psd1 b/DomainSecurityAuditor.psd1
new file mode 100644
index 0000000..15f555e
--- /dev/null
+++ b/DomainSecurityAuditor.psd1
@@ -0,0 +1,43 @@
+@{
+    RootModule        = 'DomainSecurityAuditor.psm1'
+    ModuleVersion     = '0.2.0'
+    GUID              = 'a5c3892b-1b29-4050-9dac-11a5d737da38'
+    Author            = 'Travis McDade'
+    CompanyName       = 'DomainSecurityAuditor'
+    Copyright         = '(c) 2025 DomainSecurityAuditor. All rights reserved.'
+    Description       = 'PowerShell module for auditing domain and email security baselines via DomainDetective, Pester, and native HTML rendering.'
+    PowerShellVersion = '7.0'
+    CompatiblePSEditions = @('Core')
+    RequiredModules   = @(
+        'DomainDetective'
+        'Pester'
+        'PSScriptAnalyzer'
+    )
+    FunctionsToExport = @(
+        'Invoke-DomainSecurityAuditor',
+        'Get-DSABaselineProfile',
+        'New-DSABaselineProfile',
+        'Test-DSABaselineProfile'
+    )
+    CmdletsToExport   = @()
+    VariablesToExport = @()
+    AliasesToExport   = @()
+    FileList          = @(
+        'DomainSecurityAuditor.psm1',
+        'DomainSecurityAuditor.psd1',
+        'Configs/ReferenceLinks.psd1'
+    )
+    PrivateData       = @{
+        PSData = @{
+            Tags         = @('Domain', 'Security', 'Compliance', 'Pester', 'Reporting')
+            LicenseUri   = 'https://www.apache.org/licenses/LICENSE-2.0'
+            ProjectUri   = 'https://github.com/thetechgy/DomainSecurityAuditor'
+            ReleaseNotes = @'
+0.2.0 - 2025-11-22 - BREAKING: Rename entry point to Invoke-DomainSecurityAuditor; align report title/filenames to Domain Security Auditor with timestamp appended after the report name.
+0.1.2 - 2025-11-21 - BREAKING: Default output now writes a summary; add -PassThru; capture DomainDetective warnings.
+0.1.1 - 2025-11-20 - Add CSV and CLI classification overrides with validation.
+0.1.0 - 2025-11-16 - Initial scaffolding of module structure and public entry point stub.
+'@
+        }
+    }
+}
diff --git a/DomainSecurityAuditor.psm1 b/DomainSecurityAuditor.psm1
new file mode 100644
index 0000000..48ac1ae
--- /dev/null
+++ b/DomainSecurityAuditor.psm1
@@ -0,0 +1,75 @@
+<#
+.SYNOPSIS
+    Domain Security Auditor module orchestrates domain and email security baseline validation.
+.DESCRIPTION
+    DomainSecurityAuditor builds on DomainDetective and Pester with native PowerShell HTML rendering to collect DNS posture data, execute repeatable compliance tests, and emit machine-readable artifacts for CI/CD pipelines.
+.REQUIRES
+    Modules: DomainDetective, Pester, PSScriptAnalyzer
+.NOTES
+    Module: DomainSecurityAuditor
+    Author: Travis McDade
+    Date: 11/16/2025
+    Version: 0.2.0
+    Requestor: DomainSecurityAuditor Stakeholders
+    Purpose: Provide a structured baseline for automated domain and email security evidence collection.
+
+Release Notes:
+      0.2.0 - 11/22/2025 - BREAKING: Rename entry point to Invoke-DomainSecurityAuditor and align report naming (timestamp after report name).
+      0.1.2 - 11/21/2025 - BREAKING: Default output writes summary by default; add -PassThru; capture DomainDetective warnings.
+      0.1.1 - 11/20/2025 - Added CSV and CLI classification overrides with validation.
+      0.1.0 - 11/16/2025 - Initial scaffolding with dependency enforcement and entry-point stub.
+
+Resources:
+      - https://github.com/EvotecIT/DomainDetective
+      - https://github.com/pester/Pester
+#>
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+#region ModuleInitialization
+$script:ModuleRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
+$script:ConfigRoot = Join-Path -Path $script:ModuleRoot -ChildPath 'Configs'
+$script:DSAMinDkimKeyLength = 1024
+$script:DSAConditionDefinitions = $null
+$script:DSADomainDetectiveLoaded = $false
+$script:DSAKnownReferenceLinks = @{}
+#endregion ModuleInitialization
+
+#region PrivateHelpers
+$privatePath = Join-Path -Path $script:ModuleRoot -ChildPath 'Private'
+if (Test-Path -Path $privatePath) {
+    $privateFiles = @(Get-ChildItem -Path $privatePath -Filter '*.ps1' -File | Sort-Object -Property Name)
+    $valueHelpers = @($privateFiles | Where-Object { $_.BaseName -eq 'DSA.ValueHelpers' })
+    $remaining = @($privateFiles | Where-Object { $_.BaseName -ne 'DSA.ValueHelpers' })
+
+    foreach ($file in $valueHelpers + $remaining) {
+        . $file.FullName
+    }
+}
+
+# Pre-warm condition definitions cache to avoid lazy initialization overhead during first domain run.
+$null = Get-DSAConditionDefinitions
+#endregion PrivateHelpers
+
+#region PublicFunctions
+$publicPath = Join-Path -Path $script:ModuleRoot -ChildPath 'Public'
+$publicFunctions = @()
+if (Test-Path -Path $publicPath) {
+    $publicFunctions = @(
+        Get-ChildItem -Path $publicPath -Filter '*.ps1' -File |
+            Sort-Object -Property Name |
+            ForEach-Object {
+                . $_.FullName
+                $_.BaseName
+            }
+    )
+}
+
+if ($publicFunctions.Count -gt 0) {
+    Export-ModuleMember -Function $publicFunctions
+}
+else {
+    Export-ModuleMember -Function @()
+}
+#endregion PublicFunctions
diff --git a/Examples/Invoke-DomainSecurityAuditor.ps1 b/Examples/Invoke-DomainSecurityAuditor.ps1
new file mode 100644
index 0000000..55529a5
--- /dev/null
+++ b/Examples/Invoke-DomainSecurityAuditor.ps1
@@ -0,0 +1,11 @@
+#requires -Version 7.0
+
+#region ModuleImport
+$moduleManifest = Join-Path -Path $PSScriptRoot -ChildPath '..\DomainSecurityAuditor.psd1'
+Import-Module -Name (Resolve-Path -Path $moduleManifest) -Force
+#endregion ModuleImport
+
+#region Execution
+Invoke-DomainSecurityAuditor -Domain 'example.com'
+#endregion Execution
+
diff --git a/Examples/domain_compliance_report.html b/Examples/domain_security_auditor_report.html
similarity index 86%
rename from Examples/domain_compliance_report.html
rename to Examples/domain_security_auditor_report.html
index 0b3bb1d..28993ea 100644
--- a/Examples/domain_compliance_report.html
+++ b/Examples/domain_security_auditor_report.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Domain Security Compliance Report</title>
+    <title>Domain Security Auditor Report</title>
     <style>
         * {
             margin: 0;
@@ -50,6 +50,66 @@
             margin-bottom: 30px;
         }
 
+        .report-actions {
+            display: flex;
+            align-items: center;
+            justify-content: flex-end;
+            gap: 10px;
+            margin: 0 0 16px;
+        }
+
+        .action-button {
+            padding: 8px 12px;
+            background: white;
+            color: #1e3a8a;
+            border: 1px solid #e5e7eb;
+            border-radius: 10px;
+            font-weight: 700;
+            cursor: pointer;
+            box-shadow: 0 1px 4px rgba(0,0,0,0.06);
+            transition: transform 0.2s ease, box-shadow 0.2s ease, background-color 0.2s ease;
+        }
+
+        .action-button:hover {
+            transform: translateY(-1px);
+            box-shadow: 0 2px 8px rgba(0,0,0,0.08);
+            background: #f3f4f6;
+        }
+
+        .action-button[aria-pressed="true"] {
+            background: #e0e7ff;
+            color: #1e3a8a;
+            border-color: #c7d2fe;
+            box-shadow: 0 0 0 2px rgba(37, 99, 235, 0.2);
+        }
+
+        .back-to-top-wrapper {
+            display: flex;
+            justify-content: flex-end;
+            margin-top: 16px;
+        }
+
+        .back-to-top {
+            display: inline-flex;
+            align-items: center;
+            gap: 8px;
+            padding: 8px 12px;
+            background: white;
+            border: 1px solid #e5e7eb;
+            border-radius: 10px;
+            color: #1e3a8a;
+            font-weight: 700;
+            text-decoration: none;
+            box-shadow: 0 1px 4px rgba(0,0,0,0.06);
+            transition: background-color 0.2s ease, transform 0.2s ease, box-shadow 0.2s ease;
+        }
+
+        .back-to-top:hover {
+            background: #f3f4f6;
+            transform: translateY(-1px);
+            box-shadow: 0 2px 8px rgba(0,0,0,0.08);
+        }
+
         .card {
             background: white;
             padding: 25px;
@@ -371,7 +431,7 @@
     <div class="container">
         <!-- Header -->
         <div class="header">
-            <h1>Domain Security Compliance Report</h1>
+            <h1>Domain Security Auditor Report</h1>
             <div class="meta">
                 Generated on: September 4, 2025, 2:30 PM EDT<br>
                 Framework Version: 1.0.0 | Test Suite: Baseline Email Security v1.2
@@ -417,6 +477,11 @@ <h1>Domain Security Compliance Report</h1>
             </div>
         </div>
 
+        <!-- Report Controls -->
+        <div class="report-actions">
+            <button type="button" class="action-button" id="toggle-all-sections" aria-pressed="false">Expand all sections</button>
+        </div>
+
         <!-- Domain Results -->
         <div class="domain-results">
             <div class="domain-header">
@@ -767,34 +832,86 @@ <h1>Domain Security Compliance Report</h1>
                 Test data gathered: September 4, 2025 | Report generated: September 4, 2025, 2:30 PM EDT
             </p>
         </div>
+
+        <div class="back-to-top-wrapper">
+            <a class="back-to-top" href="#main-content" aria-label="Back to the top of the report">↑ Back to top</a>
+        </div>
     </div>
 
     <script>
-        function toggleSection(sectionId) {
+        const setSectionState = (sectionId, expanded) => {
             const details = document.getElementById(sectionId);
             const chevron = document.getElementById('chevron-' + sectionId);
-            
-            if (details.classList.contains('expanded')) {
-                details.classList.remove('expanded');
-                chevron.classList.remove('expanded');
-            } else {
-                details.classList.add('expanded');
-                chevron.classList.add('expanded');
+            if (!details) {
+                return;
+            }
+            details.classList.toggle('expanded', expanded);
+            if (chevron) {
+                chevron.classList.toggle('expanded', expanded);
             }
+        };
+
+        const syncGlobalToggle = () => {
+            const toggleButton = document.getElementById('toggle-all-sections');
+            if (!toggleButton) {
+                return;
+            }
+            const sections = Array.from(document.querySelectorAll('.protocol-details'));
+            const allExpanded = sections.length > 0 && sections.every(section => section.classList.contains('expanded'));
+            toggleButton.textContent = allExpanded ? 'Collapse all sections' : 'Expand all sections';
+            toggleButton.setAttribute('aria-pressed', allExpanded ? 'true' : 'false');
+        };
+
+        function toggleSection(sectionId) {
+            const details = document.getElementById(sectionId);
+            if (!details) {
+                return;
+            }
+            const shouldExpand = !details.classList.contains('expanded');
+            setSectionState(sectionId, shouldExpand);
+            syncGlobalToggle();
         }
 
-        // Auto-expand failed sections
-        document.addEventListener('DOMContentLoaded', function() {
-            // Auto-expand any section with failed tests
+        const setAllSections = (expanded) => {
+            document.querySelectorAll('.protocol-details').forEach(section => {
+                if (!section.id) {
+                    return;
+                }
+                setSectionState(section.id, expanded);
+            });
+            syncGlobalToggle();
+        };
+
+        const initializeFailedSections = () => {
             const failedSections = document.querySelectorAll('.protocol-status .status-badge.failed');
             failedSections.forEach(function(badge) {
                 const protocolHeader = badge.closest('.protocol-header');
-                if (protocolHeader) {
-                    const sectionId = protocolHeader.getAttribute('onclick').match(/'([^']+)'/)[1];
-                    toggleSection(sectionId);
+                if (!protocolHeader) {
+                    return;
+                }
+                const onclickValue = protocolHeader.getAttribute('onclick');
+                if (!onclickValue) {
+                    return;
+                }
+                const match = onclickValue.match(/'([^']+)'/);
+                if (match && match[1]) {
+                    setSectionState(match[1], true);
                 }
             });
+        };
+
+        document.addEventListener('DOMContentLoaded', function() {
+            const toggleAllButton = document.getElementById('toggle-all-sections');
+            initializeFailedSections();
+            if (toggleAllButton) {
+                toggleAllButton.addEventListener('click', function() {
+                    const sections = Array.from(document.querySelectorAll('.protocol-details'));
+                    const allExpanded = sections.length > 0 && sections.every(section => section.classList.contains('expanded'));
+                    setAllSections(!allExpanded);
+                });
+            }
+            syncGlobalToggle();
         });
     </script>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/Logs/.gitkeep b/Logs/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/Output/.gitkeep b/Output/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/PSScriptAnalyzerSettings.psd1 b/PSScriptAnalyzerSettings.psd1
index 9d7a3b6..ba2d17b 100644
--- a/PSScriptAnalyzerSettings.psd1
+++ b/PSScriptAnalyzerSettings.psd1
@@ -1,78 +1,82 @@
 @{
-  Severity         = @('Error', 'Warning', 'Information')
+    Severity = @('Error', 'Warning', 'Information')
+    ExcludeRules = @(
+        'PSReviewUnusedParameter'
+        'PSUseShouldProcessForStateChangingFunctions'
+        'PSUseSingularNouns'
+        # AvoidReservedCharInCmdlet throws NullReferenceException against the module's dynamic export pattern on PSScriptAnalyzer 1.24.0.
+        'AvoidReservedCharInCmdlet'
+    )
 
-  # Default rules stay enabled; the Rules block below tweaks the ones that matter most to DSA.
-  Rules            = @{
-    PSUseCompatibleSyntax                          = @{
-      Enable         = $true
-      TargetVersions = @('7.0')          # README mandates PowerShell 7+, so fail anything outside that syntax surface.
-    }
-    PSUseCompatibleCmdlets                         = @{
-      Enable        = $true
-      TargetProfile = @(
-        @{
-          PowerShellVersion = '7.0'
-          Modules           = @('DomainDetective', 'PSWriteHTML', 'Pester', 'PSScriptAnalyzer')
-        }
-      )
-    }
-
-    # Enforce the authoring standards from AGENTS.md
-    PSProvideCommentHelp                           = @{
-      Enable       = $true
-      ExportedOnly = $false              # Internal helpers also require comment-based help blocks.
-    }
-    PSUseApprovedVerbs                             = @{
-      Enable = $true              # Keeps Public\ & Private\ functions aligned with “PowerShell-approved verbs”.
-    }
-    PSUseShouldProcessForStateChangingFunctions    = @{
-      Enable = $true              # Guarantees exported commands surface -WhatIf/-Confirm per the -DryRun requirement.
-    }
-    PSAvoidDefaultValueSwitchParameter             = @{
-      Enable = $true              # Ensures switches like -SkipDependencies behave predictably.
-    }
-    PSAvoidUsingCmdletAliases                      = @{
-      Enable = $true              # Log/CI output stays automatable and readable.
-    }
-    PSAvoidUsingWriteHost                          = @{
-      Enable = $true              # Forces Write-Verbose/Information + centralized logging instead of console-only output.
-    }
-    PSAvoidGlobalVars                              = @{
-      Enable = $true              # Protects reusable modules/tests from state bleed.
-    }
-    PSAvoidUsingInvokeExpression                   = @{
-      Enable = $true              # Aligns with secure-by-default dependency handling.
-    }
-    PSAvoidUsingConvertToSecureStringWithPlainText = @{
-      Enable = $true
-    }
-    PSAvoidUsingPlainTextForPassword               = @{
-      Enable = $true
-    }
+    # Default rules stay enabled; the Rules block below tweaks the ones that matter most to DSA.
+    Rules = @{
+        PSUseCompatibleSyntax = @{
+            Enable = $true
+            TargetVersions = @('7.0') # README mandates PowerShell 7+, so fail anything outside that syntax surface.
+        }
+        PSUseCompatibleCmdlets = @{
+            Enable = $true
+            # Compatibility profiles shipped with PSScriptAnalyzer 1.24.0 (PS 7.0 on Windows/Ubuntu).
+            TargetProfiles = @(
+                'win-8_x64_10.0.17763.0_7.0.0_x64_3.1.2_core'
+                'ubuntu_x64_18.04_7.0.0_x64_3.1.2_core'
+            )
+        }
 
-    # Style/readability rules that match the module template (4-space indent, braces on same line, etc.)
-    PSUseConsistentIndentation                     = @{
-      Enable          = $true
-      IndentationSize = 4
-      Kind            = 'space'
-    }
-    PSUseConsistentWhitespace                      = @{ Enable = $true }
-    PSAlignAssignmentStatement                     = @{ Enable = $true }
-    PSPlaceOpenBrace                               = @{
-    }
-    PSPlaceCloseBrace                              = @{
-      Enable             = $true
-      NoEmptyLineBefore  = $true
-      IgnoreOneLineBlock = $true
-    }
-  }
+        # Enforce the authoring standards from AGENTS.md
+        PSProvideCommentHelp = @{
+            Enable = $true
+            ExportedOnly = $false # Internal helpers also require comment-based help blocks.
+        }
+        PSUseApprovedVerbs = @{
+            Enable = $true # Keeps Public\ & Private\ functions aligned with PowerShell-approved verbs.
+        }
+        PSUseShouldProcessForStateChangingFunctions = @{
+            Enable = $true # Ensures future state-changing commands wire up -WhatIf/-Confirm.
+        }
+        PSAvoidDefaultValueSwitchParameter = @{
+            Enable = $true # Ensures switches like -SkipDependencies behave predictably.
+        }
+        PSAvoidUsingCmdletAliases = @{
+            Enable = $true # Log/CI output stays automatable and readable.
+        }
+        PSAvoidUsingWriteHost = @{
+            Enable = $true # Forces Write-Verbose/Information + centralized logging instead of console-only output.
+        }
+        PSAvoidGlobalVars = @{
+            Enable = $true # Protects reusable modules/tests from state bleed.
+        }
+        PSAvoidUsingInvokeExpression = @{
+            Enable = $true # Aligns with secure-by-default dependency handling.
+        }
+        PSAvoidUsingConvertToSecureStringWithPlainText = @{
+            Enable = $true
+        }
+        PSAvoidUsingPlainTextForPassword = @{
+            Enable = $true
+        }
 
-  # Wrapper scripts in Examples may legitimately surface informational output, so relax just that rule there.
-  RuleSuppressions = @(
-    @{
-      RuleName      = 'PSAvoidUsingWriteHost'
-      Justification = 'Example wrappers are user-facing shims per AGENTS.md; they can echo status while the module logs centrally.'
-      Target        = 'Examples\*.ps1'
+        # Style/readability rules that match the module template (4-space indent, braces on same line, etc.)
+        PSUseConsistentIndentation = @{
+            Enable = $true
+            IndentationSize = 4
+            Kind = 'space'
+        }
+        PSUseConsistentWhitespace = @{
+            Enable = $false
+        }
+        PSAlignAssignmentStatement = @{
+            Enable = $false
+        }
+        PSPlaceOpenBrace = @{
+            Enable = $true
+            OnSameLine = $true
+            IgnoreOneLineBlock = $true
+        }
+        PSPlaceCloseBrace = @{
+            Enable = $true
+            NoEmptyLineBefore = $true
+            IgnoreOneLineBlock = $true
+        }
     }
-  )
 }
diff --git a/Private/Confirm-DSADependencies.ps1 b/Private/Confirm-DSADependencies.ps1
new file mode 100644
index 0000000..5961626
--- /dev/null
+++ b/Private/Confirm-DSADependencies.ps1
@@ -0,0 +1,70 @@
+<#
+.SYNOPSIS
+    Validate required modules and optionally install missing dependencies.
+.DESCRIPTION
+    Uses Test-DSADependency to verify required modules are available, attempts installation when requested, and throws when unmet.
+.PARAMETER Name
+    Names of modules to validate.
+.PARAMETER AttemptInstallation
+    Attempt to install missing modules via Install-Module.
+.PARAMETER LogFile
+    Path to the log file for diagnostic messages.
+#>
+function Confirm-DSADependencies {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string[]]$Name,
+
+        [switch]$AttemptInstallation,
+
+        [string]$LogFile
+    )
+
+    $dependencyResult = Test-DSADependency -Name $Name -AttemptInstallation:$AttemptInstallation -LogFile $LogFile
+    if (-not $dependencyResult.IsCompliant) {
+        $missing = $dependencyResult.MissingModules -join ', '
+        if ($LogFile) {
+            Write-DSALog -Message "Missing dependencies: $missing" -LogFile $LogFile -Level 'ERROR'
+        }
+        throw "Missing dependencies: $missing"
+    }
+}
+
+<#
+.SYNOPSIS
+    Ensure the DomainDetective module is imported once per session.
+.DESCRIPTION
+    Imports DomainDetective when not already loaded and caches state to avoid redundant imports, logging failures when provided a log path.
+.PARAMETER LogFile
+    Path to the log file for error reporting.
+#>
+function Import-DSADomainDetectiveModule {
+    [CmdletBinding()]
+    param (
+        [string]$LogFile
+    )
+
+    if (-not (Get-Variable -Name DSADomainDetectiveLoaded -Scope Script -ErrorAction SilentlyContinue)) {
+        $script:DSADomainDetectiveLoaded = $false
+    }
+
+    if ($script:DSADomainDetectiveLoaded) {
+        return
+    }
+
+    try {
+        if (-not (Get-Module -Name DomainDetective -ErrorAction SilentlyContinue)) {
+            $null = Import-Module -Name DomainDetective -ErrorAction Stop
+        }
+        $script:DSADomainDetectiveLoaded = $true
+    }
+    catch {
+        $message = "DomainDetective module import failed: $($_.Exception.Message)"
+        if ($LogFile) {
+            Write-DSALog -Message $message -LogFile $LogFile -Level 'ERROR'
+        }
+        throw $message
+    }
+}
diff --git a/Private/DSA.Condition.ps1 b/Private/DSA.Condition.ps1
new file mode 100644
index 0000000..ba8bdd4
--- /dev/null
+++ b/Private/DSA.Condition.ps1
@@ -0,0 +1,347 @@
+<#
+.SYNOPSIS
+    Initialize and return baseline condition definitions.
+.DESCRIPTION
+    Builds a script-scoped dictionary of supported baseline conditions with validation and evaluation logic, caching for reuse.
+#>
+function Get-DSAConditionDefinitions {
+    if (-not $script:DSAConditionDefinitions) {
+        $script:DSAConditionDefinitions = New-Object 'System.Collections.Generic.Dictionary[string,pscustomobject]' ([System.StringComparer]::OrdinalIgnoreCase)
+
+        $addDefinition = {
+            param (
+                [Parameter(Mandatory = $true)][string]$Name,
+                [Parameter()][ScriptBlock]$Validate,
+                [Parameter(Mandatory = $true)][ScriptBlock]$Evaluate
+            )
+
+            $script:DSAConditionDefinitions[$Name] = [pscustomobject]@{
+                Name     = $Name
+                Validate = $Validate
+                Evaluate = $Evaluate
+            }
+        }
+
+        & $addDefinition 'MustExist' {
+            param ($ExpectedValue)
+            [pscustomobject]@{
+                IsValid = $true
+                Message = $null
+            }
+        } {
+            param ($Value, $ExpectedValue)
+            Test-DSAHasValue -Value $Value
+        }
+
+        & $addDefinition 'MustBeNull' {
+            param ($ExpectedValue)
+            [pscustomobject]@{
+                IsValid = $true
+                Message = $null
+            }
+        } {
+            param ($Value, $ExpectedValue)
+            -not (Test-DSAHasValue -Value $Value)
+        }
+
+        & $addDefinition 'MustContain' {
+            param ($ExpectedValue)
+            $isValid = Test-DSAHasValue -Value $ExpectedValue
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define an ExpectedValue for condition 'MustContain'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            if (-not (Test-DSAHasValue -Value $Value)) {
+                return $false
+            }
+
+            $expected = $ExpectedValue ?? ''
+            if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [string])) {
+                foreach ($item in $Value) {
+                    if (($item ?? '') -match [regex]::Escape($expected)) {
+                        return $true
+                    }
+                }
+                return $false
+            }
+
+            return (($Value ?? '') -match [regex]::Escape($expected))
+        }
+
+        & $addDefinition 'MustNotContain' {
+            param ($ExpectedValue)
+            $expectedValues = ConvertTo-DSABaselineArray -Value $ExpectedValue
+            $isValid = (@($expectedValues)).Count -gt 0
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define one or more ExpectedValue entries for condition 'MustNotContain'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            if (-not (Test-DSAHasValue -Value $Value)) {
+                return $true
+            }
+
+            $expectedValues = ConvertTo-DSABaselineArray -Value $ExpectedValue
+            foreach ($expected in $expectedValues) {
+                if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [string])) {
+                    foreach ($item in $Value) {
+                        if (([string]$item) -like "*$expected*") {
+                            return $false
+                        }
+                    }
+                }
+                elseif (([string]$Value) -like "*$expected*") {
+                    return $false
+                }
+            }
+
+            return $true
+        }
+
+        & $addDefinition 'MustEqual' {
+            param ($ExpectedValue)
+            $isValid = Test-DSAHasValue -Value $ExpectedValue
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define an ExpectedValue for condition 'MustEqual'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            if (-not (Test-DSAHasValue -Value $Value)) {
+                return $false
+            }
+
+            return [string]::Equals($Value, $ExpectedValue, [System.StringComparison]::OrdinalIgnoreCase)
+        }
+
+        & $addDefinition 'MustBeOneOf' {
+            param ($ExpectedValue)
+            $choices = ConvertTo-DSABaselineArray -Value $ExpectedValue
+            $isValid = (@($choices)).Count -gt 0
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define one or more ExpectedValue entries for condition 'MustBeOneOf'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            if (-not (Test-DSAHasValue -Value $Value)) {
+                return $false
+            }
+
+            $choices = ConvertTo-DSABaselineArray -Value $ExpectedValue
+            $normalizedValue = $Value.ToString()
+            foreach ($choice in $choices) {
+                if ([string]::Equals($normalizedValue, $choice, [System.StringComparison]::OrdinalIgnoreCase)) {
+                    return $true
+                }
+            }
+
+            return $false
+        }
+
+        & $addDefinition 'LessThanOrEqual' {
+            param ($ExpectedValue)
+            $expectedNumber = ConvertTo-DSADouble -Value $ExpectedValue
+            $isValid = $null -ne $expectedNumber
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define a numeric ExpectedValue for condition 'LessThanOrEqual'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            $numericValue = ConvertTo-DSADouble -Value $Value
+            $expectedNumber = ConvertTo-DSADouble -Value $ExpectedValue
+            if ($null -eq $numericValue -or $null -eq $expectedNumber) {
+                return $false
+            }
+
+            return $numericValue -le $expectedNumber
+        }
+
+        & $addDefinition 'GreaterThanOrEqual' {
+            param ($ExpectedValue)
+            $expectedNumber = ConvertTo-DSADouble -Value $ExpectedValue
+            $isValid = $null -ne $expectedNumber
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define a numeric ExpectedValue for condition 'GreaterThanOrEqual'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            $numericValue = ConvertTo-DSADouble -Value $Value
+            $expectedNumber = ConvertTo-DSADouble -Value $ExpectedValue
+            if ($null -eq $numericValue -or $null -eq $expectedNumber) {
+                return $false
+            }
+
+            return $numericValue -ge $expectedNumber
+        }
+
+        & $addDefinition 'BetweenInclusive' {
+            param ($ExpectedValue)
+            $min = Get-DSAPropertyValue -InputObject $ExpectedValue -PropertyName 'Min'
+            $max = Get-DSAPropertyValue -InputObject $ExpectedValue -PropertyName 'Max'
+            $isValid = ($null -ne $ExpectedValue) -and ($null -ne $min -or $null -ne $max)
+            [pscustomobject]@{
+                IsValid = $isValid
+                Message = $(if (-not $isValid) { "must define ExpectedValue.Min or ExpectedValue.Max for condition 'BetweenInclusive'." } else { $null })
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            if (-not (Test-DSAHasValue -Value $Value)) {
+                return $false
+            }
+
+            $numericValue = ConvertTo-DSADouble -Value $Value
+            if ($null -eq $numericValue) {
+                return $false
+            }
+
+            if ($null -eq $ExpectedValue) {
+                return $false
+            }
+
+            $min = Get-DSAPropertyValue -InputObject $ExpectedValue -PropertyName 'Min'
+            $max = Get-DSAPropertyValue -InputObject $ExpectedValue -PropertyName 'Max'
+            if ($null -ne $min -and $numericValue -lt (ConvertTo-DSADouble -Value $min)) {
+                return $false
+            }
+
+            if ($null -ne $max -and $numericValue -gt (ConvertTo-DSADouble -Value $max)) {
+                return $false
+            }
+
+            return $true
+        }
+
+        & $addDefinition 'MustBeFalse' {
+            param ($ExpectedValue)
+            [pscustomobject]@{
+                IsValid = $true
+                Message = $null
+            }
+        } {
+            param ($Value, $ExpectedValue)
+            -not [bool]$Value
+        }
+
+        & $addDefinition 'MustBeTrue' {
+            param ($ExpectedValue)
+            [pscustomobject]@{
+                IsValid = $true
+                Message = $null
+            }
+        } {
+            param ($Value, $ExpectedValue)
+            [bool]$Value
+        }
+
+        & $addDefinition 'MustBeEmpty' {
+            param ($ExpectedValue)
+            [pscustomobject]@{
+                IsValid = $true
+                Message = $null
+            }
+        } {
+            param ($Value, $ExpectedValue)
+
+            if ($null -eq $Value) {
+                return $true
+            }
+
+            if ($Value -is [string]) {
+                return [string]::IsNullOrWhiteSpace($Value)
+            }
+
+            if ($Value -is [System.Collections.IEnumerable]) {
+                $items = @($Value)
+                return $items.Count -eq 0
+            }
+
+            return $false
+        }
+    }
+
+    return $script:DSAConditionDefinitions
+}
+
+<#
+.SYNOPSIS
+    Retrieve a baseline condition definition by name.
+.DESCRIPTION
+    Returns the cached condition definition from Get-DSAConditionDefinitions or null when unsupported.
+.PARAMETER Name
+    Condition name to resolve.
+#>
+function Get-DSAConditionDefinition {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Name
+    )
+
+    $definitions = Get-DSAConditionDefinitions
+    if ($definitions.ContainsKey($Name)) {
+        return $definitions[$Name]
+    }
+
+    return $null
+}
+
+<#
+.SYNOPSIS
+    Validate the ExpectedValue payload for a condition.
+.DESCRIPTION
+    Ensures the supplied ExpectedValue meets the schema requirements of the referenced condition and returns validation metadata.
+.PARAMETER Condition
+    Condition name whose ExpectedValue is being validated.
+.PARAMETER ExpectedValue
+    Value to validate against the condition.
+#>
+function Test-DSAConditionExpectedValue {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Condition,
+
+        $ExpectedValue
+    )
+
+    $definition = Get-DSAConditionDefinition -Name $Condition
+    if (-not $definition) {
+        return [pscustomobject]@{
+            IsValid = $false
+            Message = "uses unsupported condition '$Condition'."
+        }
+    }
+
+    if (-not $definition.Validate) {
+        return [pscustomobject]@{
+            IsValid = $true
+            Message = $null
+        }
+    }
+
+    $validation = & $definition.Validate $ExpectedValue
+    if ($validation -is [pscustomobject]) {
+        return $validation
+    }
+
+    $isValid = [bool]$validation
+    return [pscustomobject]@{
+        IsValid = $isValid
+        Message = $(if ($isValid) { $null } else { "has an invalid ExpectedValue for condition '$Condition'." })
+    }
+}
diff --git a/Private/DSA.DkimStatus.ps1 b/Private/DSA.DkimStatus.ps1
new file mode 100644
index 0000000..81df0e8
--- /dev/null
+++ b/Private/DSA.DkimStatus.ps1
@@ -0,0 +1,142 @@
+<#
+.SYNOPSIS
+    Determine DKIM selector status relative to a specific check.
+.DESCRIPTION
+    Evaluates selector health based on presence, key length, TTL, and validity for a given DKIM check Id.
+.PARAMETER Selector
+    Selector object containing DNS lookup results.
+.PARAMETER Check
+    Baseline check definition driving evaluation.
+#>
+function Get-DSADkimSelectorStatus {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$Selector,
+
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$Check
+    )
+
+    $found = Get-DSAPropertyValue -InputObject $Selector -PropertyName @('DkimRecordExists', 'Found') -Default $true -As ([bool])
+    $keyLength = Get-DSAPropertyValue -InputObject $Selector -PropertyName @('KeyLength') -Default $null
+    $ttl = Get-DSATtlValue -InputObject $Selector
+    $validPublicKey = Get-DSAPropertyValue -InputObject $Selector -PropertyName @('ValidPublicKey', 'IsValid') -Default $null
+    $validRsaKeyLength = Get-DSAPropertyValue -InputObject $Selector -PropertyName @('ValidRsaKeyLength') -Default $null
+
+    $isValid = [bool]((($null -eq $validPublicKey) -or $validPublicKey) -and (($null -eq $validRsaKeyLength) -or $validRsaKeyLength))
+    $weakKey = Get-DSAPropertyValue -InputObject $Selector -PropertyName @('WeakKey') -Default $false -As ([bool])
+
+    switch ($Check.Id) {
+        'DKIMSelectorPresence' {
+            return $(if ($found) { 'Pass' } else { 'Fail' })
+        }
+        { $_ -in @('DKIMKeyStrength', 'DKIMSelectorHealth') } {
+            $min = if ((Test-DSAProperty -InputObject $Check -Name 'ExpectedValue') -and $Check.ExpectedValue) {
+                $Check.ExpectedValue
+            }
+            else {
+                $script:DSAMinDkimKeyLength
+            }
+            $passesKey = ($keyLength -as [int]) -ge $min -and -not $weakKey
+            return $(if ($found -and $isValid -and $passesKey) { 'Pass' } else { 'Fail' })
+        }
+        'DKIMTtl' {
+            $min = $null
+            $max = $null
+            if ((Test-DSAProperty -InputObject $Check -Name 'ExpectedValue') -and $Check.ExpectedValue) {
+                $min = $Check.ExpectedValue.Min
+                $max = $Check.ExpectedValue.Max
+            }
+            $ttlNumber = $ttl -as [int]
+            $passTtl = ($ttlNumber -and $min -and $max -and $ttlNumber -ge $min -and $ttlNumber -le $max)
+            return $(if ($passTtl) { 'Pass' } else { 'Fail' })
+        }
+        default {
+            return $(if ($found -and $isValid -and -not $weakKey) { 'Pass' } else { 'Fail' })
+        }
+    }
+}
+
+<#
+.SYNOPSIS
+    Compute effective DKIM check status considering selector breakdowns.
+.DESCRIPTION
+    Overrides the base check status with selector-level results when applicable to ensure failures/warnings propagate correctly.
+.PARAMETER Check
+    Baseline check result to adjust.
+.PARAMETER Selectors
+    Selector details associated with the domain evidence.
+#>
+function Get-DSADkimEffectiveStatus {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$Check,
+
+        [pscustomobject[]]$Selectors
+    )
+
+    $effectiveStatus = $Check.Status
+    if ($Selectors -and $Check.Area -eq 'DKIM' -and ($Check.Id -in @('DKIMKeyStrength', 'DKIMTtl', 'DKIMSelectorHealth', 'DKIMSelectorPresence'))) {
+        $selectorStatuses = @($Selectors | ForEach-Object { Get-DSADkimSelectorStatus -Selector $_ -Check $Check })
+        if ($selectorStatuses -contains 'Fail') {
+            $effectiveStatus = 'Fail'
+        }
+        elseif ($selectorStatuses -contains 'Warning') {
+            $effectiveStatus = 'Warning'
+        }
+        elseif ($selectorStatuses -contains 'Pass') {
+            $effectiveStatus = 'Pass'
+        }
+    }
+
+    return $effectiveStatus
+}
+
+<#
+.SYNOPSIS
+    Produce effective check results with DKIM selector awareness.
+.DESCRIPTION
+    Clones incoming checks and recalculates DKIM statuses based on selector details, returning a new array of results.
+.PARAMETER Checks
+    Baseline check results to process.
+.PARAMETER SelectorDetails
+    Optional DKIM selector detail collection to incorporate.
+#>
+function Get-DSAEffectiveChecks {
+    [CmdletBinding()]
+    [OutputType([object[]])]
+    param (
+        $Checks = @(),
+
+        [pscustomobject[]]$SelectorDetails
+    )
+
+    if (-not $Checks) {
+        return @()
+    }
+
+    $checkList = @($Checks | Where-Object { $_ })
+    $results = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($check in $checkList) {
+        $clone = if ($check.PSObject) { $check.PSObject.Copy() } else { $check }
+        if (-not $clone) {
+            continue
+        }
+
+        $effectiveStatus = $clone.Status
+        if ($SelectorDetails -and (Test-DSAProperty -InputObject $clone -Name 'Area') -and $clone.Area -eq 'DKIM') {
+            $effectiveStatus = Get-DSADkimEffectiveStatus -Check $clone -Selectors $SelectorDetails
+        }
+
+        if ($clone.PSObject) {
+            $clone | Add-Member -NotePropertyName 'Status' -NotePropertyValue $effectiveStatus -Force
+        }
+
+        $null = $results.Add($clone)
+    }
+
+    return [object[]]$results.ToArray()
+}
diff --git a/Private/DSA.ModuleState.ps1 b/Private/DSA.ModuleState.ps1
new file mode 100644
index 0000000..644420f
--- /dev/null
+++ b/Private/DSA.ModuleState.ps1
@@ -0,0 +1,33 @@
+# Module-level constants for TTL property resolution.
+# This is the single source of truth for TTL property candidates across DomainDetective responses.
+$script:DSATtlCandidateNames = @(
+    'AuthoritativeDnsRecordTtl'
+    'AuthorityDnsRecordTtl'
+    'DnsRecordAuthorityTtl'
+    'AuthoritativeTtl'
+    'SpfRecordTtl'
+    'DmarcRecordTtl'
+    'DkimRecordTtl'
+    'TlsRptRecordTtl'
+    'MtastsRecordTtl'
+    'MxRecordTtl'
+    'MinMxTtl'
+    'DnsRecordTtl'
+    'Ttl'
+    'TimeToLive'
+)
+
+# Note: $script:DSAMinDkimKeyLength is defined in DomainSecurityAuditor.psm1
+
+<#
+.SYNOPSIS
+    Clear script-scoped caches for the module.
+.DESCRIPTION
+    Resets condition definitions, DomainDetective import state, and reference link cache for test isolation or long-lived sessions.
+#>
+function Reset-DSAModuleState {
+    # Utility for tests/long-running sessions to clear script-scoped caches.
+    $script:DSAConditionDefinitions = $null
+    $script:DSADomainDetectiveLoaded = $false
+    $script:DSAKnownReferenceLinks = @{}
+}
diff --git a/Private/DSA.Property.ps1 b/Private/DSA.Property.ps1
new file mode 100644
index 0000000..88e80e6
--- /dev/null
+++ b/Private/DSA.Property.ps1
@@ -0,0 +1,138 @@
+<#
+.SYNOPSIS
+    Test whether a PSObject has a specific property.
+.DESCRIPTION
+    Checks if the input object has a property with the given name, reducing boilerplate for the common
+    pattern of checking $obj.PSObject.Properties.Name -contains 'PropertyName'.
+.PARAMETER InputObject
+    Object to check for the property.
+.PARAMETER Name
+    Name of the property to look for.
+.OUTPUTS
+    Boolean indicating whether the property exists on the object.
+#>
+function Test-DSAProperty {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param (
+        $InputObject,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Name
+    )
+
+    if ($null -eq $InputObject) {
+        return $false
+    }
+
+    if ($InputObject -is [hashtable]) {
+        return $InputObject.ContainsKey($Name)
+    }
+
+    return $InputObject.PSObject -and $InputObject.PSObject.Properties.Name -contains $Name
+}
+
+<#
+.SYNOPSIS
+    Retrieve a property value from objects or hashtables with optional conversion.
+.DESCRIPTION
+    Iterates candidate property names on hashtables or PSObjects, returning a default or converted value when not present.
+.PARAMETER InputObject
+    Object or hashtable containing the property.
+.PARAMETER PropertyName
+    Property name(s) to attempt in order.
+.PARAMETER Default
+    Value returned when the property is absent.
+.PARAMETER As
+    Optional type to cast the value to before returning.
+#>
+function Get-DSAPropertyValue {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        $InputObject,
+
+        [Parameter(Mandatory = $true)]
+        [string[]]$PropertyName,
+
+        $Default = $null,
+
+        [Type]$As
+    )
+
+    if ($null -eq $InputObject -or -not $PropertyName) {
+        return $Default
+    }
+
+    foreach ($name in $PropertyName) {
+        if ($InputObject -is [hashtable]) {
+            if ($InputObject.ContainsKey($name)) {
+                $value = $InputObject[$name]
+                return (Convert-DSAPropertyValue -Value $value -As $As -Default $Default)
+            }
+        }
+        elseif ($InputObject.PSObject -and $InputObject.PSObject.Properties.Name -contains $name) {
+            $value = $InputObject.$name
+            return (Convert-DSAPropertyValue -Value $value -As $As -Default $Default)
+        }
+    }
+
+    return $Default
+}
+
+<#
+.SYNOPSIS
+    Convert a value to a specific type with a default fallback.
+.DESCRIPTION
+    Attempts to cast the supplied value to a requested type, returning a default when conversion yields null.
+.PARAMETER Value
+    Input value to convert.
+.PARAMETER As
+    Type to cast the value to.
+.PARAMETER Default
+    Fallback value when the cast fails or the input is null.
+#>
+function Convert-DSAPropertyValue {
+    [CmdletBinding()]
+    param (
+        $Value,
+        [Type]$As,
+        $Default = $null
+    )
+
+    if (-not $As) {
+        return $(if ($null -eq $Value) { $Default } else { $Value })
+    }
+
+    $result = $Value -as $As
+    return $(if ($null -eq $result) { $Default } else { $result })
+}
+
+<#
+.SYNOPSIS
+    Extract a TTL value from common DNS-related property names.
+.DESCRIPTION
+    Searches candidate TTL property names on an object/hashtable and returns an integer value or default when absent.
+    Uses the centralized $script:DSATtlCandidateNames from DSA.ModuleState.ps1 as the single source of truth.
+.PARAMETER InputObject
+    Object that may contain TTL properties.
+.PARAMETER PropertyName
+    Optional additional property names to search (appended to the standard candidates).
+.PARAMETER Default
+    Value to return when no TTL is found.
+#>
+function Get-DSATtlValue {
+    [CmdletBinding()]
+    param (
+        $InputObject,
+        [string[]]$PropertyName,
+        $Default = $null
+    )
+
+    $candidateNames = $script:DSATtlCandidateNames
+    if ($PropertyName) {
+        $candidateNames = @($candidateNames + $PropertyName)
+    }
+
+    return Get-DSAPropertyValue -InputObject $InputObject -PropertyName $candidateNames -Default $Default -As ([int])
+}
diff --git a/Private/DSA.ReportAssets.ps1 b/Private/DSA.ReportAssets.ps1
new file mode 100644
index 0000000..c972c04
--- /dev/null
+++ b/Private/DSA.ReportAssets.ps1
@@ -0,0 +1,213 @@
+<#
+.SYNOPSIS
+    Encode a value for safe HTML display.
+.DESCRIPTION
+    Converts values to strings and HTML-encodes them, returning an empty string when null.
+.PARAMETER Value
+    Value to encode.
+#>
+function ConvertTo-DSAHtml {
+    param (
+        $Value
+    )
+
+    if ($null -eq $Value) {
+        return ''
+    }
+
+    $text = [string]$Value
+    return [System.Net.WebUtility]::HtmlEncode($text)
+}
+
+<#
+.SYNOPSIS
+    Format a value with semantic HTML wrappers.
+.DESCRIPTION
+    Returns stylized spans for boolean and empty values, joins enumerables, and HTML-encodes other inputs.
+.PARAMETER Value
+    Value to format.
+#>
+function ConvertTo-DSAValueHtml {
+    param (
+        $Value
+    )
+
+    if ($null -eq $Value) {
+        return '<span class="value-none">None</span>'
+    }
+
+    if ($Value -is [bool]) {
+        if ($Value) {
+            return '<span class="value-positive">Yes</span>'
+        }
+        return '<span class="value-negative">No</span>'
+    }
+
+    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [string])) {
+        $items = @($Value | Where-Object { $_ })
+        if ($items.Count -eq 0) {
+            return '<span class="value-none">None</span>'
+        }
+        return ($items | ForEach-Object { ConvertTo-DSAHtml $_ }) -join ', '
+    }
+
+    return ConvertTo-DSAHtml -Value $Value
+}
+
+<#
+.SYNOPSIS
+    Convert a reference string to an HTML link when possible.
+.DESCRIPTION
+    Resolves known references or RFCs to URLs, falling back to plain text when no mapping exists.
+.PARAMETER Reference
+    Reference text to render.
+#>
+function ConvertTo-DSAReferenceHtml {
+    param (
+        [string]$Reference
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Reference)) {
+        return ''
+    }
+
+    $normalized = $Reference.Trim()
+    $link = Get-DSAKnownReferenceLink -Reference $normalized
+    if (-not $link -and $normalized -match '^(https?://\S+)$') {
+        $link = $matches[1]
+    }
+
+    if ($link) {
+        $display = ConvertTo-DSAHtml -Value $normalized
+        return ("<a class=""reference-link"" href=""{0}"" target=""_blank"" rel=""noopener"">{1}</a>" -f $link, $display)
+    }
+
+    $displayText = ConvertTo-DSAHtml -Value $normalized
+    return ("<span class=""reference-link reference-link--static"">{0}</span>" -f $displayText)
+}
+
+<#
+.SYNOPSIS
+    Resolve a known reference label to a link.
+.DESCRIPTION
+    Loads cached reference mappings, handles RFC section linking, and returns the associated URL or null.
+.PARAMETER Reference
+    Reference label to resolve.
+#>
+function Get-DSAKnownReferenceLink {
+    param (
+        [string]$Reference
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Reference)) {
+        return $null
+    }
+
+    $trimmed = $Reference.Trim()
+
+    if (-not $script:DSAKnownReferenceLinks -or $script:DSAKnownReferenceLinks.Count -eq 0) {
+        $referenceFile = Join-Path -Path $script:ConfigRoot -ChildPath 'ReferenceLinks.psd1'
+        $script:DSAKnownReferenceLinks = if (Test-Path -Path $referenceFile) {
+            Import-PowerShellDataFile -Path $referenceFile
+        }
+        else {
+            @{}
+        }
+    }
+
+    if ($trimmed -match '^RFC\s+(\d+)(?:\s+§\s*([\d\.]+))?$') {
+        $rfcNumber = $matches[1]
+        $section = $matches[2]
+        $url = "https://www.rfc-editor.org/rfc/rfc$rfcNumber"
+        if ($section) {
+            $sectionFragment = $section -replace '\s+', ''
+            $url = "$url#section-$sectionFragment"
+        }
+        return $url
+    }
+
+    if ($script:DSAKnownReferenceLinks.ContainsKey($trimmed)) {
+        return $script:DSAKnownReferenceLinks[$trimmed]
+    }
+
+    return $null
+}
+
+<#
+.SYNOPSIS
+    Get consolidated status metadata for a given status.
+.DESCRIPTION
+    Returns a hashtable containing CSS class name, filter token, and icon for the status.
+    This is the single source of truth for status-related display properties.
+.PARAMETER Status
+    Status text to resolve (Pass, Fail, Warning, or other).
+.OUTPUTS
+    Hashtable with Class, Filter, and Icon keys.
+#>
+function Get-DSAStatusMetadata {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param (
+        [string]$Status
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Status)) {
+        return @{ Class = 'info'; Filter = 'info'; Icon = 'ℹ' }
+    }
+
+    switch ($Status.ToLowerInvariant()) {
+        'pass'    { return @{ Class = 'passed'; Filter = 'pass'; Icon = '✔' } }
+        'fail'    { return @{ Class = 'failed'; Filter = 'fail'; Icon = '✖' } }
+        'warning' { return @{ Class = 'warning'; Filter = 'warning'; Icon = '!' } }
+        default   { return @{ Class = 'info'; Filter = 'info'; Icon = 'ℹ' } }
+    }
+}
+
+<#
+.SYNOPSIS
+    Map a status to its CSS class name.
+.DESCRIPTION
+    Normalizes pass/fail/warning statuses to class tokens used in the HTML report.
+.PARAMETER Status
+    Status text to normalize.
+#>
+function Get-DSAStatusClassName {
+    param (
+        [string]$Status
+    )
+
+    return (Get-DSAStatusMetadata -Status $Status).Class
+}
+
+<#
+.SYNOPSIS
+    Map a status to a simple icon.
+.DESCRIPTION
+    Returns Unicode characters representing pass, fail, warning, or info for report display.
+.PARAMETER Status
+    Status text to normalize.
+#>
+function Get-DSAStatusIcon {
+    param (
+        [string]$Status
+    )
+
+    return (Get-DSAStatusMetadata -Status $Status).Icon
+}
+
+<#
+.SYNOPSIS
+    Normalize status values for filtering.
+.DESCRIPTION
+    Returns canonical filter tokens used to show/hide tests in the report.
+.PARAMETER Status
+    Status text to normalize.
+#>
+function Get-DSAFilterStatus {
+    param (
+        [string]$Status
+    )
+
+    return (Get-DSAStatusMetadata -Status $Status).Filter
+}
+
diff --git a/Private/DSA.ReportScript.ps1 b/Private/DSA.ReportScript.ps1
new file mode 100644
index 0000000..b903354
--- /dev/null
+++ b/Private/DSA.ReportScript.ps1
@@ -0,0 +1,217 @@
+<#
+.SYNOPSIS
+    Provide client-side script for the HTML report.
+.DESCRIPTION
+    Returns JavaScript that powers expand/collapse controls, status filtering, and keyboard accessibility for the report UI.
+#>
+function Get-DSAReportScript {
+    @"
+const protocolSections = document.querySelectorAll('.protocol-section');
+const toggleAllSectionsButton = document.getElementById('toggle-all-sections');
+
+const isSectionVisible = (section) => {
+    if (!section) {
+        return false;
+    }
+    const domain = section.closest('.domain-results');
+    const domainVisible = !domain || domain.style.display !== 'none';
+    return domainVisible && section.style.display !== 'none';
+};
+
+const getVisibleSections = () => Array.from(protocolSections).filter((section) => isSectionVisible(section));
+
+const setSectionExpanded = (section, header, details, expanded) => {
+    section.classList.toggle('expanded', expanded);
+    if (details) {
+        details.classList.toggle('expanded', expanded);
+        details.setAttribute('aria-hidden', expanded ? 'false' : 'true');
+    }
+    if (header) {
+        header.setAttribute('aria-expanded', expanded ? 'true' : 'false');
+    }
+};
+
+const updateToggleAllLabel = () => {
+    if (!toggleAllSectionsButton) {
+        return;
+    }
+    const visibleSections = getVisibleSections();
+    const allExpanded = visibleSections.length > 0 && visibleSections.every((section) => section.classList.contains('expanded'));
+    toggleAllSectionsButton.textContent = allExpanded ? 'Collapse all sections' : 'Expand all sections';
+    toggleAllSectionsButton.setAttribute('aria-pressed', allExpanded ? 'true' : 'false');
+};
+
+const setAllSectionsExpanded = (expanded) => {
+    protocolSections.forEach((section) => {
+        if (!isSectionVisible(section)) {
+            return;
+        }
+        const header = section.querySelector('.protocol-header');
+        const details = section.querySelector('.protocol-details');
+        if (!header || !details) {
+            return;
+        }
+        setSectionExpanded(section, header, details, expanded);
+        if (!expanded) {
+            delete section.dataset.filterExpanded;
+        }
+    });
+    updateToggleAllLabel();
+};
+
+protocolSections.forEach((section) => {
+    const header = section.querySelector('.protocol-header');
+    const details = section.querySelector('.protocol-details');
+    if (!header || !details) {
+        return;
+    }
+    setSectionExpanded(section, header, details, false);
+
+    const toggleSection = () => {
+        const expanded = !section.classList.contains('expanded');
+        setSectionExpanded(section, header, details, expanded);
+        updateToggleAllLabel();
+    };
+
+    header.addEventListener('click', toggleSection);
+    header.addEventListener('keydown', (event) => {
+        if (event.key === 'Enter' || event.key === ' ') {
+            event.preventDefault();
+            toggleSection();
+        }
+    });
+});
+
+if (toggleAllSectionsButton) {
+    toggleAllSectionsButton.addEventListener('click', () => {
+        const visibleSections = getVisibleSections();
+        const shouldExpand = visibleSections.some((section) => !section.classList.contains('expanded'));
+        setAllSectionsExpanded(shouldExpand);
+    });
+}
+
+const filterCards = document.querySelectorAll('.summary-cards .card[data-filter]');
+const domainSections = document.querySelectorAll('.domain-results');
+const filterSummary = document.getElementById('filter-summary');
+let activeFilters = ['all'];
+
+const setCardState = (card, isActive) => {
+    card.classList.toggle('active', isActive);
+    card.setAttribute('aria-pressed', isActive ? 'true' : 'false');
+};
+
+const renderFilterSummary = () => {
+    if (!filterSummary) {
+        return;
+    }
+    if (activeFilters.includes('all')) {
+        filterSummary.textContent = 'Showing: All checks';
+    } else {
+        const pretty = activeFilters.map(f => {
+            switch (f) {
+                case 'pass': return 'Passing';
+                case 'fail': return 'Failing';
+                case 'warning': return 'Warning';
+                default: return f;
+            }
+        });
+        filterSummary.textContent = 'Showing: ' + pretty.join(', ');
+    }
+};
+
+const applyDomainFilter = (filters) => {
+    const normalizedFilters = (filters || ['all']).map(f => (f || 'all').toLowerCase());
+    const matchAll = normalizedFilters.includes('all');
+
+    domainSections.forEach(domain => {
+        let domainHasMatch = false;
+        const protocols = domain.querySelectorAll('.protocol-section');
+
+        protocols.forEach(section => {
+            const details = section.querySelector('.protocol-details');
+            const tests = section.querySelectorAll('.test-result');
+            let sectionHasMatch = false;
+
+            tests.forEach(test => {
+                const status = (test.getAttribute('data-status') || '').toLowerCase();
+                const matches = matchAll || normalizedFilters.includes(status);
+                test.style.display = matches ? '' : 'none';
+                if (matches) {
+                    sectionHasMatch = true;
+                }
+            });
+
+            if (matchAll) {
+                section.style.display = '';
+                setSectionExpanded(section, section.querySelector('.protocol-header'), details, section.classList.contains('expanded'));
+                delete section.dataset.filterExpanded;
+            } else if (sectionHasMatch) {
+                section.style.display = '';
+                domainHasMatch = true;
+                setSectionExpanded(section, section.querySelector('.protocol-header'), details, true);
+                section.dataset.filterExpanded = 'true';
+            } else {
+                section.style.display = 'none';
+                setSectionExpanded(section, section.querySelector('.protocol-header'), details, false);
+                delete section.dataset.filterExpanded;
+            }
+        });
+
+        domain.style.display = (matchAll || domainHasMatch) ? '' : 'none';
+    });
+    updateToggleAllLabel();
+};
+
+filterCards.forEach(card => {
+    card.addEventListener('click', () => {
+        const filter = card.getAttribute('data-filter') || 'all';
+        if (filter === 'all') {
+            activeFilters = ['all'];
+            filterCards.forEach(c => setCardState(c, c.getAttribute('data-filter') === 'all'));
+        } else {
+            const isActive = card.classList.contains('active');
+            if (isActive) {
+                activeFilters = activeFilters.filter(f => f !== filter);
+            } else {
+                activeFilters = activeFilters.filter(f => f !== 'all');
+                activeFilters.push(filter);
+            }
+            if (activeFilters.length === 0) {
+                activeFilters = ['all'];
+            }
+            filterCards.forEach(c => {
+                const f = c.getAttribute('data-filter');
+                setCardState(c, activeFilters.includes(f));
+            });
+        }
+        renderFilterSummary();
+        applyDomainFilter(activeFilters);
+    });
+
+    card.addEventListener('keydown', (event) => {
+        if (event.key === 'Enter' || event.key === ' ') {
+            event.preventDefault();
+            card.click();
+        }
+    });
+});
+
+const defaultFilter = document.querySelector('.summary-cards .card[data-filter=\"all\"]');
+if (defaultFilter) {
+    activeFilters = ['all'];
+    setCardState(defaultFilter, true);
+    filterCards.forEach(c => {
+        if (c !== defaultFilter) {
+            setCardState(c, false);
+        }
+    });
+    renderFilterSummary();
+    applyDomainFilter(activeFilters);
+} else {
+    activeFilters = ['all'];
+    renderFilterSummary();
+    applyDomainFilter(activeFilters);
+}
+"@
+}
+
diff --git a/Private/DSA.ReportStyles.ps1 b/Private/DSA.ReportStyles.ps1
new file mode 100644
index 0000000..356bbcf
--- /dev/null
+++ b/Private/DSA.ReportStyles.ps1
@@ -0,0 +1,597 @@
+<#
+.SYNOPSIS
+    Provide CSS styles for the HTML compliance report.
+.DESCRIPTION
+    Returns the report stylesheet as a here-string, defining colors, layout, and interactive affordances.
+#>
+function Get-DSAReportStyles {
+    @"
+:root {
+    --color-bg: #f5f7fa;
+    --color-surface: #ffffff;
+    --color-surface-alt: #f8fafc;
+    --color-surface-subtle: #f9fafb;
+    --color-text: #1f2937;
+    --color-text-strong: #111827;
+    --color-muted: #4b5563;
+    --color-muted-light: #6b7280;
+    --color-muted-lightest: #9ca3af;
+    --color-border: #e5e7eb;
+    --color-border-light: #f3f4f6;
+
+    /* PASS - Forest Green (colorblind-friendly) */
+    --color-pass: #059669;
+    --color-pass-bg: #d1fae5;
+    --color-pass-text: #064e3b;
+
+    /* FAIL - Vibrant Vermillion (colorblind-friendly) */
+    --color-fail: #dc2626;
+    --color-fail-bg: #fee2e2;
+    --color-fail-text: #7f1d1d;
+
+    /* WARNING - Bright Yellow (colorblind-friendly) */
+    --color-warn: #eab308;
+    --color-warn-bg: #fef9c3;
+    --color-warn-text: #713f12;
+
+    /* INFO - Bright Blue (colorblind-friendly) */
+    --color-info: #3b82f6;
+    --color-info-bg: #dbeafe;
+    --color-info-text: #1e40af;
+
+    --color-focus: #2563eb;
+    --color-focus-light: #ffffff;
+    --color-header: #1e293b;
+    --color-recommendation-bg: #f0f9ff;
+    --color-recommendation-border: #0284c7;
+    --color-recommendation-label: #0c4a6e;
+}
+* { margin: 0; padding: 0; box-sizing: border-box; }
+body {
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarell', 'Helvetica Neue', sans-serif;
+    line-height: 1.6;
+    color: var(--color-text);
+    background-color: var(--color-bg);
+    font-size: 16px;
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+}
+.skip-link {
+    position: absolute;
+    top: -100px;
+    left: 50%;
+    transform: translateX(-50%);
+    background: var(--color-text-strong);
+    color: var(--color-surface);
+    padding: 12px 24px;
+    border-radius: 0 0 8px 8px;
+    text-decoration: none;
+    font-weight: 700;
+    z-index: 1000;
+    transition: top 0.2s ease;
+}
+.skip-link:focus {
+    top: 0;
+    outline: 3px solid var(--color-focus);
+    outline-offset: 2px;
+}
+.container {
+    max-width: 1200px;
+    margin: 0 auto;
+    padding: 20px;
+}
+.header {
+    background: var(--color-header);
+    color: white;
+    padding: 32px;
+    border-radius: 12px;
+    margin-bottom: 30px;
+    box-shadow: 0 4px 15px rgba(0,0,0,0.12);
+}
+.header h1 {
+    font-size: clamp(1.75rem, 3vw + 1rem, 2.6rem);
+    font-weight: 700;
+    letter-spacing: -0.02em;
+    margin-bottom: 12px;
+}
+.header .meta {
+    opacity: 0.95;
+    font-size: 1.05rem;
+}
+.summary-cards {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
+    gap: 20px;
+    margin-bottom: 30px;
+}
+.filter-summary {
+    margin-top: 8px;
+    color: var(--color-muted);
+    font-size: 0.95rem;
+    font-weight: 600;
+}
+.section-controls {
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 10px;
+    margin: 0 0 14px;
+}
+.section-toggle {
+    border: 1px solid var(--color-border);
+    background: var(--color-surface);
+    color: var(--color-text-strong);
+    padding: 8px 12px;
+    border-radius: 10px;
+    font-weight: 700;
+    cursor: pointer;
+    transition: background-color 0.2s ease, box-shadow 0.2s ease, transform 0.2s ease;
+}
+.section-toggle:hover { background: var(--color-border-light); transform: translateY(-1px); box-shadow: 0 1px 4px rgba(0,0,0,0.06); }
+.section-toggle:active { transform: translateY(0); }
+.section-toggle[aria-pressed=\"true\"] {
+    background: var(--color-info-bg);
+    color: var(--color-info-text);
+    border-color: var(--color-info);
+    box-shadow: 0 0 0 2px rgba(37, 99, 235, 0.15);
+}
+.back-to-top-wrapper {
+    display: flex;
+    justify-content: flex-end;
+    margin-top: 16px;
+}
+.back-to-top {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 8px 12px;
+    background: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: 10px;
+    color: var(--color-info-text);
+    font-weight: 700;
+    text-decoration: none;
+    box-shadow: 0 1px 4px rgba(0,0,0,0.06);
+    transition: background-color 0.2s ease, transform 0.2s ease, box-shadow 0.2s ease;
+}
+.back-to-top:hover { background: var(--color-border-light); transform: translateY(-1px); box-shadow: 0 2px 8px rgba(0,0,0,0.08); }
+.card {
+    background: var(--color-surface);
+    padding: 24px;
+    border-radius: 12px;
+    box-shadow: 0 2px 10px rgba(0,0,0,0.08);
+    transition: transform 0.2s ease, box-shadow 0.2s ease;
+}
+.card:hover { transform: translateY(-2px); }
+*:focus-visible {
+    outline: 3px solid var(--color-focus);
+    outline-offset: 3px;
+    box-shadow: 0 0 0 6px rgba(37, 99, 235, 0.1);
+}
+.card:focus-visible {
+    outline: 3px solid var(--color-focus);
+    outline-offset: 4px;
+    box-shadow: 0 0 0 8px rgba(37, 99, 235, 0.15), 0 4px 20px rgba(0, 0, 0, 0.15);
+}
+.protocol-header:focus-visible {
+    outline: 3px solid var(--color-focus);
+    outline-offset: 4px;
+    box-shadow: 0 0 0 8px rgba(37, 99, 235, 0.15);
+}
+.header .card:focus-visible {
+    outline-color: var(--color-focus-light);
+}
+.card-header { display: flex; align-items: center; margin-bottom: 12px; }
+.card-icon {
+    width: 48px;
+    height: 48px;
+    border-radius: 12px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    margin-right: 16px;
+    font-weight: 800;
+    color: white;
+    font-size: 1.3rem;
+    box-shadow: 0 2px 8px rgba(0,0,0,0.1);
+}
+.card-title { font-size: 1.1rem; font-weight: 600; color: var(--color-text-strong); }
+.card-value {
+    font-size: 2.1rem;
+    font-weight: 700;
+    margin-bottom: 6px;
+}
+.card-subtitle { color: var(--color-muted); font-size: 1rem; }
+.card-icon.passed { background-color: var(--color-pass); }
+.card-value.passed { color: var(--color-pass); }
+.card-icon.failed { background-color: var(--color-fail); }
+.card-value.failed { color: var(--color-fail); }
+.card-icon.warning { background-color: var(--color-warn); }
+.card-value.warning { color: var(--color-warn); }
+.card-icon.info { background-color: var(--color-info); }
+.card-value.info { color: var(--color-info); }
+.card.filter-card {
+    cursor: pointer;
+    transition: box-shadow 0.2s ease, transform 0.2s ease;
+}
+.card.filter-card.active { box-shadow: 0 0 0 3px rgba(37,99,235,0.5); transform: translateY(-2px); }
+.domain-results {
+    background: var(--color-surface);
+    border-radius: 12px;
+    box-shadow: 0 2px 12px rgba(0,0,0,0.08);
+    margin-bottom: 30px;
+    overflow: hidden;
+}
+.domain-results.status-pass {
+    border-left: 4px solid var(--color-pass);
+}
+.domain-results.status-fail {
+    border-left: 4px solid var(--color-fail);
+}
+.domain-results.status-warning {
+    border-left: 4px solid var(--color-warn);
+}
+.domain-empty {
+    padding: 24px;
+    color: var(--color-muted-light);
+    font-style: italic;
+    border-top: 1px solid var(--color-border-light);
+}
+.domain-header {
+    background: var(--color-surface-alt);
+    padding: 22px;
+    border-bottom: 1px solid var(--color-border);
+}
+.domain-title {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+}
+.domain-name { font-size: 1.5rem; font-weight: 700; letter-spacing: -0.01em; color: var(--color-text-strong); }
+.domain-meta { margin-top: 12px; color: var(--color-muted); font-size: 0.98rem; }
+.domain-status {
+    padding: 8px 18px;
+    border-radius: 999px;
+    font-weight: 700;
+    font-size: 0.95rem;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+.domain-status.passed { background-color: var(--color-pass-bg); color: var(--color-pass); border: 2px solid var(--color-pass); }
+.domain-status.failed { background-color: var(--color-fail-bg); color: var(--color-fail); border: 2px solid var(--color-fail); }
+.domain-status.warning { background-color: var(--color-warn-bg); color: var(--color-warn); border: 2px solid var(--color-warn); }
+.protocol-section {
+    border-bottom: 1px solid var(--color-border);
+    position: relative;
+}
+.protocol-section::before {
+    content: '';
+    position: absolute;
+    left: 0;
+    top: 0;
+    bottom: 0;
+    width: 4px;
+    background: transparent;
+    transition: background-color 0.2s ease;
+}
+.protocol-section.expanded::before {
+    background: var(--color-info);
+}
+.protocol-header {
+    background: var(--color-surface-subtle);
+    padding: 18px 24px;
+    cursor: pointer;
+    user-select: none;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    transition: background-color 0.2s ease, transform 0.2s ease;
+}
+.protocol-header:hover {
+    background: var(--color-border-light);
+    transform: translateX(2px);
+}
+.protocol-name { font-weight: 700; font-size: 1.05rem; color: var(--color-text-strong); }
+.protocol-status { display: flex; align-items: center; gap: 12px; font-size: 0.95rem; color: var(--color-muted); }
+.protocol-count { font-weight: 600; color: var(--color-text-strong); }
+.chevron {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 22px;
+    height: 22px;
+    border-radius: 50%;
+    background: var(--color-border);
+    color: var(--color-text-strong);
+    font-size: 0.75rem;
+    transition: transform 0.2s ease, background-color 0.2s ease, color 0.2s ease;
+}
+.protocol-section.expanded .chevron {
+    transform: rotate(90deg);
+    background: var(--color-info-bg);
+    color: var(--color-info-text);
+}
+.status-badge {
+    padding: 4px 12px;
+    border-radius: 12px;
+    font-size: 0.9rem;
+    font-weight: 700;
+    text-transform: uppercase;
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+}
+.status-badge.passed {
+    background-color: var(--color-pass-bg);
+    color: var(--color-pass);
+    border-bottom: 2px solid var(--color-pass);
+    background-image: linear-gradient(135deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);
+    background-size: 8px 8px;
+}
+.status-badge.failed {
+    background-color: var(--color-fail-bg);
+    color: var(--color-fail);
+    border-bottom: 2px solid var(--color-fail);
+    background-image: radial-gradient(circle, rgba(255, 255, 255, 0.2) 1px, transparent 1px);
+    background-size: 6px 6px;
+}
+.status-badge.warning {
+    background-color: var(--color-warn-bg);
+    color: var(--color-warn);
+    border-bottom: 2px solid var(--color-warn);
+    background-image: repeating-linear-gradient(45deg, transparent, transparent 4px, rgba(255, 255, 255, 0.15) 4px, rgba(255, 255, 255, 0.15) 8px);
+}
+.status-badge.info { background-color: var(--color-info-bg); color: var(--color-info-text); border-bottom: 2px solid var(--color-info); }
+.protocol-details { display: none; padding: 0; }
+.protocol-details.expanded { display: block; }
+.test-result {
+    padding: 18px 24px;
+    border-top: 1px solid var(--color-border-light);
+}
+.test-result:last-child { border-bottom: none; }
+.test-header { display: flex; align-items: flex-start; gap: 16px; }
+.test-icon {
+    width: 36px;
+    height: 36px;
+    border-radius: 50%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 1.1rem;
+    font-weight: 700;
+    color: white;
+    flex-shrink: 0;
+    box-shadow: 0 3px 8px rgba(0,0,0,0.15);
+    position: relative;
+}
+.test-icon::after {
+    content: '';
+    position: absolute;
+    inset: -4px;
+    border-radius: 50%;
+    border: 2px solid currentColor;
+    opacity: 0.2;
+}
+.test-icon.passed {
+    background-color: var(--color-pass);
+    background-image: linear-gradient(135deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);
+    background-size: 8px 8px;
+}
+.test-icon.failed {
+    background-color: var(--color-fail);
+    background-image: radial-gradient(circle, rgba(255, 255, 255, 0.2) 1px, transparent 1px);
+    background-size: 6px 6px;
+}
+.test-icon.warning {
+    background-color: var(--color-warn);
+    background-image: repeating-linear-gradient(45deg, transparent, transparent 4px, rgba(255, 255, 255, 0.15) 4px, rgba(255, 255, 255, 0.15) 8px);
+}
+.test-icon.info { background-color: var(--color-info); }
+.test-content { flex: 1; display: flex; flex-direction: column; gap: 10px; }
+.test-title-row { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.test-name { font-weight: 700; color: var(--color-text-strong); font-size: 1rem; }
+.test-message { color: var(--color-muted); font-size: 0.97rem; }
+.status-pill {
+    padding: 4px 12px;
+    border-radius: 12px;
+    font-size: 0.85rem;
+    text-transform: uppercase;
+    font-weight: 700;
+    letter-spacing: 0.025em;
+}
+.status-pill.passed {
+    background-color: var(--color-pass-bg);
+    color: var(--color-pass);
+    border-bottom: 2px solid var(--color-pass);
+    background-image: linear-gradient(135deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);
+    background-size: 8px 8px;
+}
+.status-pill.failed {
+    background-color: var(--color-fail-bg);
+    color: var(--color-fail);
+    border-bottom: 2px solid var(--color-fail);
+    background-image: radial-gradient(circle, rgba(255, 255, 255, 0.2) 1px, transparent 1px);
+    background-size: 6px 6px;
+}
+.status-pill.warning {
+    background-color: var(--color-warn-bg);
+    color: var(--color-warn);
+    border-bottom: 2px solid var(--color-warn);
+    background-image: repeating-linear-gradient(45deg, transparent, transparent 4px, rgba(255, 255, 255, 0.15) 4px, rgba(255, 255, 255, 0.15) 8px);
+}
+.status-pill.info { background-color: var(--color-info-bg); color: var(--color-info-text); border-bottom: 2px solid var(--color-info); }
+.details-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+    gap: 16px;
+}
+.detail-item {
+    background: var(--color-surface-subtle);
+    padding: 14px;
+    border-radius: 8px;
+    border-left: 3px solid var(--color-border);
+    transition: border-color 0.2s ease;
+}
+.detail-item:hover {
+    border-left-color: var(--color-info);
+}
+.detail-label {
+    font-size: 0.8rem;
+    color: var(--color-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.075em;
+    font-weight: 600;
+    margin-bottom: 6px;
+}
+.detail-value {
+    font-weight: 700;
+    color: var(--color-text-strong);
+    word-break: break-word;
+    overflow-wrap: anywhere;
+}
+.test-recommendation {
+    background: var(--color-recommendation-bg);
+    padding: 12px;
+    border-radius: 8px;
+    border-left: 4px solid var(--color-recommendation-border);
+}
+.test-recommendation .label {
+    font-weight: 700;
+    color: var(--color-recommendation-label);
+    margin-bottom: 4px;
+}
+.test-recommendation .text { color: var(--color-text); }
+.test-references {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+}
+.dkim-selectors {
+    margin-top: 12px;
+    padding: 10px 12px;
+    border-radius: 8px;
+    background: var(--color-surface-subtle);
+    border: 1px solid var(--color-border);
+}
+.dkim-selectors-title {
+    font-weight: 700;
+    color: var(--color-text-strong);
+    margin-bottom: 8px;
+    font-size: 0.95rem;
+}
+.dkim-selector-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+    gap: 8px;
+}
+.selector-card {
+    background: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: 8px;
+    padding: 10px;
+    box-shadow: 0 1px 4px rgba(0,0,0,0.04);
+}
+.selector-card.passed { border-color: var(--color-pass); }
+.selector-card.failed { border-color: var(--color-fail); }
+.selector-name { font-weight: 700; color: var(--color-text-strong); }
+.selector-status { font-weight: 700; margin-top: 2px; text-transform: uppercase; font-size: 0.8rem; }
+.selector-status.passed { color: var(--color-pass); }
+.selector-status.failed { color: var(--color-fail); }
+.selector-meta { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 6px; color: var(--color-muted); font-size: 0.9rem; }
+.selector-warning { color: var(--color-warn); font-weight: 700; }
+.reference-link {
+    display: inline-block;
+    padding: 6px 12px;
+    border-radius: 999px;
+    background: var(--color-border);
+    color: var(--color-text-strong);
+    text-decoration: none;
+    font-size: 0.9rem;
+    font-weight: 700;
+    transition: background-color 0.2s ease, color 0.2s ease;
+}
+.reference-link:hover {
+    background: #d1d5db;
+    color: var(--color-text-strong);
+}
+.reference-link.reference-link--static {
+    cursor: default;
+    background: var(--color-border-light);
+    color: var(--color-muted-light);
+}
+.footer {
+    background: var(--color-surface);
+    padding: 24px;
+    border-radius: 12px;
+    box-shadow: 0 2px 10px rgba(0,0,0,0.08);
+    text-align: center;
+    color: var(--color-muted-light);
+    margin: 40px auto 0;
+    max-width: 960px;
+}
+.footer p {
+    margin-bottom: 8px;
+}
+.footer-secondary {
+    margin-top: 10px;
+    font-size: 0.95rem;
+}
+.value-none { color: var(--color-muted-lightest); font-style: italic; }
+.value-positive { color: var(--color-pass); font-weight: 700; }
+.value-negative { color: var(--color-fail); font-weight: 700; }
+.sr-only {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border-width: 0;
+}
+@media print {
+    body {
+        background: white;
+        font-size: 12pt;
+    }
+    .header {
+        background: white !important;
+        color: black !important;
+        border: 2px solid black;
+    }
+    .skip-link,
+    .section-toggle,
+    .back-to-top,
+    .filter-card {
+        display: none !important;
+    }
+    .protocol-section {
+        page-break-inside: avoid;
+    }
+    .protocol-details {
+        display: block !important;
+    }
+    .status-badge.passed::before { content: "[PASS] "; }
+    .status-badge.failed::before { content: "[FAIL] "; }
+    .status-badge.warning::before { content: "[WARN] "; }
+    .card {
+        border: 1px solid #333;
+    }
+}
+@media (max-width: 640px) {
+    .domain-title { flex-direction: column; align-items: flex-start; gap: 10px; }
+    .summary-cards { grid-template-columns: 1fr; }
+    .section-controls { flex-direction: column; align-items: flex-start; }
+    .section-toggle { width: 100%; text-align: center; }
+    .back-to-top-wrapper { justify-content: center; }
+    .test-title-row { flex-direction: column; align-items: flex-start; gap: 6px; }
+    .protocol-header { padding: 16px; }
+}
+@media (prefers-reduced-motion: reduce) {
+    * { transition: none !important; animation-duration: 0.01ms !important; }
+    .card:hover { transform: none; }
+    .chevron { transform: none !important; }
+}
+"@
+}
diff --git a/Private/DSA.Status.ps1 b/Private/DSA.Status.ps1
new file mode 100644
index 0000000..c9c43bd
--- /dev/null
+++ b/Private/DSA.Status.ps1
@@ -0,0 +1,123 @@
+<#
+.SYNOPSIS
+    Calculate status distribution for a collection of baseline checks.
+.DESCRIPTION
+    Tallies pass, warning, and fail counts along with total checks and DKIM-specific totals.
+.PARAMETER Checks
+    Collection of check result objects.
+#>
+function Get-DSAStatusCounts {
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param (
+        [object[]]$Checks = @()
+    )
+
+    $statusCounts = @{
+        Fail    = 0
+        Warning = 0
+        Pass    = 0
+    }
+    $totalCount = 0
+    $dkimCount = 0
+
+    foreach ($check in $Checks) {
+        if (-not $check) {
+            continue
+        }
+
+        $totalCount++
+        if ($check.Area -eq 'DKIM') {
+            $dkimCount++
+        }
+
+        switch ($check.Status) {
+            'Fail' { $statusCounts.Fail++ }
+            'Warning' { $statusCounts.Warning++ }
+            'Pass' { $statusCounts.Pass++ }
+        }
+    }
+
+    return [pscustomobject]@{
+        Total     = $totalCount
+        DKIMTotal = $dkimCount
+        Fail      = $statusCounts.Fail
+        Warning   = $statusCounts.Warning
+        Pass      = $statusCounts.Pass
+    }
+}
+
+<#
+.SYNOPSIS
+    Derive an overall status from individual check results.
+.DESCRIPTION
+    Returns Fail when any check fails, Warning when any warn remains, or Pass otherwise. Special handling keeps all-DKIM sets consistent.
+.PARAMETER Checks
+    Collection of check result objects.
+#>
+function Get-DSAOverallStatus {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [object[]]$Checks = @()
+    )
+
+    $counts = Get-DSAStatusCounts -Checks $Checks
+
+    if ($counts.Total -gt 0 -and $counts.DKIMTotal -eq $counts.Total) {
+        if ($counts.Fail -eq $counts.Total) { return 'Fail' }
+        if ($counts.Warning -eq $counts.Total) { return 'Warning' }
+        if ($counts.Pass -eq $counts.Total) { return 'Pass' }
+    }
+
+    if ($counts.Fail -gt 0) { return 'Fail' }
+    if ($counts.Warning -gt 0) { return 'Warning' }
+    return 'Pass'
+}
+
+function Get-DSAColumnWidths {
+    <#
+    .SYNOPSIS
+        Calculate maximum column widths for console output in a single pass.
+    .DESCRIPTION
+        Iterates through summary objects once, calculating the maximum string length
+        for each specified property. Returns a hashtable of property names to widths.
+    .PARAMETER Summaries
+        Collection of summary objects to measure.
+    .PARAMETER Properties
+        Array of property names to calculate widths for.
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param (
+        [object[]]$Summaries = @(),
+
+        [Parameter(Mandatory = $true)]
+        [string[]]$Properties
+    )
+
+    $widths = @{}
+    foreach ($prop in $Properties) {
+        $widths[$prop] = 1
+    }
+
+    if (-not $Summaries -or $Summaries.Count -eq 0) {
+        return $widths
+    }
+
+    foreach ($summary in $Summaries) {
+        if (-not $summary) {
+            continue
+        }
+        foreach ($prop in $Properties) {
+            if ($summary.PSObject.Properties.Name -contains $prop) {
+                $len = $summary.$prop.ToString().Length
+                if ($len -gt $widths[$prop]) {
+                    $widths[$prop] = $len
+                }
+            }
+        }
+    }
+
+    return $widths
+}
diff --git a/Private/DSA.ValueHelpers.ps1 b/Private/DSA.ValueHelpers.ps1
new file mode 100644
index 0000000..8e09a56
--- /dev/null
+++ b/Private/DSA.ValueHelpers.ps1
@@ -0,0 +1,110 @@
+<#
+.SYNOPSIS
+    Determine whether a value should be treated as populated.
+.DESCRIPTION
+    Returns true when the value is non-null and, for strings or enumerables, non-empty.
+.PARAMETER Value
+    The value to evaluate.
+#>
+function Test-DSAHasValue {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param (
+        $Value
+    )
+
+    if ($null -eq $Value) {
+        return $false
+    }
+
+    if ($Value -is [string]) {
+        return -not [string]::IsNullOrWhiteSpace($Value)
+    }
+
+    if ($Value -is [System.Collections.IEnumerable]) {
+        $enumerated = @($Value)
+        return $enumerated.Count -gt 0
+    }
+
+    return $true
+}
+
+<#
+.SYNOPSIS
+    Normalize input into an array for baseline comparisons.
+.DESCRIPTION
+    Converts null to an empty array and wraps single items in an array while preserving existing enumerables.
+.PARAMETER Value
+    Input value to normalize.
+#>
+function ConvertTo-DSABaselineArray {
+    param (
+        $Value
+    )
+
+    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [string])) {
+        return ,@($Value)
+    }
+
+    if ($null -eq $Value) {
+        return ,@()
+    }
+
+    return ,@($Value)
+}
+
+function ConvertTo-DSADouble {
+    <#
+.SYNOPSIS
+    Converts a value to a double using culture-invariant parsing.
+.DESCRIPTION
+    Attempts to parse the input value as a double using invariant culture rules.
+    Returns null if parsing fails or input is null.
+#>
+    param (
+        $Value
+    )
+
+    if ($null -eq $Value) {
+        return $null
+    }
+
+    $number = 0.0
+    $style = [System.Globalization.NumberStyles]::Float
+    $culture = [System.Globalization.CultureInfo]::InvariantCulture
+    if ([double]::TryParse($Value.ToString(), $style, $culture, [ref]$number)) {
+        return $number
+    }
+
+    return $null
+}
+
+<#
+.SYNOPSIS
+    Format observed values for display in reports and logs.
+.DESCRIPTION
+    Returns 'None' for null/empty values, joins enumerables with commas, or converts scalars to string.
+.PARAMETER Value
+    Value to format.
+#>
+function Format-DSAActualValue {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        $Value
+    )
+
+    if (-not (Test-DSAHasValue -Value $Value)) {
+        return 'None'
+    }
+
+    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [string])) {
+        $flattened = @($Value | Where-Object { $_ -ne $null })
+        if ($flattened.Count -eq 0) {
+            return 'None'
+        }
+        return ($flattened -join ', ')
+    }
+
+    return $Value.ToString()
+}
diff --git a/Private/Get-DSABaseline.ps1 b/Private/Get-DSABaseline.ps1
new file mode 100644
index 0000000..ff17770
--- /dev/null
+++ b/Private/Get-DSABaseline.ps1
@@ -0,0 +1,44 @@
+function Get-DSABaseline {
+    <#
+.SYNOPSIS
+    Loads baseline profile definitions from a configuration file.
+.DESCRIPTION
+    Resolves and imports baseline checks from either a named built-in profile or a custom file path.
+    Returns a hashtable of profile definitions keyed by classification name.
+#>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param (
+        [Parameter()]
+        [string]$ProfilePath,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string]$ProfileName = 'Default'
+    )
+
+    if ($PSBoundParameters.ContainsKey('ProfilePath')) {
+        $resolvedProfile = Resolve-DSAPath -Path $ProfilePath -PathType 'File'
+    }
+    else {
+        $profileFileName = "Baseline.$ProfileName.psd1"
+        $defaultProfile = Join-Path -Path $script:ConfigRoot -ChildPath $profileFileName
+        if (-not (Test-Path -Path $defaultProfile)) {
+            throw "Baseline profile '$ProfileName' not found at '$defaultProfile'."
+        }
+
+        $resolvedProfile = Resolve-DSAPath -Path $defaultProfile -PathType 'File'
+    }
+
+    $definition = Import-DSABaselineConfig -Path $resolvedProfile
+    $profiles = Get-DSAPropertyValue -InputObject $definition -PropertyName 'Profiles'
+    if (-not $profiles) {
+        throw "Baseline profile '$resolvedProfile' is missing the 'Profiles' collection."
+    }
+
+    return @{
+        Name     = Get-DSAPropertyValue -InputObject $definition -PropertyName 'Name'
+        Version  = Get-DSAPropertyValue -InputObject $definition -PropertyName 'Version'
+        Profiles = $profiles
+    }
+}
diff --git a/Private/Get-DSADkimSelectorsFromRecord.ps1 b/Private/Get-DSADkimSelectorsFromRecord.ps1
new file mode 100644
index 0000000..4e53841
--- /dev/null
+++ b/Private/Get-DSADkimSelectorsFromRecord.ps1
@@ -0,0 +1,39 @@
+function Get-DSADkimSelectorsFromRecord {
+    <#
+    .SYNOPSIS
+        Extract DKIM selectors from a CSV or object record.
+    .DESCRIPTION
+        Normalizes selector values into a trimmed string array, handling collection and delimited string inputs.
+        Supports both comma and semicolon delimiters for flexible CSV compatibility.
+    .PARAMETER Record
+        Input record containing DKIM selector metadata (expects DkimSelectors or DKIMSelectors property).
+    .OUTPUTS
+        System.String[] - Array of trimmed selector names.
+    .EXAMPLE
+        $selectors = Get-DSADkimSelectorsFromRecord -Record $csvRecord
+        Returns an array of DKIM selector names extracted from the record.
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param (
+        [Parameter(Mandatory = $true)]
+        $Record
+    )
+
+    $dkimSelectorProperty = $Record.PSObject.Properties | Where-Object { $_.Name -in @('DkimSelectors', 'DKIMSelectors') } | Select-Object -First 1
+    if (-not $dkimSelectorProperty) {
+        return [string[]]@()
+    }
+
+    $rawSelectors = $dkimSelectorProperty.Value
+    if ($rawSelectors -is [System.Collections.IEnumerable] -and -not ($rawSelectors -is [string])) {
+        return [string[]]@($rawSelectors | ForEach-Object { "$_".Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    }
+
+    $selectorString = "$rawSelectors".Trim()
+    if ([string]::IsNullOrWhiteSpace($selectorString)) {
+        return [string[]]@()
+    }
+
+    return [string[]]@($selectorString -split '[,;]' | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+}
diff --git a/Private/Get-DSADomainEvidence.Helpers.ps1 b/Private/Get-DSADomainEvidence.Helpers.ps1
new file mode 100644
index 0000000..e5483ca
--- /dev/null
+++ b/Private/Get-DSADomainEvidence.Helpers.ps1
@@ -0,0 +1,209 @@
+<#
+.SYNOPSIS
+    Construct a standardized domain evidence object.
+.DESCRIPTION
+    Wraps the collected domain evidence with domain name and classification for baseline evaluation.
+.PARAMETER Domain
+    Domain name associated with the evidence.
+.PARAMETER Classification
+    DomainDetective classification for the domain.
+.PARAMETER Records
+    Evidence payload containing protocol-specific data.
+#>
+function New-DSADomainEvidenceObject {
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Domain,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Classification,
+
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$Records
+    )
+
+    return [pscustomobject]@{
+        Domain         = $Domain
+        Classification = $Classification
+        Records        = $Records
+    }
+}
+
+function Get-DSAMinPositiveTtl {
+    <#
+    .SYNOPSIS
+        Return the smallest positive TTL from a collection.
+    .DESCRIPTION
+        Iterates values, converts to integers, and returns the minimum positive entry or null.
+    .PARAMETER Values
+        Collection of TTL-like values to evaluate.
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param (
+        $Values
+    )
+
+    $minValue = $null
+    foreach ($value in @($Values)) {
+        $converted = $value -as [int]
+        if ($converted -and $converted -gt 0) {
+            if ($null -eq $minValue -or $converted -lt $minValue) {
+                $minValue = $converted
+            }
+        }
+    }
+
+    return $minValue
+}
+
+function Get-DSAClassificationFromHealth {
+    <#
+    .SYNOPSIS
+        Extract classification from health data.
+    .DESCRIPTION
+        Searches Classification, MailClassification, and MailDomainClassification properties
+        in order and returns the first non-empty value found.
+    .PARAMETER HealthData
+        Health data object from DomainDetective.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [pscustomobject]$HealthData
+    )
+
+    if (-not $HealthData) {
+        return $null
+    }
+
+    $propertyNames = @('Classification', 'MailClassification', 'MailDomainClassification')
+    foreach ($name in $propertyNames) {
+        if ($HealthData.PSObject -and $HealthData.PSObject.Properties.Name -contains $name) {
+            $val = $HealthData.$name
+            if ($val -and -not [string]::IsNullOrWhiteSpace("$val")) {
+                return "$val".Trim()
+            }
+        }
+    }
+
+    return $null
+}
+
+function Get-DSADkimAnalysisResult {
+    <#
+    .SYNOPSIS
+        Process DKIM analysis into standardized output.
+    .DESCRIPTION
+        Extracts DKIM selector information from analysis results and returns a structured object
+        containing selector lists, key lengths, and weak selector counts.
+    .PARAMETER DkimAnalysis
+        DKIM analysis object from DomainDetective.
+    .PARAMETER MinKeyLength
+        Minimum acceptable DKIM key length. Defaults to module-scope DSAMinDkimKeyLength.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param (
+        [pscustomobject]$DkimAnalysis,
+
+        [int]$MinKeyLength = 1024
+    )
+
+    # Use module-scope variable if available
+    if ((Get-Variable -Name DSAMinDkimKeyLength -Scope Script -ErrorAction SilentlyContinue)) {
+        $MinKeyLength = $script:DSAMinDkimKeyLength
+    }
+
+    $dkimList = [System.Collections.Generic.List[object]]::new()
+    $dkimFound = [System.Collections.Generic.List[object]]::new()
+
+    if ($DkimAnalysis -and $DkimAnalysis.AnalysisResults) {
+        foreach ($entry in $DkimAnalysis.AnalysisResults.GetEnumerator()) {
+            $selectorName = $entry.Key
+            $analysisResult = $entry.Value
+            if ($analysisResult -and -not ($analysisResult.PSObject.Properties.Name -contains 'Selector')) {
+                $analysisResult | Add-Member -MemberType NoteProperty -Name 'Selector' -Value $selectorName -Force
+            }
+            if ($analysisResult) {
+                $null = $dkimList.Add($analysisResult)
+                if ($analysisResult.DkimRecordExists) {
+                    $null = $dkimFound.Add($analysisResult)
+                }
+            }
+        }
+    }
+
+    $dkimSelectors = @($dkimFound | ForEach-Object { $_.Selector })
+    $dkimMinKey = $null
+    if ($dkimFound.Count -gt 0) {
+        $keyValues = @($dkimFound | ForEach-Object { $_.KeyLength } | Where-Object { $_ })
+        if ($keyValues) {
+            $dkimMinKey = ($keyValues | Measure-Object -Minimum).Minimum
+        }
+    }
+
+    $dkimWeakCount = 0
+    foreach ($selector in $dkimList) {
+        if (-not $selector.DkimRecordExists -or
+            -not $selector.ValidPublicKey -or
+            -not $selector.ValidRsaKeyLength -or
+            $selector.WeakKey -or
+            (($selector.KeyLength -as [int]) -lt $MinKeyLength)) {
+            $dkimWeakCount++
+        }
+    }
+
+    return [pscustomobject]@{
+        DkimList      = @($dkimList)
+        DkimFound     = @($dkimFound)
+        DkimSelectors = $dkimSelectors
+        DkimMinKey    = $dkimMinKey
+        DkimWeakCount = $dkimWeakCount
+    }
+}
+
+function Resolve-DSATtl {
+    <#
+    .SYNOPSIS
+        Resolve an authoritative TTL with resolver fallback and optional logging.
+    .DESCRIPTION
+        Chooses the minimum positive authoritative TTL when present; otherwise returns the provided resolver TTL while logging fallback.
+    .PARAMETER AuthoritativeValues
+        Collection of authoritative TTL values to evaluate.
+    .PARAMETER ResolverTtl
+        Resolver TTL value to use when authoritative values are absent.
+    .PARAMETER RecordLabel
+        Label used in log messages for clarity.
+    .PARAMETER LogFile
+        Optional log file path for debug messages.
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param (
+        $AuthoritativeValues,
+        $ResolverTtl,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string]$RecordLabel = 'record',
+
+        [string]$LogFile
+    )
+
+    $authoritativeTtl = Get-DSAMinPositiveTtl -Values $AuthoritativeValues
+    if ($null -ne $authoritativeTtl) {
+        if ($LogFile) {
+            Write-DSALog -Message ("Using authoritative {0} TTL {1}" -f $RecordLabel, $authoritativeTtl) -LogFile $LogFile -Level 'DEBUG'
+        }
+        return $authoritativeTtl
+    }
+
+    if ($LogFile) {
+        Write-DSALog -Message ("Authoritative {0} TTL unavailable; falling back to resolver TTL." -f $RecordLabel) -LogFile $LogFile -Level 'DEBUG'
+    }
+
+    return $ResolverTtl
+}
diff --git a/Private/Get-DSADomainEvidence.ps1 b/Private/Get-DSADomainEvidence.ps1
new file mode 100644
index 0000000..2d4fe7b
--- /dev/null
+++ b/Private/Get-DSADomainEvidence.ps1
@@ -0,0 +1,229 @@
+function Get-DSADomainEvidence {
+    <#
+.SYNOPSIS
+    Collects domain security evidence using DomainDetective per-protocol cmdlets.
+.DESCRIPTION
+    Invokes DomainDetective SPF, DKIM, DMARC, MX, TLS-RPT, MTA-STS, and classification checks,
+    returning a normalized object for baseline evaluation without custom parsing/flattening.
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Domain,
+
+        [string]$LogFile,
+
+        [Alias('DkimSelectors')]
+        [string[]]$DkimSelector,
+
+        [string]$ClassificationOverride,
+
+        [string]$DNSEndpoint
+    )
+
+    Import-DSADomainDetectiveModule -LogFile $LogFile
+
+    $dnsEndpointObject = $null
+    if ($PSBoundParameters.ContainsKey('DNSEndpoint') -and -not [string]::IsNullOrWhiteSpace($DNSEndpoint)) {
+        try {
+            $dnsEndpointObject = [DnsClientX.DnsEndpoint]::$DNSEndpoint
+        }
+        catch {
+            $dnsEndpointObject = $DNSEndpoint
+            if ($LogFile) {
+                Write-DSALog -Message ("DNS endpoint '{0}' is not a known DnsClientX.DnsEndpoint value; passing as string." -f $DNSEndpoint) -LogFile $LogFile -Level 'WARN'
+            }
+        }
+    }
+
+    $commonParams = @{
+        DomainName  = $Domain
+        ErrorAction = 'Stop'
+        WarningAction = 'SilentlyContinue'
+    }
+    if ($dnsEndpointObject) {
+        $commonParams['DnsEndpoint'] = $dnsEndpointObject
+    }
+
+    $errors = [System.Collections.Generic.List[string]]::new()
+
+    $health = $null
+    try {
+        $healthParams = $commonParams.Clone()
+        $healthParams['HealthCheckType'] = @('SPF', 'DKIM', 'DMARC', 'MX', 'MTASTS', 'TLSRPT', 'TTL')
+        if ($PSBoundParameters.ContainsKey('DkimSelector')) {
+            $healthParams['DkimSelectors'] = $DkimSelector
+        }
+        $health = Test-DDDomainOverallHealth @healthParams
+    }
+    catch {
+        $null = $errors.Add("Overall health lookup failed for '$Domain': $($_.Exception.Message)")
+    }
+
+    $classificationValue = Get-DSAClassificationFromHealth -HealthData $health
+    if (-not $classificationValue -and $health -and $health.Raw) {
+        $classificationValue = Get-DSAClassificationFromHealth -HealthData $health.Raw
+    }
+
+    if (-not $classificationValue) {
+        try {
+            $classificationLookup = Test-DDMailDomainClassification @commonParams
+            if ($classificationLookup -and $classificationLookup.PSObject.Properties.Name -contains 'Classification') {
+                $classificationValue = "$($classificationLookup.Classification)".Trim()
+            }
+        }
+        catch {
+            $null = $errors.Add("Classification lookup failed for '$Domain': $($_.Exception.Message)")
+        }
+    }
+
+    if ($errors.Count -gt 0 -or -not $health -or -not $health.Raw) {
+        if ($LogFile) {
+            foreach ($err in $errors) {
+                Write-DSALog -Message $err -LogFile $LogFile -Level 'WARN'
+            }
+        }
+        $failureMessage = if ($errors.Count -gt 0) { $errors -join '; ' } else { 'DomainDetective returned no data.' }
+        throw "DomainDetective evidence collection failed for '$Domain': $failureMessage"
+    }
+
+    if ($PSBoundParameters.ContainsKey('ClassificationOverride') -and -not [string]::IsNullOrWhiteSpace($ClassificationOverride)) {
+        $classificationValue = "$ClassificationOverride".Trim()
+        if ($LogFile) {
+            Write-DSALog -Message ("Using classification override '{0}' for '{1}'." -f $classificationValue, $Domain) -LogFile $LogFile -Level 'INFO'
+        }
+    }
+    elseif (-not $classificationValue) {
+        throw "Classification unavailable for '$Domain' after DomainDetective lookups."
+    }
+
+    $rawHealth = $health.Raw
+    $spf = $rawHealth.SpfAnalysis
+    $dkim = $rawHealth.DKIMAnalysis
+    $dmarc = $rawHealth.DmarcAnalysis
+    $mx = $rawHealth.MXAnalysis
+    $mtastsAnalysis = $rawHealth.MTASTSAnalysis
+    $tlsRpt = $rawHealth.TLSRPTAnalysis
+    $ttlAnalysis = $rawHealth.DnsTtlAnalysis
+    if (-not $ttlAnalysis) {
+        $ttlAnalysis = [pscustomobject]@{}
+    }
+
+    $spfRecord = $spf.SpfRecord
+    $spfRecords = $spf.SpfRecords
+    $spfCount = if ($spfRecords) { @($spfRecords).Count } elseif ($spfRecord) { 1 } else { 0 }
+    $spfUnsafe = @($spf.UnknownMechanisms)
+    if ($spf.HasPtrType) { $spfUnsafe += 'ptr' }
+
+    $dkimResult = Get-DSADkimAnalysisResult -DkimAnalysis $dkim
+    $dkimList = $dkimResult.DkimList
+    $dkimFound = $dkimResult.DkimFound
+    $dkimSelectors = $dkimResult.DkimSelectors
+    $dkimMinKey = $dkimResult.DkimMinKey
+    $dkimWeakCount = $dkimResult.DkimWeakCount
+
+    $spfAuthoritativeValues = if ($ttlAnalysis.ServerTtlTxtSpf) { $ttlAnalysis.ServerTtlTxtSpf.Values | Where-Object { $_ } } else { $null }
+    $spfResolverTtl = Get-DSATtlValue -InputObject $spf
+    $spfTtl = Resolve-DSATtl -AuthoritativeValues $spfAuthoritativeValues -ResolverTtl $spfResolverTtl -RecordLabel 'SPF' -LogFile $LogFile
+
+    $dmarcAuthoritativeValues = if ($ttlAnalysis.ServerTtlTxtDmarc) { $ttlAnalysis.ServerTtlTxtDmarc.Values | Where-Object { $_ } } else { $null }
+    $dmarcResolverTtl = Get-DSATtlValue -InputObject $dmarc
+    $dmarcTtl = Resolve-DSATtl -AuthoritativeValues $dmarcAuthoritativeValues -ResolverTtl $dmarcResolverTtl -RecordLabel 'DMARC' -LogFile $LogFile
+
+    $dkimAuthoritativeValues = [System.Collections.Generic.List[object]]::new()
+    if ($ttlAnalysis.ServerTtlTxtPerName) {
+        foreach ($perNameMap in $ttlAnalysis.ServerTtlTxtPerName.Values) {
+            if ($perNameMap) {
+                foreach ($val in ($perNameMap.Values | Where-Object { $_ })) {
+                    $null = $dkimAuthoritativeValues.Add($val)
+                }
+            }
+        }
+    }
+    $dkimResolverTtls = @($dkimFound | ForEach-Object { Get-DSATtlValue -InputObject $_ } | Where-Object { $_ })
+    $dkimResolverMin = if ($dkimResolverTtls) { ($dkimResolverTtls | Measure-Object -Minimum).Minimum } else { $null }
+    $dkimMinTtl = Resolve-DSATtl -AuthoritativeValues $dkimAuthoritativeValues -ResolverTtl $dkimResolverMin -RecordLabel 'DKIM' -LogFile $LogFile
+
+    $mtastsAuthoritativeValues = if ($ttlAnalysis -and $ttlAnalysis.PSObject -and ($ttlAnalysis.PSObject.Properties.Name -contains 'ServerTtlTxtMtasts') -and $ttlAnalysis.ServerTtlTxtMtasts) {
+        $ttlAnalysis.ServerTtlTxtMtasts.Values | Where-Object { $_ }
+    }
+    else { $null }
+    $mtastsResolverTtl = Get-DSATtlValue -InputObject $mtastsAnalysis
+    $mtastsTtl = Resolve-DSATtl -AuthoritativeValues $mtastsAuthoritativeValues -ResolverTtl $mtastsResolverTtl -RecordLabel 'MTA-STS' -LogFile $LogFile
+
+    $tlsRptAuthoritativeValues = if ($ttlAnalysis -and $ttlAnalysis.PSObject -and ($ttlAnalysis.PSObject.Properties.Name -contains 'ServerTtlTxtTlsRpt') -and $ttlAnalysis.ServerTtlTxtTlsRpt) {
+        $ttlAnalysis.ServerTtlTxtTlsRpt.Values | Where-Object { $_ }
+    }
+    else { $null }
+    $tlsRptResolverTtl = Get-DSATtlValue -InputObject $tlsRpt
+    $tlsRptTtl = Resolve-DSATtl -AuthoritativeValues $tlsRptAuthoritativeValues -ResolverTtl $tlsRptResolverTtl -RecordLabel 'TLS-RPT' -LogFile $LogFile
+
+    $mxMinimumTtl = if ($mx.MinMxTtl) { $mx.MinMxTtl } else { Get-DSATtlValue -InputObject $mx -PropertyName @('MxRecordTtl', 'MinMxTtl') }
+
+    if ($LogFile) {
+        $spfAuthCount = if ($ttlAnalysis.ServerTtlTxtSpf) { (@($ttlAnalysis.ServerTtlTxtSpf.Values | Where-Object { $_ })).Count } else { 0 }
+        $dmarcAuthCount = if ($ttlAnalysis.ServerTtlTxtDmarc) { (@($ttlAnalysis.ServerTtlTxtDmarc.Values | Where-Object { $_ })).Count } else { 0 }
+        $dkimAuthCount = 0
+        if ($ttlAnalysis.ServerTtlTxtPerName) {
+            foreach ($perNameMap in $ttlAnalysis.ServerTtlTxtPerName.Values) {
+                if ($perNameMap) {
+                    $dkimAuthCount += (@($perNameMap.Values | Where-Object { $_ })).Count
+                }
+            }
+        }
+        $mtastsAuthCount = if ($ttlAnalysis -and $ttlAnalysis.PSObject -and ($ttlAnalysis.PSObject.Properties.Name -contains 'ServerTtlTxtMtasts') -and $ttlAnalysis.ServerTtlTxtMtasts) { (@($ttlAnalysis.ServerTtlTxtMtasts.Values | Where-Object { $_ })).Count } else { 0 }
+        $tlsRptAuthCount = if ($ttlAnalysis -and $ttlAnalysis.PSObject -and ($ttlAnalysis.PSObject.Properties.Name -contains 'ServerTtlTxtTlsRpt') -and $ttlAnalysis.ServerTtlTxtTlsRpt) { (@($ttlAnalysis.ServerTtlTxtTlsRpt.Values | Where-Object { $_ })).Count } else { 0 }
+        $ttlSourceMessage = "TTL source summary: SPF auth={0} resolver={1}; DMARC auth={2} resolver={3}; DKIM auth={4} resolverMin={5}; MX resolverMin={6}; MTASTS auth={7} resolver={8}; TLSRPT auth={9} resolver={10}" -f `
+            $spfAuthCount, $spf.DnsRecordTtl, `
+            $dmarcAuthCount, $dmarc.DnsRecordTtl, `
+            $dkimAuthCount, $dkimResolverMin, `
+            $mxMinimumTtl, $mtastsAuthCount, $mtastsTtl, `
+            $tlsRptAuthCount, $tlsRptTtl
+        Write-DSALog -Message $ttlSourceMessage -LogFile $LogFile -Level 'DEBUG'
+    }
+
+    $records = [pscustomobject]@{
+        MX                    = $mx.MxRecords
+        MXRecordCount         = @($mx.MxRecords).Count
+        MXHasNull             = $mx.HasNullMx
+        MXMinimumTtl          = $mxMinimumTtl
+
+        SPFRecord             = $spfRecord
+        SPFRecords            = $spfRecords
+        SPFRecordCount        = $spfCount
+        SPFLookupCount        = $spf.DnsLookupsCount
+        SPFTerminalMechanism  = $spf.AllMechanism
+        SPFHasPtrMechanism    = [bool]$spf.HasPtrType
+        SPFRecordLength       = if ($spfRecord) { $spfRecord.Length } else { 0 }
+        SPFTtl                = $spfTtl
+        SPFIncludes           = $spf.IncludeRecords
+        SPFWildcardRecord     = $null
+        SPFWildcardConfigured = $false
+        SPFUnsafeMechanisms   = $spfUnsafe
+
+        DKIMSelectors         = $dkimSelectors
+        DKIMSelectorDetails   = $dkimList
+        DKIMMinKeyLength      = $dkimMinKey
+        DKIMWeakSelectors     = $dkimWeakCount
+        DKIMMinimumTtl        = $dkimMinTtl
+
+        DMARCRecord           = $dmarc.DmarcRecord
+        DMARCPolicy           = $dmarc.Policy
+        DMARCRuaAddresses     = @($dmarc.MailtoRua + $dmarc.HttpRua)
+        DMARCRufAddresses     = @($dmarc.MailtoRuf + $dmarc.HttpRuf)
+        DMARCTtl              = $dmarcTtl
+
+        MTASTSRecordPresent   = [bool]$mtastsAnalysis.DnsRecordPresent
+        MTASTSPolicyValid     = [bool]$mtastsAnalysis.PolicyValid
+        MTASTSMode            = $mtastsAnalysis.Mode
+        MTASTSTtl             = $mtastsTtl
+
+        TLSRPTRecordPresent   = [bool]$tlsRpt.TlsRptRecordExists
+        TLSRPTAddresses       = @($tlsRpt.MailtoRua + $tlsRpt.HttpRua)
+        TLSRPTTtl             = $tlsRptTtl
+    }
+
+    Write-Verbose -Message "Collected DomainDetective evidence for '$Domain'."
+    return New-DSADomainEvidenceObject -Domain $Domain -Classification $classificationValue -Records $records
+}
diff --git a/Private/Import-DSABaselineConfig.ps1 b/Private/Import-DSABaselineConfig.ps1
new file mode 100644
index 0000000..fa68ede
--- /dev/null
+++ b/Private/Import-DSABaselineConfig.ps1
@@ -0,0 +1,23 @@
+function Import-DSABaselineConfig {
+    <#
+.SYNOPSIS
+    Imports a baseline configuration from a .psd1 file.
+.DESCRIPTION
+    Reads the specified PowerShell data file and returns its contents as a hashtable.
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Path
+    )
+
+    $resolvedPath = Resolve-DSAPath -Path $Path -PathType 'File'
+    $extension = [System.IO.Path]::GetExtension($resolvedPath)
+    if ($extension.ToLowerInvariant() -ne '.psd1') {
+        throw "Unsupported baseline profile extension '$extension'. Provide a .psd1 file."
+    }
+
+    return Import-PowerShellDataFile -Path $resolvedPath -ErrorAction Stop
+}
+
diff --git a/Private/Invoke-DSABaselineTest.ps1 b/Private/Invoke-DSABaselineTest.ps1
new file mode 100644
index 0000000..28e80de
--- /dev/null
+++ b/Private/Invoke-DSABaselineTest.ps1
@@ -0,0 +1,181 @@
+function Invoke-DSABaselineTest {
+    <#
+.SYNOPSIS
+    Evaluates domain evidence against baseline check definitions.
+.DESCRIPTION
+    Runs each check in the baseline profile against the provided domain evidence,
+    evaluating conditions and returning pass/fail/warning results for each check.
+.PARAMETER DomainEvidence
+    The domain evidence object from Get-DSADomainEvidence containing Records property.
+.PARAMETER BaselineDefinition
+    Hashtable of baseline profiles keyed by classification name. If omitted, loads default baseline.
+.PARAMETER ClassificationOverride
+    Optional classification to use instead of the evidence-derived classification.
+.OUTPUTS
+    PSCustomObject with Domain, Classification, OverallStatus, and Checks array.
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNull()]
+        [pscustomobject]$DomainEvidence,
+
+        [Parameter()]
+        [hashtable]$BaselineDefinition,
+
+        [string]$ClassificationOverride
+    )
+
+    if (-not $BaselineDefinition) {
+        $baseline = Get-DSABaseline
+        $BaselineDefinition = $baseline.Profiles
+    }
+
+    $effectiveClassification = if (-not [string]::IsNullOrWhiteSpace($ClassificationOverride)) {
+        $ClassificationOverride
+    }
+    else {
+        $DomainEvidence.Classification
+    }
+
+    $classificationKey = Get-DSAClassificationKey -Classification $effectiveClassification
+    if (-not $classificationKey -or -not $BaselineDefinition.ContainsKey($classificationKey)) {
+        $classificationKey = 'Default'
+    }
+
+    $profileDefinition = $BaselineDefinition[$classificationKey]
+    if (-not $profileDefinition -or -not $profileDefinition.Checks) {
+        throw "Baseline profile '$classificationKey' is missing or has no checks defined."
+    }
+
+    $checkResults = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($check in $profileDefinition.Checks) {
+        $expectedValue = $null
+        if ($check -is [hashtable]) {
+            if ($check.ContainsKey('ExpectedValue')) {
+                $expectedValue = $check.ExpectedValue
+            }
+        }
+        elseif ($check.PSObject -and $check.PSObject.Properties.Name -contains 'ExpectedValue') {
+            $expectedValue = $check.ExpectedValue
+        }
+
+        $value = Get-DSAEvidenceValue -DomainEvidence $DomainEvidence -Path $check.Target
+        $conditionMet = Test-DSABaselineCondition -Condition $check.Condition -Value $value -ExpectedValue $expectedValue
+        $status = if ($conditionMet) {
+            'Pass'
+        }
+        elseif (($check.Enforcement ?? 'Required') -ieq 'Required') {
+            'Fail'
+        }
+        else {
+            'Warning'
+        }
+
+        $actualValue = Format-DSAActualValue -Value $value
+        $result = [pscustomobject]@{
+            Id            = $check.Id
+            Area          = $check.Area
+            Status        = $status
+            Severity      = $check.Severity
+            Enforcement   = $check.Enforcement
+            Expectation   = $check.Expectation
+            ExpectedValue = $expectedValue
+            Actual        = $actualValue
+            Remediation   = $check.Remediation
+            References    = $check.References
+        }
+
+        $null = $checkResults.Add($result)
+    }
+
+    $selectorDetails = $null
+    if ($DomainEvidence.PSObject.Properties.Name -contains 'Records' -and $DomainEvidence.Records -and $DomainEvidence.Records.PSObject.Properties.Name -contains 'DKIMSelectorDetails') {
+        $selectorDetails = $DomainEvidence.Records.DKIMSelectorDetails
+    }
+
+    $effectiveChecks = Get-DSAEffectiveChecks -Checks $checkResults -SelectorDetails $selectorDetails
+    $overallStatus = Get-DSAOverallStatus -Checks $effectiveChecks
+    return [pscustomobject]@{
+        Domain                 = $DomainEvidence.Domain
+        Classification         = $profileDefinition.Name
+        OriginalClassification = $DomainEvidence.Classification
+        ClassificationOverride = $ClassificationOverride
+        OverallStatus          = $overallStatus
+        Checks                 = $effectiveChecks
+    }
+}
+
+<#
+.SYNOPSIS
+    Resolve a nested property path from domain evidence.
+.DESCRIPTION
+    Traverses dot-delimited path segments on the evidence object, returning null when any segment is missing.
+.PARAMETER DomainEvidence
+    Domain evidence object produced by Get-DSADomainEvidence.
+.PARAMETER Path
+    Dot-delimited property path to extract.
+#>
+function Get-DSAEvidenceValue {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [pscustomobject]$DomainEvidence,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Path
+    )
+
+    $segments = $Path -split '\.'
+    $current = $DomainEvidence
+
+    foreach ($segment in $segments) {
+        if ($null -eq $current) {
+            return $null
+        }
+
+        if ($current.PSObject.Properties.Name -contains $segment) {
+            $current = $current.$segment
+        }
+        else {
+            return $null
+        }
+    }
+
+    return $current
+}
+
+<#
+.SYNOPSIS
+    Evaluate a baseline condition against an observed value.
+.DESCRIPTION
+    Fetches the condition definition and executes its evaluation scriptblock using the observed and expected values.
+.PARAMETER Condition
+    Baseline condition name.
+.PARAMETER Value
+    Observed value to test.
+.PARAMETER ExpectedValue
+    Expected value payload for the condition.
+#>
+function Test-DSABaselineCondition {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Condition,
+
+        [Parameter()]
+        $Value,
+
+        [Parameter()]
+        [object]$ExpectedValue
+    )
+
+    $definition = Get-DSAConditionDefinition -Name $Condition
+    if (-not $definition -or -not $definition.Evaluate) {
+        return $false
+    }
+
+    return & $definition.Evaluate $Value $ExpectedValue
+}
diff --git a/Private/Invoke-DSALogRetention.ps1 b/Private/Invoke-DSALogRetention.ps1
new file mode 100644
index 0000000..c79e5b0
--- /dev/null
+++ b/Private/Invoke-DSALogRetention.ps1
@@ -0,0 +1,42 @@
+<#
+.SYNOPSIS
+    Prune old log files based on retention count.
+.DESCRIPTION
+    Maintains at most the specified number of .log files in a directory by deleting the oldest entries.
+.PARAMETER LogDirectory
+    Directory containing log files.
+.PARAMETER RetentionCount
+    Maximum number of log files to retain.
+#>
+function Invoke-DSALogRetention {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$LogDirectory,
+
+        [Parameter()]
+        [ValidateRange(1, 365)]
+        [int]$RetentionCount = 30
+    )
+
+    if (-not (Test-Path -Path $LogDirectory)) {
+        return
+    }
+
+    $logFiles = @(Get-ChildItem -Path $LogDirectory -Filter '*.log' -File | Sort-Object -Property LastWriteTime -Descending)
+    if ($logFiles.Count -le $RetentionCount) {
+        return
+    }
+
+    $logsToRemove = $logFiles[$RetentionCount..($logFiles.Count - 1)]
+    foreach ($log in $logsToRemove) {
+        try {
+            Remove-Item -Path $log.FullName -Force -ErrorAction Stop
+        }
+        catch {
+            Write-Warning -Message "Failed to remove log '$($log.Name)': $($_.Exception.Message)"
+        }
+    }
+}
+
diff --git a/Private/Invoke-DomainSecurityAuditor.Helpers.ps1 b/Private/Invoke-DomainSecurityAuditor.Helpers.ps1
new file mode 100644
index 0000000..b3456b6
--- /dev/null
+++ b/Private/Invoke-DomainSecurityAuditor.Helpers.ps1
@@ -0,0 +1,489 @@
+<#
+.SYNOPSIS
+    Create a run context with log/output paths and transcript metadata.
+.DESCRIPTION
+    Resolves output/log directories, enforces retention, starts a transcript, and returns contextual data for the baseline run.
+.PARAMETER OutputRoot
+    Target root directory for generated artifacts.
+.PARAMETER LogRoot
+    Target root directory for logs and transcripts.
+.PARAMETER RetentionCount
+    Maximum number of log files to keep before pruning oldest entries.
+#>
+function New-DSARunContext {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$OutputRoot,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$LogRoot,
+
+        [Parameter()]
+        [ValidateRange(1, 365)]
+        [int]$RetentionCount = 30
+    )
+
+    $resolvedLogRoot = Resolve-DSAPath -Path $LogRoot -EnsureExists
+    $resolvedOutputRoot = Resolve-DSAPath -Path $OutputRoot -EnsureExists
+    Invoke-DSALogRetention -LogDirectory $resolvedLogRoot -RetentionCount $RetentionCount
+
+    $runDate = Get-Date
+    $timestamp = $runDate.ToString('yyyyMMdd_HHmmss')
+    $logFile = Join-Path -Path $resolvedLogRoot -ChildPath "${timestamp}_DomainSecurityAuditor.log"
+    $transcriptFile = Join-Path -Path $resolvedLogRoot -ChildPath "${timestamp}_Transcript.log"
+
+    $transcriptStarted = $false
+    try {
+        $null = Start-Transcript -Path $transcriptFile -Append
+        $transcriptStarted = $true
+    }
+    catch {
+        $transcriptStarted = $false
+        Write-DSALog -Message ("Failed to start transcript: {0}" -f $_.Exception.Message) -LogFile $logFile -Level 'WARN'
+    }
+
+    return [pscustomobject]@{
+        OutputRoot        = $resolvedOutputRoot
+        LogRoot           = $resolvedLogRoot
+        LogFile           = $logFile
+        TranscriptFile    = $transcriptFile
+        TranscriptStarted = $transcriptStarted
+        RunDate           = $runDate
+        Timestamp         = $timestamp
+    }
+}
+
+<#
+.SYNOPSIS
+    Build the effective domain input state for a baseline run.
+.DESCRIPTION
+    Aggregates domains from parameters or files, normalizes metadata (classification, DKIM selectors), and enforces presence of at least one target domain.
+.PARAMETER CollectedDomains
+    Domains supplied directly through parameters or accumulated from file input.
+.PARAMETER DomainMetadata
+    Per-domain metadata such as classification overrides or DKIM selectors.
+.PARAMETER DirectDomainSet
+    Set of domains explicitly provided via parameters (used for override precedence).
+.PARAMETER InputFile
+    Optional path to a CSV or newline-delimited text file containing domains.
+.PARAMETER DefaultClassificationOverride
+    Classification override applied to directly supplied domains when provided.
+.PARAMETER GlobalDkimSelectors
+    DKIM selectors to apply when domain-specific selectors are absent.
+.PARAMETER ResolvedDnsEndpoint
+    Custom DNS endpoint string passed through to DomainDetective.
+.PARAMETER LogFile
+    Path to the run log for diagnostic entries.
+#>
+function Get-DSADomainInputState {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [System.Collections.Generic.List[string]]$CollectedDomains,
+
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [hashtable]$DomainMetadata,
+
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [System.Collections.Generic.HashSet[string]]$DirectDomainSet,
+
+        [string]$InputFile,
+
+        [string]$DefaultClassificationOverride,
+
+        [string[]]$GlobalDkimSelectors,
+
+        [string]$ResolvedDnsEndpoint,
+
+        [string]$LogFile
+    )
+
+    if ($PSBoundParameters.ContainsKey('InputFile')) {
+        $resolvedInput = Resolve-DSAPath -Path $InputFile -PathType 'File'
+        $importedCount = 0
+        [array]$inputRecords = @()
+        try {
+            $inputRecords = @(Import-Csv -Path $resolvedInput -ErrorAction Stop)
+        }
+        catch {
+            if ($LogFile) {
+                Write-DSALog -Message "CSV import failed for '$resolvedInput': $($_.Exception.Message). Attempting line-based fallback." -LogFile $LogFile -Level 'WARN'
+            }
+            $inputRecords = @()
+        }
+
+        foreach ($record in $inputRecords) {
+            if (-not $record) {
+                continue
+            }
+            if ((Test-DSAProperty -InputObject $record -Name 'Domain') -and -not [string]::IsNullOrWhiteSpace($record.Domain)) {
+                $domainValue = $record.Domain.Trim()
+                $record.Domain = $domainValue
+                if ((Test-DSAProperty -InputObject $record -Name 'Classification') -and -not [string]::IsNullOrWhiteSpace($record.Classification)) {
+                    $sourceDescription = "CSV row for '$domainValue'"
+                    $record.Classification = Resolve-DSAClassificationOverride -Value $record.Classification -SourceDescription $sourceDescription
+                    $record | Add-Member -NotePropertyName 'ClassificationSource' -NotePropertyValue 'CSV' -Force
+                }
+
+                $dkimSelectorsFromCsv = Get-DSADkimSelectorsFromRecord -Record $record
+                if ($dkimSelectorsFromCsv) {
+                    $record | Add-Member -NotePropertyName 'DkimSelectors' -NotePropertyValue $dkimSelectorsFromCsv -Force
+                }
+
+                $null = $CollectedDomains.Add($domainValue)
+                $DomainMetadata[$domainValue] = $record
+                $importedCount++
+            }
+        }
+
+        if ($importedCount -eq 0) {
+            $lines = Get-Content -Path $resolvedInput -Encoding UTF8 | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
+            foreach ($line in $lines) {
+                $null = $CollectedDomains.Add($line.Trim())
+            }
+            if ($LogFile) {
+                Write-DSALog -Message "Loaded domains from '$resolvedInput' as newline-delimited text." -LogFile $LogFile
+            }
+        }
+        else {
+            if ($LogFile) {
+                Write-DSALog -Message "Loaded $importedCount domain(s) from '$resolvedInput' (CSV)." -LogFile $LogFile
+            }
+        }
+    }
+
+    $targetDomains = @($CollectedDomains | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique)
+    if (-not $targetDomains) {
+        throw 'No domains were supplied. Provide -Domain or -InputFile.'
+    }
+
+    return [pscustomobject]@{
+        TargetDomains                 = $targetDomains
+        DomainMetadata                = $DomainMetadata
+        DirectDomainSet               = $DirectDomainSet
+        DefaultClassificationOverride = $DefaultClassificationOverride
+        GlobalDkimSelectors           = $GlobalDkimSelectors
+        ResolvedDnsEndpoint           = $ResolvedDnsEndpoint
+    }
+}
+
+<#
+.SYNOPSIS
+    Resolve per-domain execution context prior to evidence collection.
+.DESCRIPTION
+    Determines effective classification, DKIM selectors, and DNS endpoint for a domain using metadata, defaults, and overrides.
+.PARAMETER DomainName
+    The domain being processed.
+.PARAMETER DomainMetadata
+    Metadata hash keyed by domain name with optional classification or selector overrides.
+.PARAMETER DirectDomainSet
+    Set of domains provided directly via parameters.
+.PARAMETER DefaultClassificationOverride
+    Classification override applied to directly supplied domains.
+.PARAMETER GlobalDkimSelectors
+    DKIM selectors applied when per-domain selectors are not supplied.
+.PARAMETER ResolvedDnsEndpoint
+    DNS endpoint string to forward to DomainDetective.
+.PARAMETER LogFile
+    Path to the log file for informational messages.
+#>
+function Resolve-DSADomainContext {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$DomainName,
+
+        [Parameter(Mandatory = $true)]
+        [hashtable]$DomainMetadata,
+
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [System.Collections.Generic.HashSet[string]]$DirectDomainSet,
+
+        [string]$DefaultClassificationOverride,
+
+        [string[]]$GlobalDkimSelectors,
+
+        [string]$ResolvedDnsEndpoint,
+
+        [string]$LogFile
+    )
+
+    $classificationOverride = $null
+    $classificationSource = $null
+    $metadataRecord = $null
+    $dkimSelectors = $null
+
+    if ($DomainMetadata.ContainsKey($DomainName)) {
+        $metadataRecord = $DomainMetadata[$DomainName]
+        if ($metadataRecord -and (Test-DSAProperty -InputObject $metadataRecord -Name 'Classification')) {
+            $classificationCandidate = $metadataRecord.Classification
+            if (-not [string]::IsNullOrWhiteSpace($classificationCandidate)) {
+                $classificationOverride = $classificationCandidate.Trim()
+            }
+        }
+        if ($metadataRecord -and (Test-DSAProperty -InputObject $metadataRecord -Name 'ClassificationSource')) {
+            $classificationSource = $metadataRecord.ClassificationSource
+        }
+
+        if ($metadataRecord -and (Test-DSAProperty -InputObject $metadataRecord -Name 'DkimSelectors')) {
+            $dkimSelectors = @($metadataRecord.DkimSelectors | ForEach-Object { "$_".Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+        }
+    }
+
+    if (-not $classificationOverride -and $DefaultClassificationOverride -and $DirectDomainSet.Contains($DomainName)) {
+        $classificationOverride = $DefaultClassificationOverride
+        $classificationSource = 'Parameter'
+    }
+
+    if (-not $dkimSelectors -and $GlobalDkimSelectors) {
+        $dkimSelectors = $GlobalDkimSelectors
+    }
+
+    if ($classificationOverride) {
+        $sourceText = switch ($classificationSource) {
+            'CSV' { 'CSV metadata' }
+            'Parameter' { 'command parameter' }
+            default { 'metadata' }
+        }
+        if ($LogFile) {
+            Write-DSALog -Message ("Classification override '{0}' detected for '{1}' from {2}." -f $classificationOverride, $DomainName, $sourceText) -LogFile $LogFile -Level 'INFO'
+        }
+    }
+
+    if ($LogFile) {
+        if ($dkimSelectors) {
+            Write-DSALog -Message ("Using custom DKIM selectors for '{0}': {1}" -f $DomainName, ($dkimSelectors -join ', ')) -LogFile $LogFile -Level 'DEBUG'
+        }
+        else {
+            Write-DSALog -Message ("Using DomainDetective default DKIM selectors for '{0}'." -f $DomainName) -LogFile $LogFile -Level 'DEBUG'
+        }
+    }
+
+    if (-not [string]::IsNullOrWhiteSpace($ResolvedDnsEndpoint) -and $LogFile) {
+        Write-DSALog -Message ("Using DNS endpoint '{0}' for '{1}'." -f $ResolvedDnsEndpoint, $DomainName) -LogFile $LogFile -Level 'DEBUG'
+    }
+
+    return [pscustomobject]@{
+        ClassificationOverride = $classificationOverride
+        ClassificationSource   = $classificationSource
+        DkimSelectors          = $dkimSelectors
+        ResolvedDnsEndpoint    = $ResolvedDnsEndpoint
+    }
+}
+
+<#
+.SYNOPSIS
+    Execute the baseline workflow for a single domain.
+.DESCRIPTION
+    Resolves domain context, collects evidence, evaluates against baseline profiles, and returns a compliance profile with metadata.
+.PARAMETER DomainName
+    Domain to process.
+.PARAMETER DomainMetadata
+    Hash table of domain metadata loaded from inputs.
+.PARAMETER DirectDomainSet
+    Set of domains provided directly via parameters.
+.PARAMETER DefaultClassificationOverride
+    Classification override applied to directly provided domains when present.
+.PARAMETER GlobalDkimSelectors
+    DKIM selectors to use when none are supplied per domain.
+.PARAMETER ResolvedDnsEndpoint
+    DNS endpoint string forwarded to DomainDetective.
+.PARAMETER BaselineProfiles
+    Baseline profile definitions keyed by classification.
+.PARAMETER OutputRoot
+    Output root for generated artifacts.
+.PARAMETER LogFile
+    Path to the log file for progress and debug messages.
+.PARAMETER CurrentIndex
+    Current domain position within the batch.
+.PARAMETER TotalCount
+    Total number of domains in the batch.
+.PARAMETER ShowProgress
+    Controls Write-Progress output.
+#>
+function Invoke-DSADomainRun {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$DomainName,
+
+        [Parameter(Mandatory = $true)]
+        [hashtable]$DomainMetadata,
+
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [System.Collections.Generic.HashSet[string]]$DirectDomainSet,
+
+        [string]$DefaultClassificationOverride,
+
+        [string[]]$GlobalDkimSelectors,
+
+        [string]$ResolvedDnsEndpoint,
+
+        [Parameter(Mandatory = $true)]
+        [hashtable]$BaselineProfiles,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$OutputRoot,
+
+        [string]$LogFile,
+
+        [int]$CurrentIndex,
+
+        [int]$TotalCount,
+
+        [switch]$ShowProgress
+    )
+
+    if ($ShowProgress) {
+        $progressSplat = @{
+            Activity        = 'Domain Security Auditor'
+            Status          = "Processing $DomainName (${CurrentIndex}/$TotalCount)"
+            PercentComplete = [int](($CurrentIndex / [math]::Max($TotalCount, 1)) * 100)
+        }
+        Write-Progress @progressSplat
+    }
+
+    $domainContext = Resolve-DSADomainContext -DomainName $DomainName -DomainMetadata $DomainMetadata -DirectDomainSet $DirectDomainSet -DefaultClassificationOverride $DefaultClassificationOverride -GlobalDkimSelectors $GlobalDkimSelectors -ResolvedDnsEndpoint $ResolvedDnsEndpoint -LogFile $LogFile
+
+    if ($LogFile) {
+        Write-DSALog -Message "Collecting evidence for '$DomainName'." -LogFile $LogFile -Level 'DEBUG'
+    }
+
+    $evidenceParams = @{
+        Domain  = $DomainName
+        LogFile = $LogFile
+    }
+    if ($domainContext.ClassificationOverride) {
+        $evidenceParams.ClassificationOverride = $domainContext.ClassificationOverride
+    }
+    if ($domainContext.DkimSelectors) {
+        $evidenceParams.DkimSelector = $domainContext.DkimSelectors
+    }
+
+    if (-not [string]::IsNullOrWhiteSpace($domainContext.ResolvedDnsEndpoint)) {
+        $evidenceParams.DNSEndpoint = $domainContext.ResolvedDnsEndpoint
+    }
+
+    $evidence = Get-DSADomainEvidence @evidenceParams
+    $baselineProfile = Invoke-DSABaselineTest -DomainEvidence $evidence -BaselineDefinition $BaselineProfiles -ClassificationOverride $domainContext.ClassificationOverride
+
+    $effectiveChecks = if ($baselineProfile.Checks) { @($baselineProfile.Checks | Where-Object { $_ }) } else { @() }
+    $statusCounts = Get-DSAStatusCounts -Checks $effectiveChecks
+
+    $profileWithMetadata = [pscustomobject]@{
+        Domain                 = $baselineProfile.Domain
+        Classification         = $baselineProfile.Classification
+        OriginalClassification = $baselineProfile.OriginalClassification
+        ClassificationOverride = $baselineProfile.ClassificationOverride
+        OverallStatus          = $baselineProfile.OverallStatus
+        Checks                 = $effectiveChecks
+        EffectiveChecks        = $effectiveChecks
+        StatusCounts           = $statusCounts
+        Evidence               = $evidence.Records
+        OutputPath             = $OutputRoot
+        Timestamp              = (Get-Date)
+        ReportPath             = $null
+    }
+
+    if ($LogFile) {
+        Write-DSALog -Message ("Completed baseline for '{0}' with status '{1}'." -f $DomainName, $baselineProfile.OverallStatus) -LogFile $LogFile
+    }
+
+    return $profileWithMetadata
+}
+
+<#
+.SYNOPSIS
+    Emit a console summary of baseline results.
+.DESCRIPTION
+    Computes aggregated pass/warning/fail counts across processed domains and writes a short summary to the information stream.
+.PARAMETER Profiles
+    Compliance profiles produced by Invoke-DSADomainRun.
+.PARAMETER ReportPath
+    Path to the generated HTML report.
+#>
+function Write-DSABaselineConsoleSummary {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [pscustomobject[]]$Profiles,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$ReportPath
+    )
+
+    $domainSummaries = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($baselineProfile in $Profiles) {
+        $selectorDetails = $null
+        if ($baselineProfile -and (Test-DSAProperty -InputObject $baselineProfile -Name 'Evidence') -and $baselineProfile.Evidence -and (Test-DSAProperty -InputObject $baselineProfile.Evidence -Name 'DKIMSelectorDetails')) {
+            $selectorDetails = $baselineProfile.Evidence.DKIMSelectorDetails
+        }
+
+        $checks = if ((Test-DSAProperty -InputObject $baselineProfile -Name 'EffectiveChecks') -and $baselineProfile.EffectiveChecks) {
+            @($baselineProfile.EffectiveChecks | Where-Object { $_ })
+        }
+        else {
+            Get-DSAEffectiveChecks -Checks ($baselineProfile.Checks | Where-Object { $_ }) -SelectorDetails $selectorDetails
+        }
+
+        $counts = if ((Test-DSAProperty -InputObject $baselineProfile -Name 'StatusCounts') -and $baselineProfile.StatusCounts) {
+            $baselineProfile.StatusCounts
+        }
+        else {
+            Get-DSAStatusCounts -Checks $checks
+        }
+        $rank = switch ($baselineProfile.OverallStatus) {
+            'Fail' { 0 }
+            'Warning' { 1 }
+            default { 2 }
+        }
+
+        $summaryItem = [pscustomobject]@{
+            Rank   = $rank
+            Domain = $baselineProfile.Domain
+            Status = $baselineProfile.OverallStatus
+            Pass   = $counts.Pass
+            Warn   = $counts.Warning
+            Fail   = $counts.Fail
+        }
+        $domainSummaries.Add($summaryItem)
+    }
+
+    $sortedSummaries = $domainSummaries | Sort-Object -Property @{ Expression = { $_.Rank } }, @{ Expression = { $_.Domain } }
+    $widths = Get-DSAColumnWidths -Summaries @($sortedSummaries) -Properties @('Pass', 'Warn', 'Fail')
+    $passWidth = $widths['Pass']
+    $warnWidth = $widths['Warn']
+    $failWidth = $widths['Fail']
+    $domainCount = ($Profiles | Measure-Object).Count
+
+    Write-Information -MessageData '' -InformationAction Continue
+    Write-Information -MessageData ("Baselines complete ({0} domain{1})" -f $domainCount, $(if ($domainCount -ne 1) { 's' } else { '' })) -InformationAction Continue
+    foreach ($summary in $sortedSummaries) {
+        $indicator = switch ($summary.Status) {
+            'Fail' { '[FAIL]' }
+            'Warning' { '[WARN]' }
+            default { '[PASS]' }
+        }
+
+        $line = "  {0} {1} (Pass {2,$passWidth} | Warn {3,$warnWidth} | Fail {4,$failWidth})" -f $indicator, $summary.Domain, $summary.Pass, $summary.Warn, $summary.Fail
+        Write-Information -MessageData $line -InformationAction Continue
+    }
+
+    Write-Information -MessageData '' -InformationAction Continue
+    Write-Information -MessageData 'Report:' -InformationAction Continue
+    Write-Information -MessageData ("  {0}" -f $ReportPath) -InformationAction Continue
+    Write-Information -MessageData '' -InformationAction Continue
+}
diff --git a/Private/Open-DSAReport.ps1 b/Private/Open-DSAReport.ps1
new file mode 100644
index 0000000..1355f22
--- /dev/null
+++ b/Private/Open-DSAReport.ps1
@@ -0,0 +1,49 @@
+function Open-DSAReport {
+    <#
+.SYNOPSIS
+    Opens a generated report file in the default viewer.
+.DESCRIPTION
+    Launches the specified report file using the system default application. Falls back to
+    platform-specific commands (explorer/open/xdg-open) if the initial attempt fails.
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Path,
+
+        [string]$LogFile
+    )
+
+    $resolved = Resolve-DSAPath -Path $Path -PathType 'File'
+
+    $opened = $false
+    try {
+        $null = Start-Process -FilePath $resolved -ErrorAction Stop
+        $opened = $true
+    }
+    catch {
+        try {
+            if ($IsWindows) {
+                $null = Start-Process -FilePath 'explorer.exe' -ArgumentList "`"$resolved`"" -ErrorAction Stop
+            }
+            elseif ($IsMacOS) {
+                $null = Start-Process -FilePath 'open' -ArgumentList "`"$resolved`"" -ErrorAction Stop
+            }
+            else {
+                $null = Start-Process -FilePath 'xdg-open' -ArgumentList "`"$resolved`"" -ErrorAction Stop
+            }
+            $opened = $true
+        }
+        catch {
+            if ($LogFile) {
+                Write-DSALog -Message "Failed to launch report viewer: $($_.Exception.Message)" -LogFile $LogFile -Level 'WARN'
+            }
+        }
+    }
+
+    if ($opened -and $LogFile) {
+        Write-DSALog -Message "Opened compliance report '$resolved'." -LogFile $LogFile -Level 'INFO'
+    }
+}
+
diff --git a/Private/Publish-DSAHtmlReport.ps1 b/Private/Publish-DSAHtmlReport.ps1
new file mode 100644
index 0000000..758d3bc
--- /dev/null
+++ b/Private/Publish-DSAHtmlReport.ps1
@@ -0,0 +1,560 @@
+<#
+.SYNOPSIS
+    Render compliance profiles into an HTML report.
+.DESCRIPTION
+    Builds an accessible HTML report with summary cards, per-domain sections, and DKIM selector breakdowns, then saves to the output directory.
+.PARAMETER Profiles
+    Compliance profiles to render.
+.PARAMETER OutputRoot
+    Root directory where the report will be written.
+.PARAMETER GeneratedOn
+    Timestamp used for metadata and filename.
+.PARAMETER BaselineName
+    Name of the baseline used during evaluation.
+.PARAMETER BaselineVersion
+    Version of the baseline used during evaluation.
+.PARAMETER LogFile
+    Optional log file path for write notifications.
+#>
+function Publish-DSAHtmlReport {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [pscustomobject[]]$Profiles,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$OutputRoot,
+
+        [Parameter(Mandatory = $true)]
+        [datetime]$GeneratedOn,
+
+        [string]$BaselineName,
+
+        [string]$BaselineVersion,
+
+        [string]$LogFile
+    )
+
+    $profilesList = @($Profiles)
+    if (-not $profilesList -or $profilesList.Count -eq 0) {
+        throw 'No compliance profiles were supplied to Publish-DSAHtmlReport.'
+    }
+
+    $reportsRoot = Resolve-DSAPath -Path (Join-Path -Path $OutputRoot -ChildPath 'Reports') -EnsureExists
+    $reportFileName = 'domain_security_auditor_report_{0}.html' -f $GeneratedOn.ToString('yyyyMMdd_HHmmss')
+    $reportPath = Join-Path -Path $reportsRoot -ChildPath $reportFileName
+
+    $summary = Get-DSAReportSummary -Profiles $profilesList
+    $module = Get-Module -Name DomainSecurityAuditor -ErrorAction SilentlyContinue | Select-Object -First 1
+    $moduleVersion = if ($module) { $module.Version.ToString() } else { 'unknown' }
+    $baselineNameText = if ($BaselineName) { $BaselineName } else { 'Baseline' }
+    $baselineVersionText = if ($BaselineVersion) { " v$BaselineVersion" } else { '' }
+    $testSuiteText = "Test Suite: $baselineNameText$baselineVersionText"
+
+    $builder = [System.Text.StringBuilder]::new()
+    $null = $builder.AppendLine('<!DOCTYPE html>')
+    $null = $builder.AppendLine('<html lang="en">')
+    $null = $builder.AppendLine('<head>')
+    $null = $builder.AppendLine('    <meta charset="UTF-8">')
+    $null = $builder.AppendLine('    <meta name="viewport" content="width=device-width, initial-scale=1.0">')
+    $null = $builder.AppendLine('    <title>Domain Security Auditor Report</title>')
+    $null = $builder.AppendLine('    <style>')
+    $null = $builder.AppendLine((Get-DSAReportStyles))
+    $null = $builder.AppendLine('    </style>')
+    $null = $builder.AppendLine('</head>')
+    $null = $builder.AppendLine('<body>')
+    $null = $builder.AppendLine('  <a href="#main-content" class="skip-link">Skip to main content</a>')
+    $null = $builder.AppendLine('  <main class="container" id="main-content" role="main">')
+    $null = $builder.AppendLine('    <header class="header">')
+    $null = $builder.AppendLine('      <h1>Domain Security Auditor Report</h1>')
+    $localTimeZone = [System.TimeZoneInfo]::Local
+    $timeZoneSuffix = if ($localTimeZone.IsDaylightSavingTime($GeneratedOn)) { $localTimeZone.DaylightName } else { $localTimeZone.StandardName }
+    $collectedText = '{0} {1}' -f ($GeneratedOn.ToString('MMMM d, yyyy h:mm tt')), $timeZoneSuffix
+    $null = $builder.AppendLine(('      <div class="meta">Collected: {0}</div>' -f (ConvertTo-DSAHtml $collectedText)))
+    $null = $builder.AppendLine(('      <div class="meta">{0}</div>' -f (ConvertTo-DSAHtml $testSuiteText)))
+    $null = $builder.AppendLine('    </header>')
+
+    Add-DSASummaryCards -Builder $builder -Summary $summary
+    Add-DSADomainSections -Builder $builder -Profiles $profilesList
+
+    $null = $builder.AppendLine('    <footer class="footer">')
+    $poweredByHtml = 'Powered by <a href="https://github.com/EvotecIT/DomainDetective" target="_blank" rel="noopener">DomainDetective</a> + <a href="https://github.com/pester/Pester" target="_blank" rel="noopener">Pester</a>'
+    $null = $builder.AppendLine(("      <p><strong>DomainSecurityAuditor v{0}</strong> | {1}</p>" -f $moduleVersion, $poweredByHtml))
+    $projectHtml = '<a href="https://github.com/thetechgy/DomainSecurityAuditor" target="_blank" rel="noopener">DomainSecurityAuditor on GitHub</a>'
+    $null = $builder.AppendLine(("      <p class=""footer-secondary"">{0}</p>" -f $projectHtml))
+    $null = $builder.AppendLine('    </footer>')
+    $null = $builder.AppendLine('    <div class="back-to-top-wrapper">')
+    $null = $builder.AppendLine('      <a class="back-to-top" href="#main-content" aria-label="Back to the top of the report">↑ Back to top</a>')
+    $null = $builder.AppendLine('    </div>')
+
+    $null = $builder.AppendLine('  </main>')
+    $null = $builder.AppendLine('  <script>')
+    $null = $builder.AppendLine((Get-DSAReportScript))
+    $null = $builder.AppendLine('  </script>')
+    $null = $builder.AppendLine('</body>')
+    $null = $builder.AppendLine('</html>')
+
+    Set-Content -Path $reportPath -Value $builder.ToString() -Encoding UTF8
+    if ($LogFile) {
+        Write-DSALog -Message "HTML report saved to '$reportPath'." -LogFile $LogFile
+    }
+    return $reportPath
+}
+
+<#
+.SYNOPSIS
+    Append summary cards to the report builder.
+.DESCRIPTION
+    Writes status-based summary cards and filter controls into the HTML builder using the supplied summary object.
+.PARAMETER Builder
+    StringBuilder that accumulates HTML output.
+.PARAMETER Summary
+    Summary object from Get-DSAReportSummary.
+#>
+function Add-DSASummaryCards {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)][System.Text.StringBuilder]$Builder,
+        [Parameter(Mandatory = $true)][pscustomobject]$Summary
+    )
+
+    $null = $Builder.AppendLine('    <section class="summary">')
+    $null = $Builder.AppendLine('      <div class="summary-cards">')
+    foreach ($card in $Summary.Cards) {
+        $styleClass = Get-DSAStatusClassName -Status $card.Style
+        $icon = Get-DSAStatusIcon -Status $card.Style
+        $isFilterable = -not [string]::IsNullOrWhiteSpace($card.Filter)
+        $cardClasses = if ($isFilterable) { 'card filter-card' } else { 'card' }
+        $filterAttr = if ($isFilterable) { " data-filter=""$($card.Filter)""" } else { '' }
+        $ariaAttr = if ($isFilterable) { ' aria-pressed="false" role="button" tabindex="0"' } else { '' }
+        $null = $Builder.AppendLine(("        <div class=""{0}""{1}{2}>" -f $cardClasses, $filterAttr, $ariaAttr))
+        $null = $Builder.AppendLine('          <div class="card-header">')
+        $null = $Builder.AppendLine(("            <div class='card-icon {0}'>{1}</div>" -f $styleClass, (ConvertTo-DSAHtml $icon)))
+        $null = $Builder.AppendLine(("            <div class='card-title'>{0}</div>" -f (ConvertTo-DSAHtml $card.Label)))
+        $null = $Builder.AppendLine('          </div>')
+        $null = $Builder.AppendLine(("          <div class='card-value {0}'>{1}</div>" -f $styleClass, (ConvertTo-DSAHtml $card.Value)))
+        if ($card.Description) {
+            $null = $Builder.AppendLine(("          <div class='card-subtitle'>{0}</div>" -f (ConvertTo-DSAHtml $card.Description)))
+        }
+        $null = $Builder.AppendLine('        </div>')
+    }
+    $null = $Builder.AppendLine('      </div>')
+    $null = $Builder.AppendLine('      <div class="filter-summary" id="filter-summary" aria-live="polite">Showing: All checks</div>')
+    $null = $Builder.AppendLine('    </section>')
+}
+
+<#
+.SYNOPSIS
+    Append per-domain result sections to the report.
+.DESCRIPTION
+    Iterates profiles, grouping checks by protocol area and adding interactive sections with status metadata.
+.PARAMETER Builder
+    StringBuilder that accumulates HTML output.
+.PARAMETER Profiles
+    Compliance profiles to render.
+#>
+function Add-DSADomainSections {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)][System.Text.StringBuilder]$Builder,
+        [Parameter(Mandatory = $true)][pscustomobject[]]$Profiles
+    )
+
+    $null = $Builder.AppendLine('    <div class="section-controls" role="group" aria-label="Protocol section controls">')
+    $null = $Builder.AppendLine('      <button type="button" class="section-toggle" id="toggle-all-sections" aria-pressed="false">Expand all sections</button>')
+    $null = $Builder.AppendLine('    </div>')
+
+    foreach ($domainProfile in $Profiles) {
+        $statusClass = Get-DSAStatusClassName -Status $domainProfile.OverallStatus
+        $statusAttr = switch ($statusClass) {
+            'passed' { 'pass' }
+            'failed' { 'fail' }
+            'warning' { 'warning' }
+            default { 'info' }
+        }
+        $checks = if ((Test-DSAProperty -InputObject $domainProfile -Name 'EffectiveChecks') -and $domainProfile.EffectiveChecks) {
+            @($domainProfile.EffectiveChecks | Where-Object { $_ })
+        }
+        elseif ($domainProfile.Checks) {
+            @($domainProfile.Checks | Where-Object { $_ })
+        }
+        else { @() }
+        $checkCount = ($checks | Measure-Object).Count
+        $metaSegments = [System.Collections.Generic.List[string]]::new()
+        $hasOverride = $false
+        if ((Test-DSAProperty -InputObject $domainProfile -Name 'ClassificationOverride') -and -not [string]::IsNullOrWhiteSpace($domainProfile.ClassificationOverride)) {
+            $null = $metaSegments.Add(("Override: {0}" -f $domainProfile.ClassificationOverride))
+            $hasOverride = $true
+        }
+        if ($domainProfile.OriginalClassification) {
+            $label = if ($hasOverride) { 'Detected' } else { 'Detected' }
+            $null = $metaSegments.Add(("{0}: {1}" -f $label, $domainProfile.OriginalClassification))
+        }
+        if ($checkCount -gt 0) {
+            $null = $metaSegments.Add(("{0} checks executed" -f $checkCount))
+        }
+        $statusText = if ($domainProfile.OverallStatus) { $domainProfile.OverallStatus.ToUpperInvariant() } else { '' }
+
+        $null = $Builder.AppendLine(("    <section class=""domain-results status-{0}"" data-status=""{0}"">" -f $statusAttr))
+        $null = $Builder.AppendLine('      <div class="domain-header">')
+        $null = $Builder.AppendLine('        <div class="domain-title">')
+        $null = $Builder.AppendLine(("          <div class='domain-name'>{0}</div>" -f (ConvertTo-DSAHtml $domainProfile.Domain)))
+        $null = $Builder.AppendLine(("          <span class='domain-status {0}'>{1}</span>" -f $statusClass, (ConvertTo-DSAHtml $statusText)))
+        $null = $Builder.AppendLine('        </div>')
+        if ($metaSegments.Count -gt 0) {
+            $metaText = [string]::Join(' • ', $metaSegments)
+            $null = $Builder.AppendLine(("        <div class='domain-meta'>{0}</div>" -f (ConvertTo-DSAHtml $metaText)))
+        }
+        $null = $Builder.AppendLine('      </div>')
+
+        if ($checkCount -eq 0) {
+            $null = $Builder.AppendLine('      <div class="domain-empty">No checks were evaluated for this domain.</div>')
+            $null = $Builder.AppendLine('    </section>')
+            continue
+        }
+
+        $groupedChecks = $checks | Group-Object -Property Area
+        $domainSlug = ($domainProfile.Domain -replace '[^a-zA-Z0-9]', '-').ToLowerInvariant()
+        foreach ($group in $groupedChecks) {
+            Add-DSAProtocolSection -Builder $Builder -Group $group -DomainSlug $domainSlug -DomainProfile $domainProfile
+        }
+
+        $null = $Builder.AppendLine('    </section>')
+    }
+}
+
+<#
+.SYNOPSIS
+    Render a protocol-specific section for a domain.
+.DESCRIPTION
+    Builds the expandable section for a protocol area, including aggregated status and individual test results.
+.PARAMETER Builder
+    StringBuilder for HTML output.
+.PARAMETER Group
+    Grouped set of checks for the protocol area.
+.PARAMETER DomainSlug
+    Sanitized domain identifier used in element ids.
+.PARAMETER DomainProfile
+    Compliance profile for the domain.
+#>
+function Add-DSAProtocolSection {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)][System.Text.StringBuilder]$Builder,
+        [Parameter(Mandatory = $true)][System.Management.Automation.PSObject]$Group,
+        [string]$DomainSlug,
+        [pscustomobject]$DomainProfile
+    )
+
+    if (-not $Group -or -not $Group.Group) {
+        return
+    }
+
+    $groupChecks = @($Group.Group | Where-Object { $_ })
+    if ($groupChecks.Count -eq 0) {
+        return
+    }
+
+    $checkCount = ($groupChecks | Measure-Object).Count
+    $sectionClass = 'protocol-section'
+    $detailsClass = 'protocol-details'
+    $checkLabel = if ($checkCount -eq 1) { '1 check' } else { ('{0} checks' -f $checkCount) }
+    $areaSlug = ($Group.Name -replace '[^a-zA-Z0-9]', '-').ToLowerInvariant()
+    $detailsId = "protocol-{0}-{1}" -f $DomainSlug, $areaSlug
+
+    $selectorDetails = $null
+    if (($Group.Name -eq 'DKIM') -and $DomainProfile -and (Test-DSAProperty -InputObject $DomainProfile -Name 'Evidence')) {
+        $selectorDetails = $DomainProfile.Evidence.DKIMSelectorDetails
+    }
+
+    $effectiveChecks = if ((Test-DSAProperty -InputObject $DomainProfile -Name 'EffectiveChecks') -and $DomainProfile.EffectiveChecks) {
+        $groupChecks
+    }
+    else {
+        Get-DSAEffectiveChecks -Checks $groupChecks -SelectorDetails $selectorDetails
+    }
+    $areaStatus = Get-DSAOverallStatus -Checks $effectiveChecks
+    $statusClass = Get-DSAStatusClassName -Status $areaStatus
+
+    $null = $Builder.AppendLine(("      <div class=""{0}"">" -f $sectionClass))
+    $null = $Builder.AppendLine(("        <div class=""protocol-header"" role=""button"" tabindex=""0"" aria-expanded=""false"" aria-controls=""{0}"">" -f $detailsId))
+    $null = $Builder.AppendLine(("          <div class='protocol-name'>{0}</div>" -f (ConvertTo-DSAHtml $Group.Name)))
+    $null = $Builder.AppendLine('          <div class="protocol-status">')
+    $null = $Builder.AppendLine(("            <span class='status-badge {0}'><span class='sr-only'>Status: </span>{1}</span>" -f $statusClass, (ConvertTo-DSAHtml $areaStatus)))
+    $null = $Builder.AppendLine(("            <span class='protocol-count'>{0}</span>" -f $checkLabel))
+    $null = $Builder.AppendLine('            <span class="chevron" aria-hidden="true">▶</span>')
+    $null = $Builder.AppendLine('          </div>')
+    $null = $Builder.AppendLine('        </div>')
+    $null = $Builder.AppendLine(("        <div class=""{0}"" id=""{1}"" aria-hidden=""true"">" -f $detailsClass, $detailsId))
+
+    foreach ($check in $effectiveChecks) {
+        Add-DSATestResult -Builder $Builder -Check $check -Selectors $selectorDetails
+    }
+
+    $null = $Builder.AppendLine('        </div>')
+    $null = $Builder.AppendLine('      </div>')
+}
+
+<#
+.SYNOPSIS
+    Render a single test result card.
+.DESCRIPTION
+    Writes the test header, expectation, observed values, remediation, references, and DKIM selector breakdowns when applicable.
+.PARAMETER Builder
+    StringBuilder for HTML output.
+.PARAMETER Check
+    Baseline check result to render.
+.PARAMETER Selectors
+    Optional DKIM selector details for DKIM check enrichment.
+#>
+function Add-DSATestResult {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)][System.Text.StringBuilder]$Builder,
+        [Parameter(Mandatory = $true)][pscustomobject]$Check,
+        [pscustomobject[]]$Selectors
+    )
+
+    if (-not $Check) {
+        return
+    }
+
+    $effectiveStatus = $Check.Status
+    $statusClass = Get-DSAStatusClassName -Status $effectiveStatus
+    $statusIcon = Get-DSAStatusIcon -Status $effectiveStatus
+    $filterStatus = Get-DSAFilterStatus -Status $effectiveStatus
+    $detailItems = [System.Collections.Generic.List[object]]::new()
+    $suppressActual = ($Check.Area -eq 'DKIM' -and $Check.Id -in @('DKIMKeyStrength', 'DKIMTtl'))
+    if (-not $suppressActual -and (Test-DSAProperty -InputObject $Check -Name 'Actual') -and ($null -ne $Check.Actual)) {
+        $valueHtml = ConvertTo-DSAValueHtml -Value $Check.Actual
+        $null = $detailItems.Add([pscustomobject]@{
+                Label  = 'Observed Value'
+                Value  = $valueHtml
+                IsHtml = $true
+            })
+    }
+    elseif ($suppressActual) {
+        $null = $detailItems.Add([pscustomobject]@{
+                Label  = 'Observed Value'
+                Value  = 'See selector details below'
+                IsHtml = $false
+            })
+    }
+    if ($Check.Severity) {
+        $null = $detailItems.Add([pscustomobject]@{
+                Label  = 'Severity'
+                Value  = $Check.Severity
+                IsHtml = $false
+            })
+    }
+    if ((Test-DSAProperty -InputObject $Check -Name 'Enforcement') -and $Check.Enforcement) {
+        $null = $detailItems.Add([pscustomobject]@{
+                Label  = 'Enforcement'
+                Value  = $Check.Enforcement
+                IsHtml = $false
+            })
+    }
+
+    $null = $Builder.AppendLine(("          <div class=""test-result"" data-status=""{0}"">" -f (ConvertTo-DSAHtml $filterStatus)))
+    $null = $Builder.AppendLine('            <div class="test-header">')
+    $null = $Builder.AppendLine(("              <div class='test-icon {0}' aria-label='{1} status'>{2}</div>" -f $statusClass, (ConvertTo-DSAHtml $effectiveStatus), (ConvertTo-DSAHtml $statusIcon)))
+    $null = $Builder.AppendLine('              <div class="test-content">')
+    $null = $Builder.AppendLine('                <div class="test-title-row">')
+    $null = $Builder.AppendLine(("                  <div class='test-name'>{0}</div>" -f (ConvertTo-DSAHtml $Check.Id)))
+    $null = $Builder.AppendLine(("                  <span class='status-pill {0}'><span class='sr-only'>Status: </span>{1}</span>" -f $statusClass, (ConvertTo-DSAHtml $Check.Status)))
+    $null = $Builder.AppendLine('                </div>')
+    if ($Check.Expectation) {
+        $null = $Builder.AppendLine(("                <div class='test-message'>{0}</div>" -f (ConvertTo-DSAHtml $Check.Expectation)))
+    }
+
+    if ($detailItems.Count -gt 0) {
+        $null = $Builder.AppendLine('                <div class="details-grid">')
+        foreach ($detail in $detailItems) {
+            $valueText = if ($detail.IsHtml) { $detail.Value } else { ConvertTo-DSAHtml -Value $detail.Value }
+            $null = $Builder.AppendLine('                  <div class="detail-item">')
+            $null = $Builder.AppendLine(("                    <div class='detail-label'>{0}</div>" -f (ConvertTo-DSAHtml $detail.Label)))
+            $null = $Builder.AppendLine(("                    <div class='detail-value'>{0}</div>" -f $valueText))
+            $null = $Builder.AppendLine('                  </div>')
+        }
+        $null = $Builder.AppendLine('                </div>')
+    }
+
+    if ($Check.Remediation -and ($Check.Status -ne 'Pass')) {
+        $null = $Builder.AppendLine('                <div class="test-recommendation">')
+        $null = $Builder.AppendLine('                  <div class="label">Remediation</div>')
+        $null = $Builder.AppendLine(("                  <div class='text'>{0}</div>" -f (ConvertTo-DSAHtml $Check.Remediation)))
+        $null = $Builder.AppendLine('                </div>')
+    }
+
+    if ($Check.References -and @($Check.References).Count -gt 0) {
+        $references = @($Check.References) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
+        if ($references) {
+            $null = $Builder.AppendLine('                <div class="test-references">')
+            foreach ($ref in $references) {
+                $referenceHtml = ConvertTo-DSAReferenceHtml -Reference $ref
+                if ($referenceHtml) {
+                    $null = $Builder.AppendLine(("                  {0}" -f $referenceHtml))
+                }
+            }
+            $null = $Builder.AppendLine('                </div>')
+        }
+    }
+
+    $breakdownEligibleIds = @('DKIMKeyStrength', 'DKIMTtl')
+    if ($Selectors -and $Check.Area -eq 'DKIM' -and ($Check.Id -in $breakdownEligibleIds)) {
+        Add-DSADkimSelectorBreakdown -Builder $Builder -Selectors $Selectors -Check $Check
+    }
+
+    $null = $Builder.AppendLine('              </div>')
+    $null = $Builder.AppendLine('            </div>')
+    $null = $Builder.AppendLine('          </div>')
+}
+
+<#
+.SYNOPSIS
+    Compute aggregate report statistics.
+.DESCRIPTION
+    Summarizes pass/fail/warning counts across domains and checks, producing card metadata for the report header.
+.PARAMETER Profiles
+    Compliance profiles to summarize.
+#>
+function Get-DSAReportSummary {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [pscustomobject[]]$Profiles
+    )
+
+    $profileList = @($Profiles)
+    $domainCount = ($profileList | Measure-Object).Count
+    $passed = ($profileList | Where-Object { $_.OverallStatus -eq 'Pass' } | Measure-Object).Count
+    $failed = ($profileList | Where-Object { $_.OverallStatus -eq 'Fail' } | Measure-Object).Count
+    $warningDomains = ($profileList | Where-Object { $_.OverallStatus -eq 'Warning' } | Measure-Object).Count
+
+    $checkStatusCounts = @{
+        Pass    = 0
+        Fail    = 0
+        Warning = 0
+    }
+    $totalChecks = 0
+    foreach ($domainProfile in $profileList) {
+        $selectorDetails = $null
+        if ($domainProfile -and $domainProfile.PSObject.Properties['Evidence'] -and $domainProfile.Evidence -and $domainProfile.Evidence.PSObject.Properties['DKIMSelectorDetails']) {
+            $selectorDetails = $domainProfile.Evidence.DKIMSelectorDetails
+        }
+
+        $checksInput = if ((Test-DSAProperty -InputObject $domainProfile -Name 'EffectiveChecks') -and $domainProfile.EffectiveChecks) {
+            $domainProfile.EffectiveChecks
+        }
+        elseif ($domainProfile.Checks) { $domainProfile.Checks } else { @() }
+
+        $checks = if ((Test-DSAProperty -InputObject $domainProfile -Name 'EffectiveChecks') -and $domainProfile.EffectiveChecks) {
+            @($checksInput | Where-Object { $_ })
+        }
+        else {
+            Get-DSAEffectiveChecks -Checks $checksInput -SelectorDetails $selectorDetails
+        }
+        if (-not $checks) {
+            $checks = @()
+        }
+
+        $counts = if ((Test-DSAProperty -InputObject $domainProfile -Name 'StatusCounts') -and $domainProfile.StatusCounts) {
+            $domainProfile.StatusCounts
+        }
+        else {
+            Get-DSAStatusCounts -Checks $checks
+        }
+        $totalChecks += $counts.Total
+        $checkStatusCounts['Pass'] += $counts.Pass
+        $checkStatusCounts['Fail'] += $counts.Fail
+        $checkStatusCounts['Warning'] += $counts.Warning
+    }
+
+    $cards = @(
+        [pscustomobject]@{ Label = 'Passing Checks'; Value = $checkStatusCounts['Pass']; Description = 'Checks meeting expectations.'; Style = 'Pass'; Filter = 'pass' }
+        [pscustomobject]@{ Label = 'Failing Checks'; Value = $checkStatusCounts['Fail']; Description = 'Immediate attention required.'; Style = 'Fail'; Filter = 'fail' }
+        [pscustomobject]@{ Label = 'Warning Checks'; Value = $checkStatusCounts['Warning']; Description = 'Recommendations available.'; Style = 'Warning'; Filter = 'warning' }
+        [pscustomobject]@{ Label = 'Total Checks'; Value = $totalChecks; Description = ("Across {0} domains" -f $domainCount); Style = 'Info'; Filter = 'all' }
+    )
+
+    return [pscustomobject]@{
+        DomainCount   = $domainCount
+        Passed        = $passed
+        Failed        = $failed
+        Warning       = $warningDomains
+        TotalChecks   = $totalChecks
+        TotalWarnings = $checkStatusCounts.Warning
+        Cards         = $cards
+    }
+}
+
+
+<#
+.SYNOPSIS
+    Render DKIM selector breakdown cards for a DKIM check.
+.DESCRIPTION
+    Emits per-selector status, key length/TTL metadata, and not-found markers to provide detail within the DKIM section.
+.PARAMETER Builder
+    StringBuilder for HTML output.
+.PARAMETER Selectors
+    DKIM selector objects returned from evidence collection.
+.PARAMETER Check
+    DKIM check driving status evaluation.
+#>
+function Add-DSADkimSelectorBreakdown {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)][System.Text.StringBuilder]$Builder,
+        [pscustomobject[]]$Selectors,
+        [pscustomobject]$Check
+    )
+
+    $selectorList = @($Selectors | Where-Object { $_ })
+    if (-not $selectorList) {
+        return
+    }
+
+    $null = $Builder.AppendLine('                <div class="dkim-selectors">')
+    $null = $Builder.AppendLine('                  <div class="dkim-selectors-title">Selector details</div>')
+    $null = $Builder.AppendLine('                  <div class="dkim-selector-grid">')
+
+    foreach ($selector in $selectorList) {
+        $found = if (Test-DSAProperty -InputObject $selector -Name 'Found') {
+            [bool]$selector.Found
+        }
+        elseif (Test-DSAProperty -InputObject $selector -Name 'DkimRecordExists') {
+            [bool]$selector.DkimRecordExists
+        }
+        else {
+            $true
+        }
+        $keyLengthValue = if ($selector.KeyLength) { $selector.KeyLength } else { 'Unknown' }
+        $ttl = Get-DSATtlValue -InputObject $selector
+        $ttlValue = if ($null -ne $ttl) { $ttl } else { 'Unknown' }
+        $selectorName = if (Test-DSAProperty -InputObject $selector -Name 'Name') { $selector.Name } else { $selector.Selector }
+
+        $status = Get-DSADkimSelectorStatus -Selector $selector -Check $Check
+        $statusClass = Get-DSAStatusClassName -Status $status
+
+        $null = $Builder.AppendLine(("                    <div class=""selector-card {0}"">" -f $statusClass))
+        $null = $Builder.AppendLine(("                      <div class=""selector-name"">{0}</div>" -f (ConvertTo-DSAHtml $selectorName)))
+        $null = $Builder.AppendLine(("                      <div class=""selector-status {0}"">{1}</div>" -f $statusClass, (ConvertTo-DSAHtml $status)))
+        $null = $Builder.AppendLine('                      <div class="selector-meta">')
+        if ($Check.Id -eq 'DKIMKeyStrength') {
+            $null = $Builder.AppendLine(("                        <span>Key: {0}</span>" -f (ConvertTo-DSAHtml $keyLengthValue)))
+        }
+        if ($Check.Id -eq 'DKIMTtl') {
+            $null = $Builder.AppendLine(("                        <span>TTL: {0}</span>" -f (ConvertTo-DSAHtml $ttlValue)))
+        }
+        if (-not $found) {
+            $null = $Builder.AppendLine('                        <span class="selector-warning">Not found</span>')
+        }
+        $null = $Builder.AppendLine('                      </div>')
+        $null = $Builder.AppendLine('                    </div>')
+    }
+
+    $null = $Builder.AppendLine('                  </div>')
+    $null = $Builder.AppendLine('                </div>')
+}
diff --git a/Private/Resolve-DSAClassificationOverride.ps1 b/Private/Resolve-DSAClassificationOverride.ps1
new file mode 100644
index 0000000..5edfc60
--- /dev/null
+++ b/Private/Resolve-DSAClassificationOverride.ps1
@@ -0,0 +1,75 @@
+function Resolve-DSAClassificationOverride {
+    <#
+.SYNOPSIS
+    Validates and normalizes user-supplied classification overrides.
+.DESCRIPTION
+    Ensures only supported baseline classification keys are accepted when overrides
+    are supplied via CSV metadata or direct parameters, returning the canonical value.
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter()]
+        [string]$Value,
+
+        [Parameter()]
+        [string]$SourceDescription = 'classification override'
+    )
+
+    $validValues = @('SendingOnly', 'ReceivingOnly', 'SendingAndReceiving', 'Parked')
+    $allowed = [string]::Join(', ', $validValues)
+    $sourceNote = if (-not [string]::IsNullOrWhiteSpace($SourceDescription)) {
+        " ($SourceDescription)"
+    }
+    else {
+        ''
+    }
+
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        throw "Classification override cannot be empty$sourceNote. Allowed values: $allowed."
+    }
+
+    $normalized = $Value.Trim()
+    foreach ($entry in $validValues) {
+        if ([string]::Equals($normalized, $entry, [System.StringComparison]::OrdinalIgnoreCase)) {
+            return $entry
+        }
+    }
+
+    throw "Classification override '$normalized'$sourceNote is invalid. Allowed values: $allowed."
+}
+
+<#
+.SYNOPSIS
+    Normalize a classification string to its canonical key.
+.DESCRIPTION
+    Strips non-letters and returns the standard baseline classification key when recognized.
+.PARAMETER Classification
+    Classification value to normalize.
+#>
+function Get-DSAClassificationKey {
+    <#
+.SYNOPSIS
+    Normalizes a classification string to its canonical key form.
+.DESCRIPTION
+    Converts classification values like 'sending-only' or 'SendingOnly' to the
+    standard key format used in baseline profiles.
+#>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [string]$Classification
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Classification)) {
+        return $null
+    }
+
+    $normalized = ($Classification -replace '[^a-zA-Z]', '').ToLowerInvariant()
+    switch ($normalized) {
+        'sendingonly' { return 'SendingOnly' }
+        'receivingonly' { return 'ReceivingOnly' }
+        'sendingandreceiving' { return 'SendingAndReceiving' }
+        'parked' { return 'Parked' }
+        default { return $Classification }
+    }
+}
diff --git a/Private/Resolve-DSAPath.ps1 b/Private/Resolve-DSAPath.ps1
new file mode 100644
index 0000000..56dae32
--- /dev/null
+++ b/Private/Resolve-DSAPath.ps1
@@ -0,0 +1,68 @@
+<#
+.SYNOPSIS
+    Resolve and optionally create module paths with validation.
+.DESCRIPTION
+    Normalizes paths, enforces type constraints, creates directories/files when requested, and guards against overly long paths.
+.PARAMETER Path
+    Path to resolve.
+.PARAMETER PathType
+    Expected item type: Directory or File.
+.PARAMETER EnsureExists
+    Create the path if it does not already exist.
+#>
+function Resolve-DSAPath {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Path,
+
+        [Parameter()]
+        [ValidateSet('Directory', 'File')]
+        [string]$PathType = 'Directory',
+
+        [switch]$EnsureExists
+    )
+
+    $invalidChars = [System.IO.Path]::GetInvalidPathChars()
+    if ($Path.IndexOfAny($invalidChars) -ge 0) {
+        throw "Path '$Path' contains invalid characters."
+    }
+
+    # Normalize relative components before validation
+    $expandedPath = [System.IO.Path]::GetFullPath((Resolve-Path -Path $Path -ErrorAction SilentlyContinue)?.Path ?? $Path)
+
+    if ($EnsureExists -or $PathType -eq 'Directory') {
+        $itemType = if ($PathType -eq 'Directory') { 'Directory' } else { 'File' }
+        if (-not (Test-Path -Path $expandedPath)) {
+            try {
+                if ($itemType -eq 'Directory') {
+                    $null = New-Item -ItemType Directory -Path $expandedPath -Force
+                }
+                else {
+                    $directory = Split-Path -Path $expandedPath -Parent
+                    if (-not (Test-Path -Path $directory)) {
+                        $null = New-Item -ItemType Directory -Path $directory -Force
+                    }
+                    $null = New-Item -ItemType File -Path $expandedPath -Force
+                }
+            }
+            catch {
+                throw "Failed to create $itemType '$expandedPath': $($_.Exception.Message)"
+            }
+        }
+    }
+
+    if (-not (Test-Path -Path $expandedPath)) {
+        throw "Unable to resolve path '$Path'."
+    }
+
+    # Windows MAX_PATH is 260 characters; reserve headroom for child items (reports, transcripts) created under this path.
+    $maxPathLength = 220
+    if ($expandedPath.Length -gt $maxPathLength) {
+        throw "Resolved path '$expandedPath' exceeds the $maxPathLength-character limit."
+    }
+
+    return $expandedPath
+}
diff --git a/Private/Test-DSADependency.ps1 b/Private/Test-DSADependency.ps1
new file mode 100644
index 0000000..6639f5d
--- /dev/null
+++ b/Private/Test-DSADependency.ps1
@@ -0,0 +1,79 @@
+<#
+.SYNOPSIS
+    Check for required modules and optionally attempt installation.
+.DESCRIPTION
+    Verifies module availability, tries to install missing modules when requested, and returns compliance details with missing list.
+.PARAMETER Name
+    Module names to validate.
+.PARAMETER AttemptInstallation
+    Attempt to install missing modules using Install-Module.
+.PARAMETER LogFile
+    Path to the log file for warnings and install results.
+#>
+function Test-DSADependency {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string[]]$Name,
+
+        [switch]$AttemptInstallation,
+
+        [string]$LogFile
+    )
+
+    $uniqueModules = $Name | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique
+    $missingModules = [System.Collections.Generic.List[string]]::new()
+
+    $availableModules = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($module in @(Get-Module -ListAvailable -Name $uniqueModules)) {
+        if ($module -and $module.Name) {
+            $null = $availableModules.Add($module.Name)
+        }
+    }
+
+    foreach ($moduleName in $uniqueModules) {
+        if (-not $availableModules.Contains($moduleName)) {
+            $null = $missingModules.Add($moduleName)
+        }
+    }
+
+    if ($missingModules.Count -gt 0 -and $AttemptInstallation) {
+        $installCommand = Get-Command -Name Install-Module -ErrorAction SilentlyContinue
+        if ($null -eq $installCommand) {
+            if ($LogFile) {
+                Write-DSALog -Message 'Install-Module not available; cannot remediate missing dependencies automatically.' -LogFile $LogFile -Level 'WARN'
+            }
+        }
+        else {
+            foreach ($module in @($missingModules.ToArray())) {
+                try {
+                    $splat = @{
+                        Name        = $module
+                        Scope       = 'CurrentUser'
+                        Force       = $true
+                        ErrorAction = 'Stop'
+                    }
+
+                    Install-Module @splat
+                    if (Get-Module -ListAvailable -Name $module) {
+                        $null = $missingModules.Remove($module)
+                        if ($LogFile) {
+                            Write-DSALog -Message "Installed dependency '$module'." -LogFile $LogFile
+                        }
+                    }
+                }
+                catch {
+                    if ($LogFile) {
+                        Write-DSALog -Message "Failed to install dependency '$module': $($_.Exception.Message)" -LogFile $LogFile -Level 'WARN'
+                    }
+                }
+            }
+        }
+    }
+
+    return [pscustomobject]@{
+        MissingModules = $missingModules.ToArray()
+        IsCompliant    = ($missingModules.Count -eq 0)
+    }
+}
diff --git a/Private/Write-DSALog.ps1 b/Private/Write-DSALog.ps1
new file mode 100644
index 0000000..8dac706
--- /dev/null
+++ b/Private/Write-DSALog.ps1
@@ -0,0 +1,50 @@
+function Write-DSALog {
+    <#
+.SYNOPSIS
+    Writes a timestamped log entry to a file.
+.DESCRIPTION
+    Appends a formatted log entry with timestamp and severity level to the specified log file.
+    Creates the log directory if it doesn't exist. Optionally outputs to verbose stream.
+.PARAMETER Message
+    The message text to log.
+.PARAMETER LogFile
+    The full path to the log file.
+.PARAMETER Level
+    The severity level: INFO, WARN, ERROR, or DEBUG. Defaults to INFO.
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Message,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$LogFile,
+
+        [Parameter()]
+        [ValidateSet('INFO', 'WARN', 'ERROR', 'DEBUG')]
+        [string]$Level = 'INFO'
+    )
+
+    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
+    $entry = "{0} [{1}] {2}" -f $timestamp, $Level.ToUpperInvariant(), $Message
+
+    try {
+        $logDirectory = Split-Path -Path $LogFile -Parent
+        if (-not (Test-Path -Path $logDirectory)) {
+            $null = New-Item -ItemType Directory -Path $logDirectory -Force
+        }
+
+        Add-Content -Path $LogFile -Value $entry -Encoding UTF8
+        if ($PSBoundParameters.ContainsKey('Verbose') -or $VerbosePreference -ne 'SilentlyContinue') {
+            Write-Verbose -Message $entry
+        }
+    }
+    catch {
+        $errorMessage = "Failed to write log entry to '$LogFile': $($_.Exception.Message)"
+        Write-Warning -Message $errorMessage
+        throw
+    }
+}
+
diff --git a/Public/Get-DSABaselineProfile.ps1 b/Public/Get-DSABaselineProfile.ps1
new file mode 100644
index 0000000..f4f6b5d
--- /dev/null
+++ b/Public/Get-DSABaselineProfile.ps1
@@ -0,0 +1,43 @@
+function Get-DSABaselineProfile {
+    <#
+.SYNOPSIS
+    Lists built-in baseline profiles available to the Domain Security Auditor module.
+.DESCRIPTION
+    Enumerates the profile data files stored under the module's Configs directory. Use this to discover profile names
+    that can be supplied to -Baseline on Invoke-DomainSecurityAuditor or as the source for New-DSABaselineProfile.
+.PARAMETER Name
+    Optional profile name (for example, 'Default'). When specified, only the matching profile metadata is returned.
+.EXAMPLE
+    Get-DSABaselineProfile
+    Lists every profile shipped with the module.
+.EXAMPLE
+    Get-DSABaselineProfile -Name 'Default'
+    Returns the path to the Default baseline definition.
+#>
+
+    [CmdletBinding()]
+    [OutputType([object[]])]
+    param (
+        [ValidateNotNullOrEmpty()]
+        [string]$Name
+    )
+
+    $configRoot = $script:ConfigRoot
+    if (-not (Test-Path -Path $configRoot)) {
+        return @()
+    }
+
+    $pattern = if ($Name) { "Baseline.$Name.psd1" } else { 'Baseline.*.psd1' }
+    $files = Get-ChildItem -Path $configRoot -Filter $pattern -File -ErrorAction SilentlyContinue
+    $profiles = @(
+        $files | ForEach-Object {
+            $profileName = $_.BaseName -replace '^Baseline\.', ''
+            [pscustomobject]@{
+                Name = $profileName
+                Path = $_.FullName
+            }
+        }
+    )
+
+    return [object[]]$profiles
+}
diff --git a/Public/Invoke-DomainSecurityAuditor.ps1 b/Public/Invoke-DomainSecurityAuditor.ps1
new file mode 100644
index 0000000..770a5f7
--- /dev/null
+++ b/Public/Invoke-DomainSecurityAuditor.ps1
@@ -0,0 +1,247 @@
+function Invoke-DomainSecurityAuditor {
+    <#
+.SYNOPSIS
+    Execute the Domain Security Auditor baseline workflow for one or more domains.
+.DESCRIPTION
+    Gathers domain data (via DomainDetective), validates it with Pester-driven baselines, and emits structured logs plus report-ready data.
+.PARAMETER Domain
+    One or more domains to analyze. Accepts pipeline input or explicit arrays.
+.PARAMETER ClassificationOverride
+    Override the DomainDetective-provided classification for directly supplied domains (single-domain CLI usage). Valid values: SendingOnly, ReceivingOnly, SendingAndReceiving, Parked.
+.PARAMETER InputFile
+    Optional path to a text or CSV file containing domain names (one per line or column header named 'Domain').
+.PARAMETER OutputRoot
+    Destination folder for generated reports and machine-readable artifacts.
+.PARAMETER LogRoot
+    Folder used for transcripts and operational logs.
+.PARAMETER RetentionCount
+    Maximum number of log/transcript files to retain before pruning oldest entries.
+.PARAMETER SkipDependencies
+    Bypass automatic dependency checks and exit after logging the decision.
+.PARAMETER DkimSelector
+    Optional DKIM selectors to verify via DomainDetective; if omitted, DomainDetective defaults are used.
+    When using -InputFile with CSV, per-domain selectors in a 'DkimSelectors' column override this parameter.
+.PARAMETER DNSEndpoint
+    Optional DNS endpoint forwarded to DomainDetective. If omitted, DomainDetective uses its system resolver.
+.PARAMETER Baseline
+    Name of the built-in baseline profile to load (defaults to 'Default').
+.PARAMETER BaselineProfilePath
+    Optional path to a .psd1 file describing a full baseline profile. Copy the default profile, adjust values, and pass the new file to this parameter.
+.PARAMETER SkipReportLaunch
+    Prevents automatic opening of the generated HTML report. Use this in CI/CD or other non-interactive scenarios.
+.PARAMETER ShowProgress
+    Toggle Write-Progress output for long-running collections.
+.PARAMETER PassThru
+    Returns the compliance profile objects to the pipeline instead of writing a summary to the console.
+    Use this when you need to process results programmatically or in scripts.
+.EXAMPLE
+    Invoke-DomainSecurityAuditor -Domain 'example.com'
+    Runs the baseline workflow for example.com and writes the report to the default Output folder.
+.OUTPUTS
+    None by default. Writes a summary to the information stream.
+    PSCustomObject[] when -PassThru is specified, containing compliance profiles for each domain.
+.NOTES
+    Author: Travis McDade
+    Date: 11/21/2025
+    Version: 0.2.0
+    Purpose: Provide a consistent baseline entry point for the Domain Security Auditor module.
+
+Revision History:
+      0.2.0 - 11/22/2025 - BREAKING: Rename entry point to Invoke-DomainSecurityAuditor and align report naming (timestamp after report name).
+      0.1.2 - 11/21/2025 - BREAKING: Default output changed from returning objects to writing summary.
+                          Add -PassThru parameter to return compliance profile objects for pipeline use.
+                          Capture and log DomainDetective warnings.
+      0.1.1 - 11/20/2025 - Add classification override support through CSV metadata and direct parameters.
+      0.1.0 - 11/16/2025 - Initial scaffolded implementation with logging/transcript plumbing.
+
+Known Issues:
+      - TTL evidence fields require DomainDetective updates to expose DNS record TTLs.
+
+Resources:
+      - https://github.com/thetechgy/DomainSecurityAuditor
+#>
+
+    [CmdletBinding()]
+    [OutputType([pscustomobject[]])]
+    param (
+        #region Parameters
+        [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
+        [ValidateNotNullOrEmpty()]
+        [Alias('Domains')]
+        [string[]]$Domain,
+
+        [Parameter()]
+        [Alias('Classification')]
+        [string]$ClassificationOverride,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string]$InputFile,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string]$OutputRoot = (Join-Path -Path $script:ModuleRoot -ChildPath 'Output'),
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string]$LogRoot = (Join-Path -Path $script:ModuleRoot -ChildPath 'Logs'),
+
+        [Parameter()]
+        [ValidateRange(1, 365)]
+        [int]$RetentionCount = 30,
+
+        [switch]$SkipDependencies,
+        [Alias('DkimSelectors')]
+        [string[]]$DkimSelector,
+        [string]$DNSEndpoint,
+        [string]$Baseline = 'Default',
+        [string]$BaselineProfilePath,
+        [switch]$SkipReportLaunch,
+        [switch]$ShowProgress,
+        [switch]$PassThru
+        #endregion Parameters
+    )
+
+    begin {
+        $collectedDomains = [System.Collections.Generic.List[string]]::new()
+        $domainMetadata = @{}
+        $directDomainSet = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        $defaultClassificationOverride = $null
+        $globalDkimSelectors = @()
+        $resolvedDnsEndpoint = $null
+
+        if ($PSBoundParameters.ContainsKey('ClassificationOverride')) {
+            $defaultClassificationOverride = Resolve-DSAClassificationOverride -Value $ClassificationOverride -SourceDescription 'ClassificationOverride parameter'
+        }
+
+        if ($PSBoundParameters.ContainsKey('DkimSelector')) {
+            $globalDkimSelectors = @($DkimSelector | ForEach-Object { "$_".Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+        }
+
+        if ($PSBoundParameters.ContainsKey('DNSEndpoint')) {
+            $resolvedDnsEndpoint = "$DNSEndpoint".Trim()
+        }
+    }
+
+    process {
+        if ($PSBoundParameters.ContainsKey('Domain')) {
+            foreach ($domainValue in $Domain) {
+                if (-not [string]::IsNullOrWhiteSpace($domainValue)) {
+                    $trimmedDomain = $domainValue.Trim()
+                    $null = $collectedDomains.Add($trimmedDomain)
+                    $null = $directDomainSet.Add($trimmedDomain)
+                    if ($defaultClassificationOverride) {
+                        $domainMetadata[$trimmedDomain] = [pscustomobject]@{
+                            Domain               = $trimmedDomain
+                            Classification       = $defaultClassificationOverride
+                            ClassificationSource = 'Parameter'
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    end {
+        $context = $null
+        $logFile = $null
+
+        try {
+            $context = New-DSARunContext -OutputRoot $OutputRoot -LogRoot $LogRoot -RetentionCount $RetentionCount
+            $logFile = $context.LogFile
+
+            $parameterSummary = $PSBoundParameters.GetEnumerator() | ForEach-Object {
+                $value = if ($_.Value -is [System.Array]) { $_.Value -join ';' } else { $_.Value }
+                '{0}={1}' -f $_.Key, $value
+            }
+            Write-DSALog -Message 'Starting Domain Security Auditor invocation.' -LogFile $logFile
+            Write-DSALog -Message ("Effective parameters: {0}" -f ($parameterSummary -join ', ')) -LogFile $logFile -Level 'DEBUG'
+
+            $inputSplat = @{
+                CollectedDomains              = $collectedDomains
+                DomainMetadata                = $domainMetadata
+                DirectDomainSet               = $directDomainSet
+                DefaultClassificationOverride = $defaultClassificationOverride
+                GlobalDkimSelectors           = $globalDkimSelectors
+                ResolvedDnsEndpoint           = $resolvedDnsEndpoint
+                LogFile                       = $logFile
+            }
+            if ($PSBoundParameters.ContainsKey('InputFile')) {
+                $inputSplat.InputFile = $InputFile
+            }
+
+            $inputState = Get-DSADomainInputState @inputSplat
+            $targetDomains = $inputState.TargetDomains
+
+            if ($SkipDependencies) {
+                Write-DSALog -Message 'Dependency verification skipped for modules: DomainDetective, Pester, PSScriptAnalyzer.' -LogFile $logFile -Level 'WARN'
+                return
+            }
+
+            Confirm-DSADependencies -Name @('DomainDetective', 'Pester', 'PSScriptAnalyzer') -AttemptInstallation -LogFile $logFile
+
+            $results = [System.Collections.Generic.List[object]]::new()
+            $domainCount = $targetDomains.Count
+            $currentIndex = 0
+            $showProgressEnabled = if ($PSBoundParameters.ContainsKey('ShowProgress')) { [bool]$ShowProgress } else { $true }
+            if ($PSBoundParameters.ContainsKey('BaselineProfilePath')) {
+                $loadedBaseline = Get-DSABaseline -ProfilePath $BaselineProfilePath
+            }
+            else {
+                $loadedBaseline = Get-DSABaseline -ProfileName $Baseline
+            }
+            $baselineProfiles = $loadedBaseline.Profiles
+
+            foreach ($domainName in $targetDomains) {
+                $currentIndex++
+                $runResult = Invoke-DSADomainRun -DomainName $domainName `
+                    -DomainMetadata $inputState.DomainMetadata `
+                    -DirectDomainSet $inputState.DirectDomainSet `
+                    -DefaultClassificationOverride $inputState.DefaultClassificationOverride `
+                    -GlobalDkimSelectors $inputState.GlobalDkimSelectors `
+                    -ResolvedDnsEndpoint $inputState.ResolvedDnsEndpoint `
+                    -BaselineProfiles $baselineProfiles `
+                    -OutputRoot $context.OutputRoot `
+                    -LogFile $logFile `
+                    -CurrentIndex $currentIndex `
+                    -TotalCount $domainCount `
+                    -ShowProgress:$showProgressEnabled
+                $null = $results.Add($runResult)
+            }
+
+            if ($showProgressEnabled) {
+                Write-Progress -Activity 'Domain Security Auditor' -Completed
+            }
+
+            Write-DSALog -Message "Processed $domainCount domain(s)." -LogFile $logFile
+
+            $resultArray = $results.ToArray()
+            $reportPath = Publish-DSAHtmlReport -Profiles $resultArray -OutputRoot $context.OutputRoot -GeneratedOn $context.RunDate -BaselineName $loadedBaseline.Name -BaselineVersion $loadedBaseline.Version -LogFile $logFile
+            foreach ($item in $resultArray) {
+                $item | Add-Member -NotePropertyName 'ReportPath' -NotePropertyValue $reportPath -Force
+            }
+
+            if (-not $SkipReportLaunch -and $reportPath) {
+                Open-DSAReport -Path $reportPath -LogFile $logFile
+            }
+
+            if ($PassThru) {
+                return [pscustomobject[]]$resultArray
+            }
+
+            Write-DSABaselineConsoleSummary -Profiles $resultArray -ReportPath $reportPath
+            return
+        }
+        catch {
+            if ($logFile) {
+                Write-DSALog -Message "Unhandled error: $($_.Exception.Message)" -LogFile $logFile -Level 'ERROR'
+            }
+            throw
+        }
+        finally {
+            if ($context -and $context.TranscriptStarted) {
+                $null = Stop-Transcript
+            }
+        }
+    }
+}
diff --git a/Public/New-DSABaselineProfile.ps1 b/Public/New-DSABaselineProfile.ps1
new file mode 100644
index 0000000..fee46e4
--- /dev/null
+++ b/Public/New-DSABaselineProfile.ps1
@@ -0,0 +1,52 @@
+function New-DSABaselineProfile {
+    <#
+.SYNOPSIS
+    Creates a new baseline profile file based on an existing built-in profile.
+.DESCRIPTION
+    Copies the specified source profile from the module's Configs directory to a new destination so that operators can
+    adjust expectations without editing the module contents.
+.PARAMETER Path
+    Destination path for the new baseline file.
+.PARAMETER SourceProfile
+    Name of the built-in profile to copy. Defaults to 'Default'.
+.PARAMETER Force
+    Overwrite the destination file if it already exists.
+.EXAMPLE
+    New-DSABaselineProfile -Path '.\Baseline.MyOrg.psd1'
+    Copies the default profile to Baseline.MyOrg.psd1 in the current directory.
+#>
+
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [ValidatePattern('\.psd1$')]
+        [string]$Path,
+
+        [string]$SourceProfile = 'Default',
+
+        [switch]$Force
+    )
+
+    $sourceInfo = Get-DSABaselineProfile -Name $SourceProfile
+    if (-not $sourceInfo) {
+        throw "Baseline profile '$SourceProfile' was not found."
+    }
+
+    $targetPath = [System.IO.Path]::GetFullPath($Path)
+    $targetDirectory = Split-Path -Path $targetPath -Parent
+    if (-not (Test-Path -Path $targetDirectory)) {
+        $null = New-Item -Path $targetDirectory -ItemType Directory -Force
+    }
+
+    if ((Test-Path -Path $targetPath) -and -not $Force) {
+        throw "The file '$targetPath' already exists. Use -Force to overwrite."
+    }
+
+    if ($PSCmdlet.ShouldProcess($targetPath, "Copy baseline profile '$SourceProfile'")) {
+        Copy-Item -Path $sourceInfo.Path -Destination $targetPath -Force:$Force
+    }
+
+    return $targetPath
+}
diff --git a/Public/Test-DSABaselineProfile.ps1 b/Public/Test-DSABaselineProfile.ps1
new file mode 100644
index 0000000..5f1c47d
--- /dev/null
+++ b/Public/Test-DSABaselineProfile.ps1
@@ -0,0 +1,83 @@
+function Test-DSABaselineProfile {
+    <#
+.SYNOPSIS
+    Validates that a baseline profile file is well-formed.
+.DESCRIPTION
+    Loads the specified PSD1/JSON baseline and verifies it contains the Profiles collection plus required fields for each check.
+.PARAMETER Path
+    Path to the baseline profile file (PSD1).
+.EXAMPLE
+    Test-DSABaselineProfile -Path '.\Baseline.MyOrg.psd1'
+#>
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Path
+    )
+
+    $resolvedPath = Resolve-DSAPath -Path $Path -PathType 'File'
+    $errors = [System.Collections.Generic.List[string]]::new()
+
+    try {
+        $definition = Import-DSABaselineConfig -Path $resolvedPath
+    }
+    catch {
+        $null = $errors.Add($_.Exception.Message)
+        return [pscustomobject]@{
+            Path    = $resolvedPath
+            IsValid = $false
+            Errors  = $errors
+        }
+    }
+
+    $profiles = Get-DSAPropertyValue -InputObject $definition -PropertyName 'Profiles'
+    if (-not $profiles) {
+        $null = $errors.Add('Profiles collection is missing.')
+    }
+    else {
+        foreach ($profileKey in $profiles.Keys) {
+            $profileDefinition = $profiles[$profileKey]
+            $checks = Get-DSAPropertyValue -InputObject $profileDefinition -PropertyName 'Checks'
+            if (-not $checks) {
+                $null = $errors.Add("Profile '$profileKey' does not define any checks.")
+                continue
+            }
+
+            $checkIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            foreach ($check in @($checks)) {
+                $checkId = Get-DSAPropertyValue -InputObject $check -PropertyName 'Id'
+                $checkLabel = if (-not [string]::IsNullOrWhiteSpace($checkId)) { $checkId } else { '<missing Id>' }
+
+                if (-not [string]::IsNullOrWhiteSpace($checkId)) {
+                    if (-not $checkIds.Add($checkId)) {
+                        $null = $errors.Add("Profile '$profileKey' defines duplicate check Id '$checkId'.")
+                    }
+                }
+
+                foreach ($required in @('Id', 'Condition', 'Target', 'Area', 'Severity')) {
+                    if (-not (Get-DSAPropertyValue -InputObject $check -PropertyName $required)) {
+                        $null = $errors.Add("Check '$checkLabel' in profile '$profileKey' is missing required property '$required'.")
+                    }
+                }
+
+                $condition = Get-DSAPropertyValue -InputObject $check -PropertyName 'Condition'
+                $expectedValue = Get-DSAPropertyValue -InputObject $check -PropertyName 'ExpectedValue'
+                if ($condition) {
+                    $validation = Test-DSAConditionExpectedValue -Condition $condition -ExpectedValue $expectedValue
+                    if (-not $validation.IsValid) {
+                        $message = if ($validation.Message) { $validation.Message } else { "has an invalid ExpectedValue for condition '$condition'." }
+                        $null = $errors.Add("Check '$checkLabel' in profile '$profileKey' $message")
+                    }
+                }
+            }
+        }
+    }
+
+    return [pscustomobject]@{
+        Path    = $resolvedPath
+        IsValid = ($errors.Count -eq 0)
+        Errors  = $errors
+    }
+}
diff --git a/README.md b/README.md
index ad6dfb2..37e2a28 100644
--- a/README.md
+++ b/README.md
@@ -4,22 +4,25 @@
 > This README explains the design concept and how the project is intended to work once functional.
 
 [![Status](https://img.shields.io/badge/status-active_development-orange)](https://github.com/thetechgy/DomainSecurityAuditor/tree/develop)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/thetechgy/DomainSecurityAuditor/badge)](https://api.securityscorecards.dev/projects/github.com/thetechgy/DomainSecurityAuditor)
+[![Pester CI](https://github.com/thetechgy/DomainSecurityAuditor/actions/workflows/pester.yml/badge.svg?branch=develop)](https://github.com/thetechgy/DomainSecurityAuditor/actions/workflows/pester.yml)
+[![PSScriptAnalyzer CI](https://github.com/thetechgy/DomainSecurityAuditor/actions/workflows/psscriptanalyzer.yml/badge.svg?branch=develop)](https://github.com/thetechgy/DomainSecurityAuditor/actions/workflows/psscriptanalyzer.yml)
+[![Dependabot](https://img.shields.io/badge/Dependabot-enabled-025e8c?logo=dependabot)](https://github.com/thetechgy/DomainSecurityAuditor/network/updates)
 [![PowerShell 7+](https://img.shields.io/badge/PowerShell-7%2B-2671E5)](#requirements)
 [![Pester](https://img.shields.io/badge/Tests-Pester-blue)](#quality--testing)
 [![License](https://img.shields.io/badge/License-Apache--2.0-green)](LICENSE)
 
-**Domain Security Auditor (DSA)** is a PowerShell-based project that uses [DomainDetective] as the data source and adds a testing layer with [Pester] and reporting layer with [PSWriteHTML] to check domain and email security against best practices or custom baselines.
+**Domain Security Auditor (DSA)** is a PowerShell-based project that uses [DomainDetective] as the data source and adds a testing layer with [Pester] plus a native HTML renderer to check domain and email security against best practices or custom baselines.
 
 [DomainDetective]: https://github.com/EvotecIT/DomainDetective
 [Pester]: https://github.com/pester/Pester
-[PSWriteHTML]: https://github.com/EvotecIT/PSWriteHTML
 
 ---
 
 ## At a Glance
 
 - **Purpose:** Repeatable, reference-backed checks for domain/email security
-- **Stack:** PowerShell 7+, Pester, DomainDetective, PSWriteHTML
+- **Stack:** PowerShell 7+, Pester, DomainDetective
 - **Output:** HTML first; JSON/CSV/JUnit later for CI/CD
 
 ---
@@ -84,6 +87,70 @@
 
 DSA generates comprehensive HTML reports with intuitive modern styling, interactive elements, and detailed test results that make security posture immediately clear while providing relevant remediation steps.
 
+### Running Baselines
+
+Analyze a single domain:
+
+```powershell
+Invoke-DomainSecurityAuditor -Domain 'example.com'
+```
+
+Analyze multiple domains at once:
+
+```powershell
+Invoke-DomainSecurityAuditor -Domain 'example.com','contoso.com' -SkipReportLaunch
+```
+
+Provide a CSV (or newline-delimited text) file with a `Domain` column to batch large lists:
+
+```powershell
+@'
+Domain
+example.com
+contoso.com
+legacy.example
+'@ | Set-Content -Encoding UTF8 -Path ./domains.csv
+
+Invoke-DomainSecurityAuditor -InputFile ./domains.csv
+```
+
+Add optional metadata columns when the defaults need adjustment. A `Classification` column overrides the DomainDetective-detected type for that row, ensuring the correct baseline is selected:
+
+```powershell
+@'
+Domain,Classification
+example.com,SendingAndReceiving
+legacy.example,SendingOnly
+'@ | Set-Content -Encoding UTF8 -Path ./domains-with-classifications.csv
+
+Invoke-DomainSecurityAuditor -InputFile ./domains-with-classifications.csv
+```
+Accepted values mirror the built-in profile keys (`SendingOnly`, `ReceivingOnly`, `SendingAndReceiving`, or `Parked`) and are matched case-insensitively.
+
+DKIM selector coverage defaults to the list baked into DomainDetective. Override that list for specific domains by adding a `DKIMSelectors` column to your CSV. Comma or semicolon separators are accepted; blank cells fall back to the DomainDetective defaults:
+
+```powershell
+@'
+Domain,DKIMSelectors
+example.com,selector1;selector2
+legacy.example,
+'@ | Set-Content -Encoding UTF8 -Path ./domains-with-dkim-selectors.csv
+
+Invoke-DomainSecurityAuditor -InputFile ./domains-with-dkim-selectors.csv
+```
+
+For single-domain or ad-hoc runs without a CSV, specify the override directly:
+
+```powershell
+Invoke-DomainSecurityAuditor -Domain 'example.com' -Classification SendingOnly
+Invoke-DomainSecurityAuditor -Domain 'example.com' -DkimSelector 'selector1','selector2'
+Invoke-DomainSecurityAuditor -Domain 'example.com' -DNSEndpoint 'udp://1.1.1.1:53'
+```
+
+When `-DNSEndpoint` is omitted, DomainDetective automatically uses the system resolver.
+
+By default, the generated HTML report opens when processing completes. Use `-SkipReportLaunch` in CI/CD or other non-interactive scenarios.
+
 ### Report Features
 
 The HTML reports provide:
@@ -105,7 +172,7 @@ The HTML reports provide:
 Here's what a typical report shows:
 
 ```
-Domain Security Compliance Report
+Domain Security Auditor Report
 Generated on: September 4, 2025, 2:30 PM EDT
 Framework Version: 1.0.0 | Test Suite: Baseline Email Security v1.2
 
@@ -158,7 +225,7 @@ Production Domain • 14 tests executed
      📖 References: RFC 7489, DMARC.org Deployment, M3AAWG DMARC Guide
 ```
 
-> 📸 [View full example report](Examples/domain_compliance_report.html)
+> 📸 [View full example report](Examples/domain_security_auditor_report.html)
 
 ---
 
@@ -168,7 +235,7 @@ Production Domain • 14 tests executed
 
 - **Data:** Domain details from DomainDetective (single source of truth)
 - **Testing:** Pester-based Compliance Engine runs baselines or custom packs
-- **Reporting:** PSWriteHTML for HTML; JSON/CSV/JUnit later for automation
+- **Reporting:** Native PowerShell HTML builder; JSON/CSV/JUnit later for automation
 
 ### Data Shapes
 
@@ -252,7 +319,7 @@ Issues, discussions, and PRs are welcome. When adding or changing baseline rules
 ### Inspiration and Foundations
 
 - [Maester] — Informed the data-driven, Pester-first approach and overall UX philosophy
-- [Przemyslaw Klys / Evotec] — Author of DomainDetective (data source) and PSWriteHTML (reporting), plus many other high-quality PowerShell projects
+- [Przemyslaw Klys / Evotec] — Author of DomainDetective (data source) and numerous high-quality PowerShell projects
 
 [Maester]: https://maester.dev/
 [Przemyslaw Klys / Evotec]: https://evotec.xyz/
@@ -262,7 +329,6 @@ Issues, discussions, and PRs are welcome. When adding or changing baseline rules
 If this project helps you, please consider starring, contributing to, or sponsoring:
 
 - [DomainDetective]
-- [PSWriteHTML]
 - [Maester]
 
 ### Community References
diff --git a/Tests/Invoke-DomainSecurityAuditor.Tests.ps1 b/Tests/Invoke-DomainSecurityAuditor.Tests.ps1
new file mode 100644
index 0000000..2fcc9bb
--- /dev/null
+++ b/Tests/Invoke-DomainSecurityAuditor.Tests.ps1
@@ -0,0 +1,1346 @@
+<#
+.SYNOPSIS
+    Create a reusable evidence payload for tests.
+.DESCRIPTION
+    Builds a customizable DomainDetective-like evidence object for use across test scenarios.
+#>
+function global:New-TestEvidence {
+    param (
+        [string]$Domain = 'example.com',
+        [string]$Classification = 'SendingAndReceiving',
+        [ScriptBlock]$Adjust
+    )
+
+    $records = [pscustomobject]@{
+        MX                    = @('mx1.example.com')
+        MXRecordCount         = 1
+        MXHasNull             = $false
+        MXMinimumTtl          = 3600
+        SPFRecord             = 'v=spf1 include:_spf.example.com -all'
+        SPFRecords            = @('v=spf1 include:_spf.example.com -all')
+        SPFRecordCount        = 1
+        SPFLookupCount        = 2
+        SPFTerminalMechanism  = '-all'
+        SPFHasPtrMechanism    = $false
+        SPFRecordLength       = 40
+        SPFTtl                = 3600
+        SPFIncludes           = @('_spf.example.com')
+        SPFWildcardRecord     = 'v=spf1 -all'
+        SPFWildcardConfigured = $true
+        SPFUnsafeMechanisms   = @()
+        DKIMSelectors         = @('selector1')
+        DKIMSelectorDetails   = @(
+            [pscustomobject]@{
+                Selector          = 'selector1'
+                DkimRecordExists  = $true
+                KeyLength         = 2048
+                ValidPublicKey    = $true
+                ValidRsaKeyLength = $true
+                WeakKey           = $false
+                DnsRecordTtl      = 3600
+            }
+        )
+        DKIMMinKeyLength      = 2048
+        DKIMWeakSelectors     = 0
+        DKIMMinimumTtl        = 3600
+        DMARCRecord           = 'v=DMARC1; p=reject; rua=mailto:dmarc@example.com'
+        DMARCPolicy           = 'reject'
+        DMARCRuaAddresses     = @('dmarc@example.com')
+        DMARCRufAddresses     = @()
+        DMARCTtl              = 3600
+        MTASTSRecordPresent   = $true
+        MTASTSPolicyValid     = $true
+        MTASTSMode            = 'enforce'
+        MTASTSTtl             = 86400
+        TLSRPTRecordPresent   = $true
+        TLSRPTAddresses       = @('tls@example.com')
+        TLSRPTTtl             = 86400
+    }
+
+    $evidence = [pscustomobject]@{
+        Domain         = $Domain
+        Classification = $Classification
+        Records        = $records
+    }
+
+    if ($Adjust) {
+        & $Adjust -ArgumentList $evidence
+    }
+
+    return $evidence
+}
+
+BeforeAll {
+    $stubModuleRoot = Join-Path -Path $PSScriptRoot -ChildPath 'Stubs'
+    if (Test-Path -Path $stubModuleRoot) {
+        $env:PSModulePath = "{0}{1}{2}" -f $stubModuleRoot, [System.IO.Path]::PathSeparator, $env:PSModulePath
+    }
+
+    $moduleManifest = Join-Path -Path $PSScriptRoot -ChildPath '..\DomainSecurityAuditor.psd1'
+    Import-Module -Name (Resolve-Path -Path $moduleManifest) -Force
+}
+
+AfterAll {
+    Remove-Item -Path Function:\New-TestEvidence -ErrorAction SilentlyContinue
+}
+
+Describe 'Invoke-DomainSecurityAuditor' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+    It 'is exported by the module' {
+        $command = Get-Command -Name Invoke-DomainSecurityAuditor -Module DomainSecurityAuditor -ErrorAction Stop
+        $command | Should -Not -BeNullOrEmpty
+    }
+
+    It 'includes required parameters' {
+        $command = Get-Command -Name Invoke-DomainSecurityAuditor -Module DomainSecurityAuditor
+        $command.Parameters.Keys | Should -Contain 'ShowProgress'
+        $command.Parameters.Keys | Should -Contain 'SkipDependencies'
+        $command.Parameters.Keys | Should -Contain 'DkimSelector'
+        $command.Parameters.Keys | Should -Contain 'DNSEndpoint'
+        $command.Parameters.Keys | Should -Contain 'Baseline'
+        $command.Parameters.Keys | Should -Contain 'BaselineProfilePath'
+    }
+
+    Context 'baseline evaluation' {
+        BeforeEach {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Test-DSADependency -MockWith {
+                    [pscustomobject]@{
+                        MissingModules = @()
+                        IsCompliant    = $true
+                    }
+                }
+
+                Mock -CommandName Start-Transcript -MockWith { }
+                Mock -CommandName Stop-Transcript -MockWith { }
+                Mock -CommandName Invoke-DSALogRetention -MockWith { }
+                Mock -CommandName Write-DSALog -MockWith { }
+                Mock -CommandName Publish-DSAHtmlReport -MockWith { 'C:\Reports\domain_report.html' }
+                Mock -CommandName Open-DSAReport -MockWith { }
+                Mock Get-DSABaseline {
+                    $baselineFile = Join-Path -Path $script:ModuleRoot -ChildPath 'Configs/Baseline.Default.psd1'
+                    $definition = Import-PowerShellDataFile -Path $baselineFile
+                    [pscustomobject]@{
+                        Name     = $definition.Name
+                        Version  = $definition.Version
+                        Profiles = $definition.Profiles
+                    }
+                }
+            }
+        }
+
+        It 'returns structured compliance data' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'example.com' -SkipReportLaunch -PassThru
+                $result | Should -Not -BeNullOrEmpty
+
+                $auditProfile = $result | Select-Object -First 1
+                $auditProfile.Domain | Should -Be 'example.com'
+                $auditProfile.Checks.Count | Should -BeGreaterThan 0
+                $auditProfile.OverallStatus | Should -Be 'Pass'
+                $auditProfile.ReportPath | Should -Be 'C:\Reports\domain_report.html'
+
+                Assert-MockCalled -CommandName Publish-DSAHtmlReport -Times 1 -Scope It
+                Assert-MockCalled -CommandName Open-DSAReport -Times 0 -Scope It
+            }
+        }
+
+        It 'uses DomainDetective default DKIM selectors when none are provided' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence }
+
+                $null = Invoke-DomainSecurityAuditor -Domain 'example.com' -SkipReportLaunch -PassThru
+
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { -not $DkimSelector }
+            }
+        }
+
+        It 'passes custom DKIM selectors from parameters' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence -Domain $Domain }
+
+                $null = Invoke-DomainSecurityAuditor -Domain 'example.com' -DkimSelector 'sel1', 'sel2' -SkipReportLaunch -PassThru
+
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { $DkimSelector -and $DkimSelector -contains 'sel1' -and $DkimSelector -contains 'sel2' }
+            }
+        }
+
+        It 'passes DNSEndpoint through to evidence collection' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence -Domain $Domain }
+
+                $null = Invoke-DomainSecurityAuditor -Domain 'example.com' -DNSEndpoint 'udp://1.1.1.1:53' -SkipReportLaunch -PassThru
+
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { $DNSEndpoint -eq 'udp://1.1.1.1:53' }
+            }
+        }
+
+        It 'honors per-domain DKIM selectors from CSV metadata' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence -Domain $Domain }
+
+                $csvPath = Join-Path -Path $TestDrive -ChildPath 'domain-selectors.csv'
+                @"
+Domain,DKIMSelectors
+example.com,alpha;beta
+contoso.com,
+"@ | Set-Content -Encoding UTF8 -Path $csvPath
+
+                $null = Invoke-DomainSecurityAuditor -InputFile $csvPath -SkipReportLaunch -PassThru
+
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { $Domain -eq 'example.com' -and $DkimSelector -and $DkimSelector -contains 'alpha' -and $DkimSelector -contains 'beta' }
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { $Domain -eq 'contoso.com' -and -not $DkimSelector }
+            }
+        }
+
+        It 'filters empty entries from malformed DKIM selector values' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence -Domain $Domain }
+
+                $csvPath = Join-Path -Path $TestDrive -ChildPath 'malformed-selectors.csv'
+                @"
+Domain,DKIMSelectors
+example.com,"selector1,,selector2"
+contoso.com,;alpha;;beta;
+"@ | Set-Content -Encoding UTF8 -Path $csvPath
+
+                $null = Invoke-DomainSecurityAuditor -InputFile $csvPath -SkipReportLaunch -PassThru
+
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { $Domain -eq 'example.com' -and $DkimSelector -contains 'selector1' -and $DkimSelector -contains 'selector2' }
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 1 -ParameterFilter { $Domain -eq 'contoso.com' -and $DkimSelector -contains 'alpha' -and $DkimSelector -contains 'beta' }
+            }
+        }
+
+        It 'flags missing MX records for active domains' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith {
+                    $evidence = New-TestEvidence
+                    $evidence.Records.MX = @()
+                    $evidence.Records.MXRecordCount = 0
+                    $evidence
+                }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'example.com' -PassThru
+                $auditProfile = $result | Select-Object -First 1
+                $auditProfile.OverallStatus | Should -Be 'Fail'
+
+                $mxCheck = $auditProfile.Checks | Where-Object { $_.Id -eq 'MXPresence' }
+                $mxCheck.Status | Should -Be 'Fail'
+                $auditProfile.ReportPath | Should -Be 'C:\Reports\domain_report.html'
+
+                Assert-MockCalled -CommandName Publish-DSAHtmlReport -Times 1 -Scope It
+                Assert-MockCalled -CommandName Open-DSAReport -Times 1 -Scope It
+            }
+        }
+
+        It 'enforces SPF lookup limits' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith {
+                    $evidence = New-TestEvidence
+                    $evidence.Records.SPFLookupCount = 15
+                    $evidence
+                }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'example.com' -PassThru
+                $auditProfile = $result | Select-Object -First 1
+
+                $spfLookup = $auditProfile.Checks | Where-Object { $_.Id -eq 'SPFLookupLimit' }
+                $spfLookup.Status | Should -Be 'Fail'
+                Assert-MockCalled -CommandName Publish-DSAHtmlReport -Times 1 -Scope It
+                Assert-MockCalled -CommandName Open-DSAReport -Times 1 -Scope It
+            }
+        }
+
+        It 'requires Null MX for parked domains' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith {
+                    $evidence = New-TestEvidence -Classification 'Parked'
+                    $evidence.Records.MXHasNull = $false
+                    $evidence
+                }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'example.com' -PassThru
+                $auditProfile = $result | Select-Object -First 1
+                $auditProfile.Classification | Should -Match 'Parked'
+
+                $nullMxCheck = $auditProfile.Checks | Where-Object { $_.Id -eq 'MXNullForParked' }
+                $nullMxCheck.Status | Should -Be 'Fail'
+                Assert-MockCalled -CommandName Publish-DSAHtmlReport -Times 1 -Scope It
+                Assert-MockCalled -CommandName Open-DSAReport -Times 1 -Scope It
+            }
+        }
+
+        It 'accepts custom baseline files' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith {
+                    $evidence = New-TestEvidence
+                    $evidence.Records.SPFLookupCount = 6
+                    $evidence
+                }
+
+                $profilePath = Join-Path -Path $TestDrive -ChildPath 'custom-baseline.psd1'
+                $psd1Content = @"
+@{
+    Name = 'Custom Test Baseline'
+    Version = '1.0'
+    Profiles = @{
+        SendingAndReceiving = @{
+            Name = 'SendingAndReceiving'
+            Checks = @(
+                @{
+                    Id = 'SPFLookupLimit'
+                    Area = 'SPF'
+                    Condition = 'LessThanOrEqual'
+                    Target = 'Records.SPFLookupCount'
+                    ExpectedValue = 5
+                    Expectation = 'SPF lookups must remain under five.'
+                    Remediation = 'Reduce include chains.'
+                    Severity = 'High'
+                    Enforcement = 'Required'
+                    References = @()
+                }
+            )
+        }
+    }
+}
+"@
+                Set-Content -Path $profilePath -Value $psd1Content -Encoding UTF8
+
+                # Override the BeforeEach mock to load the custom baseline file
+                Mock Get-DSABaseline {
+                    param($ProfilePath, $ProfileName)
+                    $definition = Import-PowerShellDataFile -Path $ProfilePath
+                    [pscustomobject]@{
+                        Name     = $definition.Name
+                        Version  = $definition.Version
+                        Profiles = $definition.Profiles
+                    }
+                } -ParameterFilter { $ProfilePath -eq $profilePath }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'example.com' -BaselineProfilePath $profilePath -SkipReportLaunch -PassThru
+                $auditProfile = $result | Select-Object -First 1
+                $spfLookup = $auditProfile.Checks | Where-Object { $_.Id -eq 'SPFLookupLimit' }
+                $spfLookup.Status | Should -Be 'Fail'
+                Assert-MockCalled -CommandName Open-DSAReport -Times 0 -Scope It
+            }
+        }
+
+        It 'skips report launch when requested' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence }
+
+                $null = Invoke-DomainSecurityAuditor -Domain 'example.com' -SkipReportLaunch -PassThru
+                Assert-MockCalled -CommandName Open-DSAReport -Times 0 -Scope It
+            }
+        }
+
+        It 'processes multiple domains' {
+            InModuleScope DomainSecurityAuditor {
+                $queue = [System.Collections.Generic.Queue[pscustomobject]]::new()
+                $queue.Enqueue((New-TestEvidence -Domain 'contoso.com'))
+                $queue.Enqueue((New-TestEvidence -Domain 'example.com'))
+                Mock -CommandName Get-DSADomainEvidence -MockWith { $queue.Dequeue() }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'contoso.com', 'example.com' -SkipReportLaunch -PassThru
+                $result.Count | Should -Be 2
+                ($result | Select-Object -ExpandProperty Domain) | Should -Contain 'example.com'
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 2 -Scope It
+                Assert-MockCalled -CommandName Publish-DSAHtmlReport -Times 1 -Scope It
+            }
+        }
+
+        It 'accepts domains from input files' {
+            InModuleScope DomainSecurityAuditor {
+                $csvPath = Join-Path -Path $TestDrive -ChildPath 'domains.csv'
+                @'
+Domain
+alpha.example
+beta.example
+'@ | Set-Content -Path $csvPath
+
+                $queue = [System.Collections.Generic.Queue[pscustomobject]]::new()
+                $queue.Enqueue((New-TestEvidence -Domain 'alpha.example'))
+                $queue.Enqueue((New-TestEvidence -Domain 'beta.example'))
+                Mock -CommandName Get-DSADomainEvidence -MockWith { $queue.Dequeue() }
+
+                $result = Invoke-DomainSecurityAuditor -InputFile $csvPath -SkipReportLaunch -PassThru
+                $result.Count | Should -Be 2
+                ($result | Select-Object -ExpandProperty Domain) | Should -Contain 'beta.example'
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 2 -Scope It
+            }
+        }
+
+        It 'falls back to newline-delimited lists when CSV headers are absent' {
+            InModuleScope DomainSecurityAuditor {
+                $txtPath = Join-Path -Path $TestDrive -ChildPath 'domains.txt'
+                @'
+gamma.example
+delta.example
+'@ | Set-Content -Path $txtPath
+
+                $queue = [System.Collections.Generic.Queue[pscustomobject]]::new()
+                $queue.Enqueue((New-TestEvidence -Domain 'gamma.example'))
+                $queue.Enqueue((New-TestEvidence -Domain 'delta.example'))
+                Mock -CommandName Get-DSADomainEvidence -MockWith { $queue.Dequeue() }
+
+                $result = Invoke-DomainSecurityAuditor -InputFile $txtPath -SkipReportLaunch -PassThru
+                $result.Count | Should -Be 2
+                ($result | Select-Object -ExpandProperty Domain) | Should -Contain 'gamma.example'
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 2 -Scope It
+            }
+        }
+
+        It 'honors classification overrides sourced from CSV metadata' {
+            InModuleScope DomainSecurityAuditor {
+                $csvPath = Join-Path -Path $TestDrive -ChildPath 'domains-with-metadata.csv'
+                @'
+Domain,Classification
+override.example,SendingOnly
+'@ | Set-Content -Path $csvPath
+
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence -Domain 'override.example' -Classification 'Parked' }
+                Mock -CommandName Invoke-DSABaselineTest -MockWith {
+                    param(
+                        $DomainEvidence,
+                        $BaselineDefinition,
+                        $ClassificationOverride
+                    )
+
+                    [pscustomobject]@{
+                        Domain                 = $DomainEvidence.Domain
+                        Classification         = if ($ClassificationOverride) { "Profile:$ClassificationOverride" } else { 'Profile:Default' }
+                        OriginalClassification = $DomainEvidence.Classification
+                        ClassificationOverride = $ClassificationOverride
+                        OverallStatus          = 'Pass'
+                        Checks                 = @()
+                    }
+                }
+
+                $result = Invoke-DomainSecurityAuditor -InputFile $csvPath -SkipReportLaunch -PassThru
+                $result.Count | Should -Be 1
+                $result[0].ClassificationOverride | Should -Be 'SendingOnly'
+                $result[0].OriginalClassification | Should -Be 'Parked'
+
+                Assert-MockCalled -CommandName Invoke-DSABaselineTest -Times 1 -Scope It -ParameterFilter { $ClassificationOverride -eq 'SendingOnly' }
+            }
+        }
+
+        It 'supports command-line classification overrides for direct domains' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { New-TestEvidence -Domain 'solo.example' -Classification 'ReceivingOnly' }
+                Mock -CommandName Invoke-DSABaselineTest -MockWith {
+                    param(
+                        $DomainEvidence,
+                        $BaselineDefinition,
+                        $ClassificationOverride
+                    )
+
+                    [pscustomobject]@{
+                        Domain                 = $DomainEvidence.Domain
+                        Classification         = if ($ClassificationOverride) { "Profile:$ClassificationOverride" } else { 'Profile:Default' }
+                        OriginalClassification = $DomainEvidence.Classification
+                        ClassificationOverride = $ClassificationOverride
+                        OverallStatus          = 'Pass'
+                        Checks                 = @()
+                    }
+                }
+
+                $result = Invoke-DomainSecurityAuditor -Domain 'solo.example' -Classification SendingOnly -SkipReportLaunch -PassThru
+                $result.Count | Should -Be 1
+                $result[0].ClassificationOverride | Should -Be 'SendingOnly'
+                Assert-MockCalled -CommandName Invoke-DSABaselineTest -Times 1 -Scope It -ParameterFilter { $ClassificationOverride -eq 'SendingOnly' }
+            }
+        }
+
+        It 'errors when CSV classification overrides contain unsupported values' {
+            InModuleScope DomainSecurityAuditor {
+                $csvPath = Join-Path -Path $TestDrive -ChildPath 'domains-invalid-metadata.csv'
+                @'
+Domain,Classification
+invalid.example,Unknown
+'@ | Set-Content -Path $csvPath
+
+                Mock -CommandName Get-DSADomainEvidence -MockWith { throw 'Should not execute for invalid CSV override' }
+
+                { Invoke-DomainSecurityAuditor -InputFile $csvPath -SkipReportLaunch } | Should -Throw -ExpectedMessage '*Allowed values*'
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 0 -Scope It
+            }
+        }
+
+        It 'errors when the command-line classification override is invalid' {
+            InModuleScope DomainSecurityAuditor {
+                Mock -CommandName Get-DSADomainEvidence -MockWith { throw 'Should not execute for invalid CLI override' }
+
+                { Invoke-DomainSecurityAuditor -Domain 'solo.example' -Classification 'InvalidType' -SkipReportLaunch } | Should -Throw -ExpectedMessage '*Allowed values*'
+                Assert-MockCalled -CommandName Get-DSADomainEvidence -Times 0 -Scope It
+            }
+        }
+
+        Context 'console output' {
+            It 'emits pass, warning, and fail counts to the information stream' {
+                InModuleScope DomainSecurityAuditor {
+                    $originalPreference = $InformationPreference
+                    $originalRendering = if ($PSStyle) { $PSStyle.OutputRendering } else { $null }
+                    try {
+                        $InformationPreference = 'SilentlyContinue'
+                        if ($PSStyle) {
+                            $PSStyle.OutputRendering = 'PlainText'
+                        }
+                        $auditProfile = [pscustomobject]@{
+                            Domain                 = 'example.com'
+                            Classification         = 'SendingAndReceiving'
+                            OriginalClassification = 'SendingAndReceiving'
+                            ClassificationOverride = $null
+                            OverallStatus          = 'Warning'
+                            Checks                 = @(
+                                [pscustomobject]@{ Id = 'CheckPass'; Status = 'Pass'; Area = 'SPF' }
+                                [pscustomobject]@{ Id = 'CheckWarn'; Status = 'Warning'; Area = 'DMARC' }
+                                [pscustomobject]@{ Id = 'CheckFail'; Status = 'Fail'; Area = 'MX' }
+                            )
+                            Evidence               = [pscustomobject]@{
+                                DKIMSelectorDetails = @()
+                            }
+                        }
+
+                        $infoOutput = & {
+                            Write-DSABaselineConsoleSummary -Profiles @($auditProfile) -ReportPath 'C:\Reports\domain_report.html'
+                        } 6>&1
+
+                        $stripAnsi = {
+                            param($Value)
+                            if (-not $Value) { return '' }
+                            return ($Value.ToString() -replace "`e\\[[0-9;]*[A-Za-z]", '')
+                        }
+
+                        $infoMessages = @($infoOutput | ForEach-Object { & $stripAnsi $_ })
+
+                        $infoMessages | Should -Contain 'Baselines complete (1 domain)'
+                        $infoMessages | Should -Contain '  [WARN] example.com (Pass 1 | Warn 1 | Fail 1)'
+                        $infoMessages | Should -Contain 'Report:'
+                        $infoMessages | Should -Contain '  C:\Reports\domain_report.html'
+                        $infoMessages | Should -Contain ''
+                    }
+                    finally {
+                        if ($PSStyle -and $null -ne $originalRendering) {
+                            $PSStyle.OutputRendering = $originalRendering
+                        }
+                        $InformationPreference = $originalPreference
+                    }
+                }
+            }
+        }
+    }
+}
+
+Describe 'Get-DSADomainEvidence' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'collects evidence via Test-DDDomainOverallHealth and forwards DNS endpoint' {
+        InModuleScope DomainSecurityAuditor {
+            Mock -CommandName Write-DSALog -MockWith { }
+            Mock -CommandName Get-Module -MockWith { $null }
+            Mock -CommandName Import-Module -MockWith { }
+
+            $script:capturedDnsEndpoint = $null
+            $script:capturedHealthChecks = @()
+            $spf = [pscustomobject]@{
+                SpfRecord         = 'v=spf1 -all'
+                SpfRecords        = @('v=spf1 -all')
+                DnsLookupsCount   = 0
+                UnknownMechanisms = @()
+                AllMechanism      = '-all'
+                HasPtrType        = $false
+                IncludeRecords    = @()
+                DnsRecordTtl      = 1200
+            }
+            $dkimResult = [pscustomobject]@{
+                DkimRecordExists  = $true
+                Selector          = 'selector1'
+                KeyLength         = 2048
+                WeakKey           = $false
+                ValidPublicKey    = $true
+                ValidRsaKeyLength = $true
+                DnsRecordTtl      = 600
+            }
+            $dkimAnalysis = [pscustomobject]@{
+                AnalysisResults = @{ selector1 = $dkimResult }
+            }
+            $dmarc = [pscustomobject]@{
+                DmarcRecord  = 'v=DMARC1; p=reject'
+                Policy       = 'reject'
+                MailtoRua    = @('rua@example.com')
+                HttpRua      = @()
+                MailtoRuf    = @()
+                HttpRuf      = @()
+                DnsRecordTtl = 400
+            }
+            $mx = [pscustomobject]@{
+                MxRecords   = @('mx1.example')
+                HasNullMx   = $false
+                MinMxTtl    = 1800
+            }
+            $mtasts = [pscustomobject]@{
+                DnsRecordPresent = $true
+                PolicyValid      = $true
+                Mode             = 'enforce'
+                DnsRecordTtl     = 1800
+            }
+            $tlsrpt = [pscustomobject]@{
+                TlsRptRecordExists = $true
+                MailtoRua          = @('mailto:tls@example.com')
+                HttpRua            = @()
+                DnsRecordTtl       = 900
+            }
+            $ttlAnalysis = [pscustomobject]@{
+                ServerTtlTxtSpf     = @{ '1.1.1.1' = 3500 }
+                ServerTtlTxtDmarc   = @{ '1.1.1.1' = 4000 }
+                ServerTtlTxtPerName = @{
+                    'selector1._domainkey.example.com' = @{ '1.1.1.1' = 3200 }
+                }
+                ServerTtlTxtMtasts  = @{}
+                ServerTtlTxtTlsRpt  = @{}
+            }
+
+            <#
+            .SYNOPSIS
+                Stubbed DomainDetective entry point for test validation.
+            #>
+            function Test-DDDomainOverallHealth {
+                [CmdletBinding()]
+                param($DomainName, $HealthCheckType, $DnsEndpoint, $DkimSelectors)
+                $script:capturedDnsEndpoint = $DnsEndpoint
+                $script:capturedHealthChecks = $HealthCheckType
+                return [pscustomobject]@{
+                    Raw = [pscustomobject]@{
+                        SpfAnalysis     = $spf
+                        DKIMAnalysis    = $dkimAnalysis
+                        DmarcAnalysis   = $dmarc
+                        MXAnalysis      = $mx
+                        MTASTSAnalysis  = $mtasts
+                        TLSRPTAnalysis  = $tlsrpt
+                        DnsTtlAnalysis  = $ttlAnalysis
+                    }
+                }
+            }
+
+            <#
+            .SYNOPSIS
+                Stubbed classification function for test validation.
+            #>
+            function Test-DDMailDomainClassification {
+                [CmdletBinding()]
+                param($DomainName, $DnsEndpoint)
+                return [pscustomobject]@{ Classification = 'SendingAndReceiving'; Raw = [pscustomobject]@{} }
+            }
+
+            $evidence = Get-DSADomainEvidence -Domain 'example.com' -DNSEndpoint 'udp://9.9.9.9:53'
+            $evidence | Should -Not -BeNullOrEmpty
+            $evidence.Records.SPFTtl | Should -Be 3500
+            $evidence.Records.DMARCTtl | Should -Be 4000
+            $evidence.Records.DKIMMinimumTtl | Should -Be 3200
+            $evidence.Records.MXMinimumTtl | Should -Be 1800
+            $evidence.Records.MTASTSMode | Should -Be 'enforce'
+            $evidence.Records.TLSRPTAddresses | Should -Contain 'mailto:tls@example.com'
+
+            $script:capturedDnsEndpoint | Should -Be 'udp://9.9.9.9:53'
+            $script:capturedHealthChecks | Should -Contain 'TTL'
+        }
+    }
+
+    It 'passes custom DKIM selectors to DomainOverallHealth and maps classification' {
+        InModuleScope DomainSecurityAuditor {
+            Mock -CommandName Write-DSALog -MockWith { }
+            Mock -CommandName Get-Module -MockWith { $null }
+            Mock -CommandName Import-Module -MockWith { }
+
+            $script:capturedSelectors = @()
+            <#
+            .SYNOPSIS
+                Stubbed DomainDetective entry point for DKIM selector tests.
+            #>
+            function Test-DDDomainOverallHealth {
+                [CmdletBinding()]
+                param($DomainName, $HealthCheckType, $DnsEndpoint, $DkimSelectors)
+                $script:capturedSelectors = $DkimSelectors
+                return [pscustomobject]@{
+                    Raw = [pscustomobject]@{
+                        SpfAnalysis    = [pscustomobject]@{
+                            SpfRecord         = 'v=spf1 -all'
+                            SpfRecords        = @('v=spf1 -all')
+                            DnsLookupsCount   = 0
+                            UnknownMechanisms = @()
+                            AllMechanism      = '-all'
+                            HasPtrType        = $false
+                            IncludeRecords    = @()
+                            DnsRecordTtl      = 300
+                        }
+                        DKIMAnalysis   = [pscustomobject]@{
+                            AnalysisResults = @{
+                                alpha = [pscustomobject]@{
+                                    DkimRecordExists  = $true
+                                    Selector          = 'alpha'
+                                    KeyLength         = 1024
+                                    WeakKey           = $false
+                                    ValidPublicKey    = $true
+                                    ValidRsaKeyLength = $true
+                                    DnsRecordTtl      = 500
+                                }
+                            }
+                        }
+                        DmarcAnalysis  = [pscustomobject]@{
+                            DmarcRecord  = 'v=DMARC1; p=quarantine'
+                            Policy       = 'quarantine'
+                            MailtoRua    = @('mailto:rua@example.com')
+                            HttpRua      = @()
+                            MailtoRuf    = @()
+                            HttpRuf      = @()
+                            DnsRecordTtl = 600
+                        }
+                        MXAnalysis     = [pscustomobject]@{
+                            MxRecords = @('mx1.example')
+                            HasNullMx = $false
+                            MinMxTtl  = 900
+                        }
+                        MTASTSAnalysis = [pscustomobject]@{
+                            DnsRecordPresent = $false
+                            PolicyValid      = $false
+                            Mode             = $null
+                            DnsRecordTtl     = $null
+                        }
+                        TLSRPTAnalysis = [pscustomobject]@{
+                            TlsRptRecordExists = $false
+                            MailtoRua          = @()
+                            HttpRua            = @()
+                            DnsRecordTtl       = $null
+                        }
+                        DnsTtlAnalysis = [pscustomobject]@{
+                            ServerTtlTxtSpf     = @{ '1.1.1.1' = 300 }
+                            ServerTtlTxtDmarc   = @{ '1.1.1.1' = 600 }
+                            ServerTtlTxtPerName = @{
+                                'alpha._domainkey.example.com' = @{ '1.1.1.1' = 500 }
+                            }
+                            ServerTtlTxtMtasts  = @{}
+                            ServerTtlTxtTlsRpt  = @{}
+                        }
+                    }
+                }
+            }
+
+            <#
+            .SYNOPSIS
+                Stubbed classification function for DKIM selector tests.
+            #>
+            function Test-DDMailDomainClassification {
+                [CmdletBinding()]
+                param($DomainName, $DnsEndpoint)
+                return [pscustomobject]@{ Classification = 'ReceivingOnly'; Raw = [pscustomobject]@{} }
+            }
+
+            $evidence = Get-DSADomainEvidence -Domain 'example.com' -DkimSelector @('alpha', 'beta')
+            $evidence.Classification | Should -Be 'ReceivingOnly'
+            $evidence.Records.DKIMSelectors | Should -Contain 'alpha'
+            $script:capturedSelectors | Should -Contain 'alpha'
+            $script:capturedSelectors | Should -Contain 'beta'
+        }
+    }
+}
+
+Describe 'Baseline profile helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+    It 'lists built-in profiles' {
+        InModuleScope DomainSecurityAuditor {
+            $profiles = Get-DSABaselineProfile
+            ($profiles | Where-Object { $_.Name -eq 'Default' }).Count | Should -BeGreaterThan 0
+        }
+    }
+
+    It 'validates profile files' {
+        InModuleScope DomainSecurityAuditor {
+            $defaultProfile = Get-DSABaselineProfile -Name 'Default'
+            $result = Test-DSABaselineProfile -Path $defaultProfile.Path
+            $result.IsValid | Should -BeTrue
+            $result.Errors.Count | Should -Be 0
+        }
+    }
+
+    It 'creates copies from built-in profiles' {
+        InModuleScope DomainSecurityAuditor {
+            $target = Join-Path -Path $TestDrive -ChildPath 'Baseline.Copy.psd1'
+            New-DSABaselineProfile -Path $target -SourceProfile 'Default' | Should -Be $target
+            Test-Path -Path $target | Should -BeTrue
+        }
+    }
+
+    It 'renders RFC references as clickable links' {
+        InModuleScope DomainSecurityAuditor {
+            $html = ConvertTo-DSAReferenceHtml -Reference 'RFC 7208 §3.1'
+            $html | Should -Match '<a '
+            $html | Should -Match 'rfc7208#section-3\.1'
+        }
+    }
+
+    It 'renders known named references as clickable links' {
+        InModuleScope DomainSecurityAuditor {
+            $html = ConvertTo-DSAReferenceHtml -Reference 'M3AAWG Email Authentication Best Practices'
+            $html | Should -Match '<a '
+            $html | Should -Match 'm3aawg'
+        }
+    }
+}
+
+Describe 'Test-DSAProperty' {
+    It 'returns true when PSObject has the property' {
+        InModuleScope DomainSecurityAuditor {
+            $obj = [pscustomobject]@{ Name = 'test'; Value = 42 }
+            Test-DSAProperty -InputObject $obj -Name 'Name' | Should -BeTrue
+            Test-DSAProperty -InputObject $obj -Name 'Value' | Should -BeTrue
+        }
+    }
+
+    It 'returns false when PSObject lacks the property' {
+        InModuleScope DomainSecurityAuditor {
+            $obj = [pscustomobject]@{ Name = 'test' }
+            Test-DSAProperty -InputObject $obj -Name 'Missing' | Should -BeFalse
+        }
+    }
+
+    It 'returns true when hashtable contains the key' {
+        InModuleScope DomainSecurityAuditor {
+            $hash = @{ Name = 'test'; Count = 5 }
+            Test-DSAProperty -InputObject $hash -Name 'Name' | Should -BeTrue
+            Test-DSAProperty -InputObject $hash -Name 'Count' | Should -BeTrue
+        }
+    }
+
+    It 'returns false when hashtable lacks the key' {
+        InModuleScope DomainSecurityAuditor {
+            $hash = @{ Name = 'test' }
+            Test-DSAProperty -InputObject $hash -Name 'Missing' | Should -BeFalse
+        }
+    }
+
+    It 'returns false for null input' {
+        InModuleScope DomainSecurityAuditor {
+            Test-DSAProperty -InputObject $null -Name 'Any' | Should -BeFalse
+        }
+    }
+}
+
+Describe 'Get-DSAStatusMetadata' {
+    It 'returns correct metadata for Pass status' {
+        InModuleScope DomainSecurityAuditor {
+            $meta = Get-DSAStatusMetadata -Status 'Pass'
+            $meta.Class | Should -Be 'passed'
+            $meta.Filter | Should -Be 'pass'
+            $meta.Icon | Should -Be '✔'
+        }
+    }
+
+    It 'returns correct metadata for Fail status' {
+        InModuleScope DomainSecurityAuditor {
+            $meta = Get-DSAStatusMetadata -Status 'Fail'
+            $meta.Class | Should -Be 'failed'
+            $meta.Filter | Should -Be 'fail'
+            $meta.Icon | Should -Be '✖'
+        }
+    }
+
+    It 'returns correct metadata for Warning status' {
+        InModuleScope DomainSecurityAuditor {
+            $meta = Get-DSAStatusMetadata -Status 'Warning'
+            $meta.Class | Should -Be 'warning'
+            $meta.Filter | Should -Be 'warning'
+            $meta.Icon | Should -Be '!'
+        }
+    }
+
+    It 'returns info metadata for unknown status' {
+        InModuleScope DomainSecurityAuditor {
+            $meta = Get-DSAStatusMetadata -Status 'Unknown'
+            $meta.Class | Should -Be 'info'
+            $meta.Filter | Should -Be 'info'
+            $meta.Icon | Should -Be 'ℹ'
+        }
+    }
+
+    It 'returns info metadata for null or empty status' {
+        InModuleScope DomainSecurityAuditor {
+            $meta = Get-DSAStatusMetadata -Status ''
+            $meta.Class | Should -Be 'info'
+            $meta.Filter | Should -Be 'info'
+
+            $meta = Get-DSAStatusMetadata -Status $null
+            $meta.Class | Should -Be 'info'
+        }
+    }
+
+    It 'handles case-insensitive status values' {
+        InModuleScope DomainSecurityAuditor {
+            $meta = Get-DSAStatusMetadata -Status 'PASS'
+            $meta.Class | Should -Be 'passed'
+
+            $meta = Get-DSAStatusMetadata -Status 'fail'
+            $meta.Class | Should -Be 'failed'
+
+            $meta = Get-DSAStatusMetadata -Status 'WARNING'
+            $meta.Class | Should -Be 'warning'
+        }
+    }
+}
+
+Describe 'Dependency helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'returns missing modules when they are not available' {
+        InModuleScope DomainSecurityAuditor {
+            Mock -CommandName Write-DSALog -MockWith { }
+            Mock -CommandName Get-Module -MockWith {
+                param($Name, $ListAvailable)
+                if ($ListAvailable -and ($Name -contains 'Present')) {
+                    return [pscustomobject]@{ Name = 'Present' }
+                }
+            } -ParameterFilter { $ListAvailable -eq $true }
+
+            $result = Test-DSADependency -Name @('Present', 'MissingOne')
+            $result.IsCompliant | Should -BeFalse
+            $result.MissingModules | Should -Contain 'MissingOne'
+        }
+    }
+
+    It 'installs missing modules when Install-Module succeeds' {
+        InModuleScope DomainSecurityAuditor {
+            Mock -CommandName Write-DSALog -MockWith { }
+
+            $available = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            Mock -CommandName Get-Module -MockWith {
+                param($Name, $ListAvailable)
+                if ($ListAvailable -and $Name -and ($Name -is [System.Collections.IEnumerable])) {
+                    $foundModules = @()
+                    foreach ($entry in $Name) {
+                        if ($available.Contains($entry)) {
+                            $foundModules += [pscustomobject]@{ Name = $entry }
+                        }
+                    }
+                    return $foundModules
+                }
+                if ($ListAvailable -and $Name -and $available.Contains($Name)) {
+                    return [pscustomobject]@{ Name = $Name }
+                }
+            } -ParameterFilter { $ListAvailable -eq $true }
+
+            $stubCommandCreated = $false
+            if (-not (Get-Command -Name Install-Module -ErrorAction SilentlyContinue)) {
+                Set-Item -Path Function:\Install-Module -Value { param($Name) }
+                $stubCommandCreated = $true
+            }
+
+            try {
+                Mock -CommandName Install-Module -MockWith {
+                    param($Name)
+                    $null = $available.Add($Name)
+                }
+
+                $result = Test-DSADependency -Name @('DomainDetective') -AttemptInstallation
+                $result.IsCompliant | Should -BeTrue
+                $result.MissingModules.Count | Should -Be 0
+                Assert-MockCalled -CommandName Install-Module -Times 1 -Scope It -Exactly -ParameterFilter { $Name -eq 'DomainDetective' }
+            }
+            finally {
+                if ($stubCommandCreated) {
+                    Remove-Item -Path Function:\Install-Module -ErrorAction SilentlyContinue
+                }
+            }
+        }
+    }
+
+    It 'throws and logs when dependencies remain missing' {
+        InModuleScope DomainSecurityAuditor {
+            $logged = [System.Collections.Generic.List[string]]::new()
+            Mock -CommandName Write-DSALog -MockWith {
+                param($Message)
+                $logged.Add($Message) | Out-Null
+            }
+
+            Mock -CommandName Test-DSADependency -MockWith {
+                [pscustomobject]@{
+                    MissingModules = @('Pester')
+                    IsCompliant    = $false
+                }
+            }
+
+            { Confirm-DSADependencies -Name @('Pester') -LogFile 'log.txt' } | Should -Throw -ExpectedMessage '*Missing dependencies*'
+            ($logged -join ' ') | Should -Match 'Missing dependencies: Pester'
+        }
+    }
+
+    It 'imports DomainDetective only once per session' {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+            $script:DSADomainDetectiveLoaded = $true
+            $importCount = 0
+            Mock -CommandName Get-Module -MockWith { throw 'should not query modules' }
+            Mock -CommandName Import-Module -MockWith { $importCount++ }
+
+            Import-DSADomainDetectiveModule
+
+            $importCount | Should -Be 0
+            $script:DSADomainDetectiveLoaded | Should -BeTrue
+        }
+    }
+}
+
+Describe 'Path and run context helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'rejects invalid paths and overly long paths' {
+        InModuleScope DomainSecurityAuditor {
+            $invalidChar = [System.IO.Path]::GetInvalidPathChars() | Select-Object -First 1
+            $invalidPath = "Invalid${invalidChar}Path"
+            { Resolve-DSAPath -Path $invalidPath } | Should -Throw -ExpectedMessage '*invalid characters*'
+
+            $longName = 'a' * 221
+            $longPath = Join-Path -Path $TestDrive -ChildPath "$longName.txt"
+            { Resolve-DSAPath -Path $longPath -PathType 'File' -EnsureExists } | Should -Throw -ExpectedMessage '*exceeds*'
+        }
+    }
+
+    It 'creates directories and files when EnsureExists is specified' {
+        InModuleScope DomainSecurityAuditor {
+            $dirPath = Join-Path -Path $TestDrive -ChildPath 'nested/dir'
+            $resolvedDir = Resolve-DSAPath -Path $dirPath -EnsureExists
+            Test-Path -Path $resolvedDir | Should -BeTrue
+
+            $filePath = Join-Path -Path $TestDrive -ChildPath 'files/example.txt'
+            $resolvedFile = Resolve-DSAPath -Path $filePath -PathType 'File' -EnsureExists
+            Test-Path -Path $resolvedFile | Should -BeTrue
+        }
+    }
+
+    It 'initializes run context and prunes logs' {
+        InModuleScope DomainSecurityAuditor {
+            Mock -CommandName Start-Transcript -MockWith { }
+            Mock -CommandName Invoke-DSALogRetention -MockWith { }
+            Mock -CommandName Write-DSALog -MockWith { }
+
+            $context = New-DSARunContext -OutputRoot $TestDrive -LogRoot $TestDrive -RetentionCount 2
+            $context.LogFile | Should -Not -BeNullOrEmpty
+            $context.OutputRoot | Should -Not -BeNullOrEmpty
+            $context.TranscriptStarted | Should -BeTrue
+
+            Assert-MockCalled -CommandName Invoke-DSALogRetention -Times 1 -Scope It
+            Assert-MockCalled -CommandName Start-Transcript -Times 1 -Scope It
+        }
+    }
+
+    It 'logs a warning when transcript start fails' {
+        InModuleScope DomainSecurityAuditor {
+            Mock -CommandName Invoke-DSALogRetention -MockWith { }
+            Mock -CommandName Start-Transcript -MockWith { throw 'transcript failure' }
+            $logged = [System.Collections.Generic.List[string]]::new()
+            Mock -CommandName Write-DSALog -MockWith {
+                param($Message)
+                $logged.Add($Message) | Out-Null
+            }
+
+            $context = New-DSARunContext -OutputRoot $TestDrive -LogRoot $TestDrive
+            $context.TranscriptStarted | Should -BeFalse
+            ($logged -join ' ') | Should -Match 'Failed to start transcript'
+        }
+    }
+}
+
+Describe 'Baseline validation helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'flags duplicate check identifiers' {
+        InModuleScope DomainSecurityAuditor {
+            $path = Join-Path -Path $TestDrive -ChildPath 'Baseline.Duplicate.psd1'
+            @"
+@{
+    Profiles = @{
+        Default = @{
+            Checks = @(
+                @{ Id = 'Dup'; Condition = 'MustExist'; Target = 'Records.MX'; Area = 'MX'; Severity = 'High' },
+                @{ Id = 'Dup'; Condition = 'MustExist'; Target = 'Records.SPFRecord'; Area = 'SPF'; Severity = 'High' }
+            )
+        }
+    }
+}
+"@ | Set-Content -Path $path -Encoding UTF8
+
+            $result = Test-DSABaselineProfile -Path $path
+            $result.IsValid | Should -BeFalse
+            ($result.Errors -join ' ') | Should -Match 'duplicate check Id'
+        }
+    }
+
+    It 'detects missing required properties and invalid ExpectedValue' {
+        InModuleScope DomainSecurityAuditor {
+            $path = Join-Path -Path $TestDrive -ChildPath 'Baseline.Invalid.psd1'
+            @'
+@{
+    Profiles = @{
+        Default = @{
+            Checks = @(
+                @{ Id = 'MissingTarget'; Condition = 'MustContain'; Area = 'SPF'; Severity = 'High' },
+                @{ Id = 'BadExpected'; Condition = 'MustContain'; Target = 'Records.SPFRecord'; Area = 'SPF'; Severity = 'High'; ExpectedValue = $null }
+            )
+        }
+    }
+}
+'@ | Set-Content -Path $path -Encoding UTF8
+
+            $result = Test-DSABaselineProfile -Path $path
+            $result.IsValid | Should -BeFalse
+            ($result.Errors -join ' ') | Should -Match 'missing required property'
+            ($result.Errors -join ' ') | Should -Match 'define an ExpectedValue'
+        }
+    }
+
+    It 'rejects unsupported baseline file extensions' {
+        InModuleScope DomainSecurityAuditor {
+            $path = Join-Path -Path $TestDrive -ChildPath 'Baseline.txt'
+            Set-Content -Path $path -Value 'content' -Encoding UTF8
+            { Import-DSABaselineConfig -Path $path } | Should -Throw -ExpectedMessage '*Unsupported baseline profile extension*'
+        }
+    }
+
+    It 'throws when named baseline profile is missing' {
+        InModuleScope DomainSecurityAuditor {
+            { Get-DSABaseline -ProfileName 'DoesNotExist' } | Should -Throw -ExpectedMessage '*not found*'
+        }
+    }
+}
+
+Describe 'Condition and value helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'validates ExpectedValue payloads' {
+        InModuleScope DomainSecurityAuditor {
+            $validation = Test-DSAConditionExpectedValue -Condition 'MustContain' -ExpectedValue $null
+            $validation.IsValid | Should -BeFalse
+            $validation.Message | Should -Match 'ExpectedValue'
+
+            $rangeValidation = Test-DSAConditionExpectedValue -Condition 'BetweenInclusive' -ExpectedValue @{ Min = $null; Max = $null }
+            $rangeValidation.IsValid | Should -BeFalse
+        }
+    }
+
+    It 'evaluates baseline conditions correctly' -TestCases @(
+        @{ Condition = 'MustContain'; Value = 'spf include'; ExpectedValue = 'include'; ExpectedResult = $true }
+        @{ Condition = 'MustNotContain'; Value = @('ptr', 'mx'); ExpectedValue = @('ptr'); ExpectedResult = $false }
+        @{ Condition = 'MustBeOneOf'; Value = 'Reject'; ExpectedValue = @('Reject', 'Quarantine'); ExpectedResult = $true }
+        @{ Condition = 'LessThanOrEqual'; Value = 5; ExpectedValue = 10; ExpectedResult = $true }
+        @{ Condition = 'LessThanOrEqual'; Value = '5'; ExpectedValue = 10; ExpectedResult = $true }
+        @{ Condition = 'BetweenInclusive'; Value = 400; ExpectedValue = @{ Min = 300; Max = 600 }; ExpectedResult = $true }
+        @{ Condition = 'BetweenInclusive'; Value = 'non-numeric'; ExpectedValue = @{ Min = 300; Max = 600 }; ExpectedResult = $false }
+        @{ Condition = 'MustBeEmpty'; Value = @(); ExpectedValue = $null; ExpectedResult = $true }
+        @{ Condition = 'UnsupportedCondition'; Value = 'value'; ExpectedValue = $null; ExpectedResult = $false }
+    ) {
+        param($Condition, $Value, $ExpectedValue, $ExpectedResult)
+
+        InModuleScope DomainSecurityAuditor -Parameters $_ {
+            $result = Test-DSABaselineCondition -Condition $Condition -Value $Value -ExpectedValue $ExpectedValue
+            $result | Should -Be $ExpectedResult
+        }
+    }
+
+    It 'normalizes and formats values' {
+        InModuleScope DomainSecurityAuditor {
+            (ConvertTo-DSABaselineArray -Value $null).Count | Should -Be 0
+            (@(ConvertTo-DSABaselineArray -Value 'solo')).Count | Should -Be 1
+            Format-DSAActualValue -Value $null | Should -Be 'None'
+            Format-DSAActualValue -Value @($null) | Should -Be 'None'
+            Format-DSAActualValue -Value @('a', 'b') | Should -Be 'a, b'
+        }
+    }
+}
+
+Describe 'DKIM and status helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'evaluates DKIM selector status using default minimum key length' {
+        InModuleScope DomainSecurityAuditor {
+            $check = [pscustomobject]@{
+                Id      = 'DKIMKeyStrength'
+                Area    = 'DKIM'
+                Status  = 'Pass'
+                Severity = 'High'
+            }
+            $selector = [pscustomobject]@{
+                Selector         = 'sel1'
+                DkimRecordExists = $true
+                KeyLength        = 512
+                ValidPublicKey   = $true
+                ValidRsaKeyLength = $true
+                WeakKey          = $false
+            }
+
+            $status = Get-DSADkimSelectorStatus -Selector $selector -Check $check
+            $status | Should -Be 'Fail'
+        }
+    }
+
+    It 'fails selectors when required DKIM properties are missing' {
+        InModuleScope DomainSecurityAuditor {
+            $check = [pscustomobject]@{
+                Id       = 'DKIMKeyStrength'
+                Area     = 'DKIM'
+                Status   = 'Pass'
+                Severity = 'High'
+            }
+            $selector = [pscustomobject]@{
+                Selector         = 'missing-fields'
+                DkimRecordExists = $true
+                WeakKey          = $false
+            }
+
+            Get-DSADkimSelectorStatus -Selector $selector -Check $check | Should -Be 'Fail'
+
+            $ttlCheck = [pscustomobject]@{
+                Id            = 'DKIMTtl'
+                Area          = 'DKIM'
+                Status        = 'Pass'
+                ExpectedValue = @{ Min = 300; Max = 600 }
+            }
+
+            Get-DSADkimSelectorStatus -Selector $selector -Check $ttlCheck | Should -Be 'Fail'
+        }
+    }
+
+    It 'applies TTL bounds and propagates selector failures' {
+        InModuleScope DomainSecurityAuditor {
+            $check = [pscustomobject]@{
+                Id           = 'DKIMTtl'
+                Area         = 'DKIM'
+                Status       = 'Pass'
+                ExpectedValue = @{ Min = 300; Max = 600 }
+            }
+            $selector = [pscustomobject]@{
+                Selector = 'sel2'
+                DkimRecordExists = $true
+                KeyLength = 2048
+                ValidPublicKey = $true
+                ValidRsaKeyLength = $true
+                DnsRecordTtl = 120
+            }
+            $status = Get-DSADkimSelectorStatus -Selector $selector -Check $check
+            $status | Should -Be 'Fail'
+
+            $effective = Get-DSAEffectiveChecks -Checks @([pscustomobject]@{ Id = 'DKIMTtl'; Area = 'DKIM'; Status = 'Pass' }) -SelectorDetails @($selector)
+            $effective[0].Status | Should -Be 'Fail'
+        }
+    }
+
+    It 'counts statuses and handles DKIM-only overall status' {
+        InModuleScope DomainSecurityAuditor {
+            $checks = @(
+                [pscustomobject]@{ Id = 'One'; Area = 'DKIM'; Status = 'Fail' },
+                [pscustomobject]@{ Id = 'Two'; Area = 'DKIM'; Status = 'Pass' }
+            )
+            $counts = Get-DSAStatusCounts -Checks $checks
+            $counts.Fail | Should -Be 1
+            $counts.Pass | Should -Be 1
+            $counts.Total | Should -Be 2
+
+            $overall = Get-DSAOverallStatus -Checks $checks
+            $overall | Should -Be 'Fail'
+        }
+    }
+}
+
+Describe 'Domain input and context helpers' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+
+    It 'throws when no domains are supplied' {
+        InModuleScope DomainSecurityAuditor {
+            { Get-DSADomainInputState -CollectedDomains ([System.Collections.Generic.List[string]]::new()) -DomainMetadata @{} -DirectDomainSet ([System.Collections.Generic.HashSet[string]]::new()) } | Should -Throw -ExpectedMessage '*No domains were supplied*'
+        }
+    }
+
+    It 'falls back to newline-delimited files when CSV import fails' {
+        InModuleScope DomainSecurityAuditor {
+            $inputPath = Join-Path -Path $TestDrive -ChildPath 'domains.txt'
+            @'
+alpha.example
+beta.example
+'@ | Set-Content -Path $inputPath -Encoding UTF8
+
+            $logFile = Join-Path -Path $TestDrive -ChildPath 'log.txt'
+            Mock -CommandName Write-DSALog -MockWith { }
+
+            $state = Get-DSADomainInputState -CollectedDomains ([System.Collections.Generic.List[string]]::new()) -DomainMetadata @{} -DirectDomainSet ([System.Collections.Generic.HashSet[string]]::new()) -InputFile $inputPath -LogFile $logFile
+            $state.TargetDomains | Should -Contain 'alpha.example'
+            $state.TargetDomains | Should -Contain 'beta.example'
+        }
+    }
+
+    It 'prefers metadata classification over parameter overrides and applies global selectors' {
+        InModuleScope DomainSecurityAuditor {
+            $metadata = @{
+                'example.com' = [pscustomobject]@{
+                    Classification       = 'SendingOnly'
+                    ClassificationSource = 'CSV'
+                }
+            }
+            $direct = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            $direct.Add('example.com') | Out-Null
+
+            $context = Resolve-DSADomainContext -DomainName 'example.com' -DomainMetadata $metadata -DirectDomainSet $direct -DefaultClassificationOverride 'ReceivingOnly' -GlobalDkimSelectors @('alpha') -ResolvedDnsEndpoint 'udp://1.1.1.1:53'
+            $context.ClassificationOverride | Should -Be 'SendingOnly'
+            $context.ClassificationSource | Should -Be 'CSV'
+            $context.DkimSelectors | Should -Contain 'alpha'
+            $context.ResolvedDnsEndpoint | Should -Be 'udp://1.1.1.1:53'
+        }
+    }
+
+    It 'applies parameter classification overrides for direct domains when metadata is absent' {
+        InModuleScope DomainSecurityAuditor {
+            $metadata = @{}
+            $direct = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            $direct.Add('nocsv.example') | Out-Null
+
+            $context = Resolve-DSADomainContext -DomainName 'nocsv.example' -DomainMetadata $metadata -DirectDomainSet $direct -DefaultClassificationOverride 'ReceivingOnly' -GlobalDkimSelectors @()
+            $context.ClassificationOverride | Should -Be 'ReceivingOnly'
+            $context.ClassificationSource | Should -Be 'Parameter'
+        }
+    }
+}
diff --git a/Tests/Publish-DSAHtmlReport.Tests.ps1 b/Tests/Publish-DSAHtmlReport.Tests.ps1
new file mode 100644
index 0000000..7de7385
--- /dev/null
+++ b/Tests/Publish-DSAHtmlReport.Tests.ps1
@@ -0,0 +1,149 @@
+BeforeAll {
+    $stubModuleRoot = Join-Path -Path $PSScriptRoot -ChildPath 'Stubs'
+    if (Test-Path -Path $stubModuleRoot) {
+        $env:PSModulePath = "{0}{1}{2}" -f $stubModuleRoot, [System.IO.Path]::PathSeparator, $env:PSModulePath
+    }
+
+    $moduleManifest = Join-Path -Path $PSScriptRoot -ChildPath '..\DomainSecurityAuditor.psd1'
+    Import-Module -Name (Resolve-Path -Path $moduleManifest) -Force
+}
+
+Describe 'Publish-DSAHtmlReport' {
+    AfterEach {
+        InModuleScope DomainSecurityAuditor {
+            Reset-DSAModuleState
+        }
+    }
+    It 'renders expected header and footer metadata' {
+        InModuleScope DomainSecurityAuditor {
+            $complianceProfile = [pscustomobject]@{
+                Domain                 = 'example.com'
+                Classification         = 'Default'
+                OriginalClassification = 'SendingOnly'
+                ClassificationOverride = $null
+                OverallStatus          = 'Pass'
+                Checks                 = @()
+                Timestamp              = (Get-Date)
+                Evidence               = [pscustomobject]@{}
+            }
+
+            $outputRoot = Join-Path -Path $TestDrive -ChildPath 'Output'
+            $reportPath = Publish-DSAHtmlReport -Profiles $complianceProfile -OutputRoot $outputRoot -GeneratedOn (Get-Date)
+            Test-Path -Path $reportPath | Should -BeTrue
+
+            $content = Get-Content -Path $reportPath -Raw
+            ($content -like '*Collected:*') | Should -BeTrue
+            ($content -match 'Test Suite') | Should -BeTrue
+            $content.Contains('DomainSecurityAuditor v') | Should -BeTrue
+            $content.Contains('DomainSecurityAuditor on GitHub') | Should -BeTrue
+        }
+    }
+
+    It 'renders DKIM selectors within the DKIM section' {
+        InModuleScope DomainSecurityAuditor {
+            $complianceProfile = [pscustomobject]@{
+                Domain                 = 'example.com'
+                Classification         = 'Default'
+                OriginalClassification = 'SendingOnly'
+                ClassificationOverride = $null
+                OverallStatus          = 'Pass'
+                Checks                 = @(
+                    [pscustomobject]@{
+                        Id            = 'DKIMKeyStrength'
+                        Area          = 'DKIM'
+                        Status        = 'Pass'
+                        Severity      = 'High'
+                        Enforcement   = 'Required'
+                        Expectation   = 'Ensure DKIM selectors are strong.'
+                        Actual        = 'selector1, selector2, missing'
+                        Remediation   = ''
+                        References    = @()
+                        ExpectedValue = 1024
+                    }
+                )
+                Timestamp              = (Get-Date)
+                Evidence               = [pscustomobject]@{
+                    DKIMSelectorDetails = @(
+                        [pscustomobject]@{ Name = 'selector1'; KeyLength = 2048; Ttl = 3600; IsValid = $true; Found = $true }
+                        [pscustomobject]@{ Name = 'selector2'; KeyLength = 768; Ttl = 7200; IsValid = $false; Found = $true }
+                        [pscustomobject]@{ Name = 'missing'; KeyLength = $null; Ttl = $null; IsValid = $false; Found = $false }
+                    )
+                }
+            }
+
+            $outputRoot = Join-Path -Path $TestDrive -ChildPath 'Output'
+            $reportPath = Publish-DSAHtmlReport -Profiles $complianceProfile -OutputRoot $outputRoot -GeneratedOn (Get-Date)
+            $content = Get-Content -Path $reportPath -Raw
+            $content | Should -Match 'Selector details'
+            $content | Should -Match 'selector1'
+            $content | Should -Match 'selector2'
+            $content | Should -Match 'missing'
+            $content | Should -Match 'Key: 2048'
+        }
+    }
+
+    It 'handles profiles with no checks' {
+        InModuleScope DomainSecurityAuditor {
+            $complianceProfile = [pscustomobject]@{
+                Domain                 = 'example.com'
+                Classification         = 'Default'
+                OriginalClassification = 'SendingOnly'
+                ClassificationOverride = $null
+                OverallStatus          = 'Pass'
+                Checks                 = @()
+                Timestamp              = (Get-Date)
+                Evidence               = [pscustomobject]@{}
+            }
+
+            $summary = Get-DSAReportSummary -Profiles $complianceProfile
+            $summary.TotalChecks | Should -Be 0
+            $summary.DomainCount | Should -Be 1
+        }
+    }
+
+    It 'throws when no profiles are supplied' {
+        InModuleScope DomainSecurityAuditor {
+            { Publish-DSAHtmlReport -Profiles @() -OutputRoot $TestDrive -GeneratedOn (Get-Date) } | Should -Throw -ExpectedMessage '*null, empty*'
+        }
+    }
+
+    It 'includes filter metadata and classification overrides in the rendered report' {
+        InModuleScope DomainSecurityAuditor {
+            $complianceProfile = [pscustomobject]@{
+                Domain                 = 'demo.example'
+                Classification         = 'Default'
+                OriginalClassification = 'Parked'
+                ClassificationOverride = 'SendingOnly'
+                OverallStatus          = 'Fail'
+                Checks                 = @(
+                    [pscustomobject]@{ Id = 'CheckPass'; Area = 'SPF'; Status = 'Pass'; Severity = 'High'; Enforcement = 'Required'; Expectation = 'Pass expectation'; ExpectedValue = $null; Actual = 'ok'; Remediation = ''; References = @() },
+                    [pscustomobject]@{ Id = 'CheckWarn'; Area = 'DMARC'; Status = 'Warning'; Severity = 'Medium'; Enforcement = 'Recommended'; Expectation = 'Warn expectation'; ExpectedValue = $null; Actual = 'warn'; Remediation = ''; References = @() },
+                    [pscustomobject]@{ Id = 'CheckFail'; Area = 'MX'; Status = 'Fail'; Severity = 'High'; Enforcement = 'Required'; Expectation = 'Fail expectation'; ExpectedValue = $null; Actual = 'fail'; Remediation = ''; References = @() }
+                )
+                Timestamp              = (Get-Date)
+                Evidence               = [pscustomobject]@{
+                    DKIMSelectorDetails = @()
+                }
+            }
+
+            $outputRoot = Join-Path -Path $TestDrive -ChildPath 'Output'
+            $reportPath = Publish-DSAHtmlReport -Profiles $complianceProfile -OutputRoot $outputRoot -GeneratedOn (Get-Date) -BaselineName 'Default' -BaselineVersion '1.0'
+            $content = Get-Content -Path $reportPath -Raw
+
+            $content | Should -Match 'data-filter="pass"'
+            $content | Should -Match 'data-filter="fail"'
+            $content | Should -Match 'data-filter="warning"'
+            $content | Should -Match 'aria-pressed="false"'
+            $content | Should -Match 'Override: SendingOnly'
+            $content | Should -Match 'Detected: Parked'
+        }
+    }
+}
+
+Describe 'Resolve-DSAClassificationOverride' {
+    It 'rejects blank override values' {
+        InModuleScope DomainSecurityAuditor {
+            { Resolve-DSAClassificationOverride -Value '' -SourceDescription 'test parameter' } | Should -Throw -ExpectedMessage '*cannot be empty*Allowed values*'
+        }
+    }
+}
diff --git a/Tests/Stubs/DomainDetective/DomainDetective.psd1 b/Tests/Stubs/DomainDetective/DomainDetective.psd1
new file mode 100644
index 0000000..765fe00
--- /dev/null
+++ b/Tests/Stubs/DomainDetective/DomainDetective.psd1
@@ -0,0 +1,15 @@
+@{
+    RootModule        = 'DomainDetective.psm1'
+    ModuleVersion     = '0.0.1'
+    GUID              = 'd1c1d8b2-53b6-4aa7-80d3-6cab7b9bf0ea'
+    Author            = 'DomainSecurityAuditor Test Stub'
+    CompanyName       = 'DomainSecurityAuditor'
+    PowerShellVersion = '7.0'
+    FunctionsToExport = @('Invoke-DomainDetective')
+    PrivateData       = @{
+        PSData = @{
+            Tags       = @('Stub', 'Testing')
+            ProjectUri = 'https://github.com/thetechgy/DomainSecurityAuditor'
+        }
+    }
+}
diff --git a/Tests/Stubs/DomainDetective/DomainDetective.psm1 b/Tests/Stubs/DomainDetective/DomainDetective.psm1
new file mode 100644
index 0000000..e28f345
--- /dev/null
+++ b/Tests/Stubs/DomainDetective/DomainDetective.psm1
@@ -0,0 +1,33 @@
+function Invoke-DomainDetective {
+    <#
+    .SYNOPSIS
+        Test stub for the DomainDetective entry point.
+    .DESCRIPTION
+        Returns canned domain metadata so DomainSecurityAuditor tests can run without the real module.
+    .PARAMETER Domain
+        Target domain name to echo into the stubbed payload.
+    .OUTPUTS
+        PSCustomObject
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Domain
+    )
+
+    return [pscustomobject]@{
+        Domain               = $Domain
+        Classification       = 'SendingAndReceiving'
+        MXRecords            = @('mx1.stubbed.example')
+        SPFRecord            = 'v=spf1 include:_spf.stubbed.example -all'
+        DKIMSelectors        = @('selector1')
+        DMARCRecord          = 'v=DMARC1; p=reject'
+        MTASTSMode           = 'enforce'
+        MTASTSTtl            = 86400
+        TLSRPT               = 'v=TLSRPTv1; rua=mailto:tls@stubbed.example'
+        SPFRecordTTL         = 3600
+        DMARCRecordTTL       = 3600
+        TLSRPTTtl            = 86400
+    }
+}
diff --git a/Tests/Stubs/PSScriptAnalyzer/PSScriptAnalyzer.psd1 b/Tests/Stubs/PSScriptAnalyzer/PSScriptAnalyzer.psd1
new file mode 100644
index 0000000..ac97020
--- /dev/null
+++ b/Tests/Stubs/PSScriptAnalyzer/PSScriptAnalyzer.psd1
@@ -0,0 +1,9 @@
+@{
+    RootModule        = 'PSScriptAnalyzer.psm1'
+    ModuleVersion     = '0.0.1'
+    GUID              = '4a49acbd-3b60-4db5-b086-3c9f03dde5f1'
+    Author            = 'DomainSecurityAuditor Test Stub'
+    CompanyName       = 'DomainSecurityAuditor'
+    PowerShellVersion = '7.0'
+    FunctionsToExport = @('Invoke-ScriptAnalyzer')
+}
diff --git a/Tests/Stubs/PSScriptAnalyzer/PSScriptAnalyzer.psm1 b/Tests/Stubs/PSScriptAnalyzer/PSScriptAnalyzer.psm1
new file mode 100644
index 0000000..d9d6502
--- /dev/null
+++ b/Tests/Stubs/PSScriptAnalyzer/PSScriptAnalyzer.psm1
@@ -0,0 +1,27 @@
+function Invoke-ScriptAnalyzer {
+    <#
+    .SYNOPSIS
+        Stubbed ScriptAnalyzer invocation for tests.
+    .DESCRIPTION
+        Returns an empty result set while exercising the same parameter surface as the real cmdlet.
+    .PARAMETER Path
+        Path passed through from Invoke-ScriptAnalyzer callers.
+    .PARAMETER Settings
+        Optional settings file forwarded from the caller.
+    .OUTPUTS
+        System.Object[]
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param (
+        [Parameter(ValueFromPipelineByPropertyName = $true)]
+        [string]$Path,
+
+        [Parameter()]
+        [string]$Settings
+    )
+
+    process {
+        return @()
+    }
+}