Skill: luigi08001/gmail-to-outlook (version 1.2.0)

--- name: gmail-to-outlook description: "Migrate email, contacts, and calendars from Google Workspace (Gmail) to Microsoft 365 (Outlook/Exchange Online). Use when a user asks to migrate from Gmail to Outlook, transfer emails from Google Workspace to Office 365, export Google Takeout to Outlook, switch from Gmail to Exchange, or plan a Google Workspace to Microsoft 365 migration. Covers: single-user migrations, bulk/org-wide migrations, MBOX imports, calendar + contacts transfer, DNS/MX cutover, and post-migration validation." --- # Gmail to Outlook Migration ## Migration Paths Assess the source environment first: | Source | Best Method | Scope | |--------|------------|-------| | Google Workspace | Microsoft Data Migration Service | Org-wide, bulk | | Google Takeout (MBOX) | Outlook Desktop Import | Per-user | | Gmail (personal) | IMAP bridge via Outlook Desktop | Per-user | | G Suite Legacy | Microsoft Migration Tools | Per-user or bulk | ## Pre-Migration Checklist Run through this with the client before touching anything: 1. **Inventory** — Number of users, total mailbox sizes, largest mailbox, shared mailboxes, Google Groups 2. **Microsoft 365 plan** — Confirm active subscription, verify admin access (Global Admin required) 3. **Source admin access** — Google Workspace Super Admin + service account for bulk migration 4. **DNS access** — Whoever manages MX records (registrar, Cloudflare, etc.) 5. **Data scope** — Email only? +Contacts? +Calendars? +Drive files? 6. **Cutover window** — When to switch MX records (weekend recommended) 7. **Client communication** — Draft email to users about the switch, new login instructions 8. **Retention** — Keep Google Workspace active 30 days post-migration as safety net ## Method 1: Microsoft Data Migration Service (Recommended for Google Workspace) Best for org-wide migrations from Google Workspace to Microsoft 365. ### Setup 1. Microsoft 365 Admin Center → **Migration** → **Data Migration** 2. Select **Google Workspace** as source 3. Create service account in Google Admin Console with domain-wide delegation 4. Upload service account key file to Microsoft migration tool 5. Select what to migrate: Email, Contacts, Calendars 6. Choose date range filter (optional — migrate only last N months to save time) ### Execution 1. Add users to migrate (CSV upload for bulk: `source_email,destination_email`) 2. Start migration — Microsoft handles delta sync automatically 3. Monitor progress in Admin Center → shows per-user status 4. Migration runs in background — users can keep using Gmail during this phase ### CSV Format ```csv source_email,destination_email [REDACTED_SECRET],[REDACTED_SECRET] [REDACTED_SECRET],[REDACTED_SECRET] ``` See `references/csv-template.md` for full template with notes. ## Method 2: Google Takeout + Outlook Import Best for individual users or when bulk migration fails. ### Export from Google 1. Go to Google Takeout: https://takeout.google.com 2. Select **Mail**, **Contacts**, **Calendar** 3. Choose MBOX format for mail (compatible with Outlook) 4. Download archive when ready (can take hours/days for large mailboxes) ### Import to Outlook 1. **Email**: Outlook Desktop → File → Open & Export → Import/Export → Import from MBOX 2. **Contacts**: Import Google CSV to Outlook contacts 3. **Calendar**: Export Google Calendar as ICS, import to Outlook Calendar **Limitations**: Manual per-user process, requires desktop Outlook, size limits. ## Method 3: IMAP Bridge (Manual / Small Scale) For personal Gmail accounts or when other methods fail: 1. Enable IMAP in Gmail: Settings → Forwarding and POP/IMAP → Enable IMAP 2. Create app password for Gmail account 3. In Outlook desktop, add Gmail as IMAP account using app password 4. Set up Microsoft 365 account in same Outlook profile 5. Drag-and-drop folders from Gmail IMAP to Microsoft 365 mailbox ## Data Mapping Considerations | Gmail Feature | Outlook Equivalent | Notes | |---------------|-------------------|-------| | Labels | Folders | Multiple labels become copies in folders | | Google Groups | Distribution Lists | May need manual recreation | | Google Drive links | OneDrive links | Links break — migrate files separately | | Gmail filters | Outlook rules | Manual recreation required | | Hangouts/Chat history | Teams | Not directly migratable | ## DNS / MX Cutover After migration data is transferred: 1. **Verify domain** in Microsoft 365 Admin Center (TXT record) 2. **Update MX records** to Microsoft: ``` Priority Host 0 company-com.mail.protection.outlook.com ``` 3. **Set SPF**: `v=spf1 include:spf.protection.outlook.com ~all` 4. **Set DKIM**: Admin Center → Defender → Email authentication → Enable DKIM 5. **Set DMARC**: `v=DMARC1; p=none; rua=mailto:[REDACTED_SECRET]` (start with `p=none`) 6. **Autodiscover CNAME**: `autodiscover.outlook.com` 7. **TTL**: Lower TTL to 300 before cutover, restore to 3600 after 48h See `references/dns-records.md` for copy-paste DNS templates. ## Post-Migration Validation Run these checks for every user: - [ ] Email receiving on Outlook (send test from external) - [ ] Historical emails present (spot-check oldest + newest) - [ ] Folders mapped correctly (labels→folders) - [ ] Contacts imported (check count vs Google) - [ ] Calendar events present (check recurring events specifically) - [ ] Google Groups recreated as Distribution Lists - [ ] Signatures set up in Outlook - [ ] Mobile devices re-configured (Outlook app or Exchange) - [ ] Gmail IMAP disabled or account removed See `references/validation-checklist.md` for printable per-user checklist. ## Common Issues | Issue | Fix | |-------|-----| | Migration stuck at connecting | Re-check Google service account permissions | | Labels become nested folders | Expected — Google labels flatten to Outlook folders | | Calendar recurring events broken | Complex recurrences may need manual recreation | | Contacts missing phone numbers | Google exports differently — check import mapping | | Large attachments missing | Items >150MB not migrated — export separately | | Google Groups not migrating | Create Distribution Lists manually in Exchange Admin | | Drive file links broken | Migrate files to OneDrive, update links manually | | MX propagation slow | Check TTL, use `dig MX domain.com` to verify | ## Deliverables Template For client-facing migration projects, prepare: 1. **Migration Plan** — Timeline, phases, user batches, rollback plan 2. **User Communication** — Email template announcing the switch 3. **Admin Runbook** — Step-by-step for the migration operator 4. **Validation Report** — Per-user sign-off checklist See `references/client-templates.md` for ready-to-use templates.

path: references/client-templates.md
content: # Client Templates — Gmail to Outlook Migration

## Migration Plan Template

### Project: Gmail to Microsoft 365 Migration
**Client:** _________________ **Start Date:** __________ **IT Contact:** _____________

#### Phase 1: Preparation (Week 1)
- [ ] Complete pre-migration inventory
- [ ] Set up Microsoft 365 licenses for all users
- [ ] Create migration CSV with user mappings
- [ ] Configure service account for bulk migration
- [ ] Schedule communication to users

#### Phase 2: Pilot Migration (Week 2)
- [ ] Migrate 5-10 test users
- [ ] Validate data integrity and functionality
- [ ] Gather feedback from pilot users
- [ ] Refine migration process based on results
- [ ] Document any issues and resolutions

#### Phase 3: Phased Rollout (Weeks 3-4)
- [ ] Batch 1: Management/IT team (20% of users)
- [ ] Batch 2: Department leads (30% of users)
- [ ] Batch 3: General users (remaining 50%)
- [ ] 48-hour gap between batches for issue resolution

#### Phase 4: DNS Cutover (Week 4 end)
- [ ] Update MX records to Microsoft 365
- [ ] Monitor mail flow for 24 hours
- [ ] Disable Gmail IMAP access
- [ ] Complete final user validations

#### Rollback Plan
If critical issues arise:
1. Revert MX records to Google Workspace
2. Re-enable Gmail IMAP access
3. Communicate delay to users
4. Address issues before retry

## User Announcement Email

**Subject: Important: Email Migration to Microsoft 365 - Action Required**

Dear Team,

We are migrating our email system from Gmail/Google Workspace to Microsoft 365 (Outlook) to better align with our business needs and improve collaboration capabilities.

### What's Happening
- **Migration Date:** [DATE]
- **Downtime:** Minimal (15-30 minutes during MX cutover)
- **Your Action Required:** Set up new Outlook account

### What's Changing
- **Email Address:** Stays the same ([REDACTED_SECRET])
- **New Login:** Use your Microsoft 365 credentials
- **New Apps:** Microsoft Outlook (instead of Gmail)
- **Calendar/Contacts:** Will migrate automatically

### Before Migration Day
1. **Back up important emails** if desired (Google Takeout)
2. **Note important calendar events** for the next 30 days
3. **Update mobile devices** with new Outlook app after migration

### After Migration Day
1. **Log in to outlook.office.com** with your new credentials
2. **Install Outlook app** on mobile devices
3. **Verify your data** migrated correctly
4. **Contact IT** if you have any issues

### New Features You'll Enjoy
- **Better integration** with Office 365 tools (Word, Excel, Teams)
- **Enhanced security** and compliance features
- **Improved mobile experience** with Outlook app
- **Shared calendars** and collaboration tools

### Support
- **Help Desk:** [CONTACT INFO]
- **Migration Support:** Available [DATES/TIMES]
- **Quick Setup Guide:** [LINK TO GUIDE]

Your historical emails, contacts, and calendar will be migrated automatically. We expect the migration to be seamless, but please report any issues immediately.

Thank you for your cooperation during this transition.

Best regards,
IT Team

## Migration Report Template

### Gmail to Microsoft 365 Migration Report
**Date:** __________ **Technician:** _____________ **Client:** _____________

#### Migration Summary
- **Total Users:** _____ **Successful:** _____ **Failed:** _____ **Retry Required:** _____
- **Total Data Migrated:** _____ GB **Largest Mailbox:** _____ GB
- **Migration Duration:** _____ hours **DNS Cutover Time:** _____

#### User Status
| User | Status | Email Count | Issues | Resolution |
|------|--------|-------------|---------|-----------|
| [REDACTED_SECRET] | Complete | 5,247 | None | - |
| [REDACTED_SECRET] | Complete | 3,891 | Calendar sync | Fixed manually |
| [REDACTED_SECRET] | Failed | - | Permission error | Retry scheduled |

#### Technical Details
- **Migration Method:** Microsoft Data Migration Service
- **Service Account:** [REDACTED_SECRET]
- **Migration Batch ID:** [BATCH_ID]
- **DNS Changes Applied:** [DATE/TIME]

#### Data Integrity Validation
- [ ] Email counts verified for sample users
- [ ] Calendar events spot-checked
- [ ] Contacts migrated completely
- [ ] Folder structure preserved
- [ ] Search functionality tested

#### Issues Encountered
1. **Google Drive links in emails** — Links remain functional, no action needed
2. **Complex calendar recurrence** — 3 users require manual calendar recreation
3. **Large attachments** — 12 emails with 25MB+ attachments need separate migration

#### User Feedback
- **Positive:** Users appreciate unified Microsoft ecosystem
- **Concerns:** Learning curve for Outlook interface
- **Requests:** Training session on advanced Outlook features

#### Post-Migration Actions
- [ ] Schedule user training session for [DATE]
- [ ] Monitor mail flow for 48 hours
- [ ] Follow up with users experiencing issues
- [ ] Complete final validations by [DATE]
- [ ] Document lessons learned

#### Client Sign-off
**Migration completed successfully:** ☐ Yes ☐ No

**Client signature:** ________________________ **Date:** ___________

**IT signature:** __________________________ **Date:** ___________

## Quick Setup Guide Template

### Microsoft 365 Outlook Setup Guide

#### Desktop Setup (Windows/Mac)
1. **Download Outlook** from office.com
2. **Add account** → Choose Microsoft 365
3. **Enter credentials** provided by IT
4. **Wait for sync** (may take 1-2 hours for large mailboxes)

#### Mobile Setup (iOS/Android)
1. **Install Microsoft Outlook** from app store
2. **Tap "Get Started"**
3. **Enter work email** ([REDACTED_SECRET])
4. **Enter password** provided by IT
5. **Allow notifications** when prompted

#### Web Access
- **URL:** outlook.office.com
- **Login:** Use your Microsoft 365 credentials
- **Bookmark** for easy access

#### Frequently Asked Questions

**Q: Where are my old emails?**
A: All migrated to your new Outlook mailbox. Check the "Archive" folder for older items.

**Q: My calendar is empty?**
A: Calendar sync may take 2-4 hours. Contact IT if still missing after 24 hours.

**Q: Can I still access Gmail?**
A: Yes, for 30 days during transition period. After that, Gmail will be read-only.

**Q: How do I set up my signature?**
A: Outlook → Settings → Signature. IT can help transfer your old signature.

**Need Help?** Contact IT: [PHONE] | [EMAIL] | [TICKET SYSTEM]

path: references/csv-template.md
content: # CSV Template — Bulk User Migration

## Microsoft Data Migration Service Format

```csv
source_email,destination_email
[REDACTED_SECRET],[REDACTED_SECRET]
[REDACTED_SECRET],[REDACTED_SECRET]
[REDACTED_SECRET],[REDACTED_SECRET]
```

## Extended Format (with additional mapping)

```csv
source_email,destination_email,source_display_name,migration_start_date
[REDACTED_SECRET],[REDACTED_SECRET],"John Smith",2024-03-01
[REDACTED_SECRET],[REDACTED_SECRET],"Jane Doe",2024-03-01
[REDACTED_SECRET],[REDACTED_SECRET],"IT Admin",2024-03-02
```

## Notes

- **Headers required**: First row must contain column names exactly as shown
- **Email format**: Use primary email addresses, not aliases
- **Destination**: Can be existing Microsoft 365 users or will create new ones
- **Case sensitive**: Email addresses should match exactly as they appear in admin consoles
- **Special characters**: Avoid spaces in email addresses
- **Encoding**: Save as UTF-8 CSV to handle international characters

## Batch Migration Strategy

For large organizations (100+ users), split into batches:

### Batch 1: Test Group (Week 1)
```csv
source_email,destination_email,batch
[REDACTED_SECRET],[REDACTED_SECRET],pilot
[REDACTED_SECRET],[REDACTED_SECRET],pilot
```

### Batch 2: Early Adopters (Week 2)
```csv
source_email,destination_email,batch
[REDACTED_SECRET],[REDACTED_SECRET],early
[REDACTED_SECRET],[REDACTED_SECRET],early
```

### Batch 3: General Users (Week 3+)
```csv
source_email,destination_email,batch
[REDACTED_SECRET],[REDACTED_SECRET],general
[REDACTED_SECRET],[REDACTED_SECRET],general
```

## Pre-Migration User Preparation

Before adding users to migration CSV:

1. **Verify Google Workspace licenses** — Active users only
2. **Check Microsoft 365 licenses** — Assign Exchange Online license
3. **Validate email addresses** — No typos or inactive accounts
4. **Note special cases** — Shared mailboxes, service accounts, former employees
5. **Estimate data size** — Plan for large mailboxes (10GB+)

## Common Pitfalls

- **Mixed domains**: Don't mix @company.com and @company.onmicrosoft.com in same batch
- **Inactive users**: Remove terminated employees from CSV
- **Alias confusion**: Use primary email address, not aliases
- **Permission issues**: Ensure destination accounts exist with proper licenses
- **Time zones**: Consider business hours when scheduling migration batches

path: references/dns-records.md
content: # DNS Records — Microsoft 365

Copy-paste templates for MX cutover from Google to Microsoft.

## MX Records

Remove ALL existing MX records, then add:

| Type | Host | Value | Priority | TTL |
|------|------|-------|----------|-----|
| MX | @ | [tenant-name].mail.protection.outlook.com | 0 | 3600 |

Replace `[tenant-name]` with your Microsoft 365 tenant name (e.g., `company-com` for company.com).

## SPF Record

```
Type: TXT
Host: @
Value: v=spf1 include:spf.protection.outlook.com ~all
TTL: 3600
```

If client also sends from other services (HubSpot, Mailchimp, etc.), combine:
```
v=spf1 include:spf.protection.outlook.com include:mail.hubspot.net include:servers.mcsv.net ~all
```

## DKIM Record

Enabled in Microsoft 365 Defender → Email & Collaboration → Policies & Rules → Threat policies → Email Authentication Settings → DKIM.

Two CNAME records will be generated:
```
Type: CNAME
Host: selector1._domainkey
Value: selector1-[tenant-guid]._domainkey.[tenant-name].onmicrosoft.com
TTL: 3600

Type: CNAME
Host: selector2._domainkey
Value: selector2-[tenant-guid]._domainkey.[tenant-name].onmicrosoft.com
TTL: 3600
```

## DMARC Record

Start permissive, tighten over 2-4 weeks:

```
# Phase 1: Monitor only
Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[REDACTED_SECRET]

# Phase 2: Quarantine (after 2 weeks)
Value: v=DMARC1; p=quarantine; pct=25; rua=mailto:[REDACTED_SECRET]

# Phase 3: Reject (after 4 weeks)
Value: v=DMARC1; p=reject; rua=mailto:[REDACTED_SECRET]
```

## Autodiscover

Essential for Outlook client auto-configuration:
```
Type: CNAME
Host: autodiscover
Value: autodiscover.outlook.com
TTL: 3600
```

## Mobile Device Management (Optional)

If using Intune/MDM:
```
Type: CNAME
Host: enterpriseregistration
Value: enterpriseregistration.windows.net
TTL: 3600

Type: CNAME
Host: enterpriseenrollment
Value: enterpriseenrollment.manage.microsoft.com
TTL: 3600
```

## Verification Commands

```bash
# Check MX
dig MX domain.com +short

# Check SPF
dig TXT domain.com +short | grep spf

# Check DKIM selectors
dig CNAME selector1._domainkey.domain.com +short
dig CNAME selector2._domainkey.domain.com +short

# Check DMARC
dig TXT _dmarc.domain.com +short

# Check Autodiscover
dig CNAME autodiscover.domain.com +short

# Check propagation worldwide
# https://dnschecker.org
```

## Pre-Cutover Test

Before changing MX records, test mail flow:
```bash
# Send test email to:
# [user]@[tenant-name].mail.onmicrosoft.com
# If it reaches the user, Exchange Online is working
```

path: references/validation-checklist.md
content: # Post-Migration Validation Checklist

**User:** _________________ **Date:** __________ **Validator:** _____________

## Email Functionality

- [ ] **Test inbound email** — Send from external account, verify receipt in Outlook
- [ ] **Test outbound email** — Send from Outlook to external account, verify delivery
- [ ] **Historical email present** — Check oldest and newest emails migrated
- [ ] **Email count validation** — Spot-check folder counts vs. original Gmail
- [ ] **Search functionality** — Test searching for old emails
- [ ] **Attachments intact** — Open email with attachment, verify it downloads

## Folder/Label Structure

- [ ] **Inbox migrated** — All Gmail inbox items present
- [ ] **Sent items migrated** — Sent folder populated from Gmail
- [ ] **Custom labels → folders** — Gmail labels converted to Outlook folders
- [ ] **Nested folder structure** — Multi-level Gmail labels properly nested
- [ ] **Spam/Junk folder** — Junk email migrated if applicable
- [ ] **Archive functionality** — Archive behavior configured

## Contacts

- [ ] **Contact count** — Compare total contacts: Gmail vs. Outlook
- [ ] **Contact details** — Spot-check names, emails, phone numbers
- [ ] **Contact groups** — Gmail contact groups migrated as Outlook categories
- [ ] **Profile photos** — Contact photos migrated (where supported)
- [ ] **Special contacts** — Check VIP contacts are properly flagged

## Calendar

- [ ] **Event count** — Compare calendar entries: Google vs. Outlook
- [ ] **Recurring events** — Weekly/monthly meetings working correctly
- [ ] **Meeting invitations** — Can send/receive calendar invites
- [ ] **Shared calendars** — Access to shared/team calendars
- [ ] **Time zones** — Events display in correct local time
- [ ] **Reminders** — Pop-up and email reminders functioning

## Client Configuration

### Desktop Outlook
- [ ] **Account added** — Microsoft 365 account configured
- [ ] **Sync working** — Email/calendar/contacts syncing
- [ ] **Signature** — Email signature configured
- [ ] **Rules** — Critical Outlook rules recreated from Gmail filters
- [ ] **Archive settings** — Auto-archive configured as needed

### Mobile Device (iOS/Android)
- [ ] **Outlook app installed** — Microsoft Outlook app
- [ ] **Account configured** — Signed in with Microsoft 365 account
- [ ] **Push notifications** — Email notifications working
- [ ] **Calendar sync** — Calendar events showing in phone's calendar app
- [ ] **Contacts sync** — Contacts accessible from phone's contacts app

### Web Access
- [ ] **Outlook Web Access** — Can log in to outlook.office.com
- [ ] **All features working** — Email, calendar, contacts accessible online
- [ ] **Browser compatibility** — Works in user's preferred browser

## Security & Compliance

- [ ] **Two-factor authentication** — MFA enabled for Microsoft 365 account
- [ ] **App passwords** — Any IMAP clients updated with new credentials
- [ ] **Gmail access** — Gmail account secured or access removed as per policy
- [ ] **Shared mailbox access** — Permissions to shared mailboxes verified
- [ ] **Distribution lists** — Membership in relevant distribution lists

## User Training & Acceptance

- [ ] **Basic training** — User trained on Outlook interface differences
- [ ] **Key shortcuts** — Common keyboard shortcuts demonstrated
- [ ] **Mobile setup** — User can access email on mobile device
- [ ] **User satisfaction** — User comfortable with migration results
- [ ] **Support contact** — User knows who to contact for issues

## Common Issue Checks

- [ ] **No duplicate emails** — Check for mail loops or duplicated items
- [ ] **Drive links working** — Google Drive links in emails still accessible
- [ ] **External sharing** — Shared documents/calendars still accessible
- [ ] **Forwarding rules** — Any Gmail forwarding rules disabled/recreated
- [ ] **Alias functionality** — Email aliases working in Microsoft 365

## Final Sign-off

**Issues found:** ___________________________________________________

________________________________________________________________

**Resolution:** ____________________________________________________

________________________________________________________________

**User sign-off:** I confirm my email migration is complete and working satisfactorily.

**User signature:** ________________________ **Date:** ___________

**IT sign-off:** Migration validated and complete.

**IT signature:** __________________________ **Date:** ___________

---

**Notes:**
- Keep original Gmail account active for 30 days post-migration
- Schedule follow-up check in 1 week for any delayed issues
- Document any custom configurations for future reference

path: scripts/pre-migration-audit.sh
content: #!/usr/bin/env bash
# Pre-migration audit — Check DNS, MX, SPF, DKIM, DMARC for Microsoft 365 readiness
# Usage: pre-migration-audit.sh <domain>

set -euo pipefail

DOMAIN="${1:?Usage: pre-migration-audit.sh <domain>}"

echo "=========================================="
echo "Pre-Migration DNS Audit: $DOMAIN"
echo "Microsoft 365 Readiness Check"
echo "=========================================="
echo ""

echo "--- Current MX Records ---"
dig MX "$DOMAIN" +short 2>/dev/null || echo "(dig not available, try: nslookup -type=MX $DOMAIN)"
echo ""

echo "--- Current SPF ---"
dig TXT "$DOMAIN" +short 2>/dev/null | grep -i "spf" || echo "No SPF record found"
echo ""

echo "--- Current DMARC ---"
dig TXT "_dmarc.$DOMAIN" +short 2>/dev/null || echo "No DMARC record found"
echo ""

echo "--- Current DKIM (checking Microsoft selectors) ---"
for sel in selector1 selector2; do
  result=$(dig CNAME "${sel}._domainkey.$DOMAIN" +short 2>/dev/null)
  if [ -n "$result" ]; then
    echo "  $sel._domainkey: $result"
  else
    echo "  $sel._domainkey: Not configured"
  fi
done
echo ""

echo "--- Autodiscover ---"
dig CNAME "autodiscover.$DOMAIN" +short 2>/dev/null || echo "No autodiscover CNAME"
echo ""

echo "--- Microsoft 365 Tenant Check ---"
# Extract potential tenant name from domain
TENANT_GUESS=$(echo "$DOMAIN" | sed 's/\./-/g')
echo "Checking potential tenant: $TENANT_GUESS.mail.protection.outlook.com"
dig A "$TENANT_GUESS.mail.protection.outlook.com" +short 2>/dev/null || echo "Tenant MX not resolvable (normal if not configured yet)"
echo ""

echo "--- Assessment ---"
MX=$(dig MX "$DOMAIN" +short 2>/dev/null)
if echo "$MX" | grep -qi "outlook\|microsoft\|protection.outlook"; then
  echo "✅ MX already points to Microsoft 365"
elif echo "$MX" | grep -qi "google\|gmail\|aspmx"; then
  echo "⚠️  MX points to Google — migration source confirmed"
else
  echo "ℹ️  MX points to: $(echo "$MX" | head -1 | awk '{print $2}')"
fi

SPF=$(dig TXT "$DOMAIN" +short 2>/dev/null | grep -i "spf" || true)
if echo "$SPF" | grep -qi "protection.outlook.com"; then
  echo "✅ SPF includes Microsoft 365"
elif echo "$SPF" | grep -qi "google"; then
  echo "⚠️  SPF includes Google — will need update during cutover"
else
  echo "ℹ️  Current SPF: $SPF"
fi

AUTODISCOVER=$(dig CNAME "autodiscover.$DOMAIN" +short 2>/dev/null)
if echo "$AUTODISCOVER" | grep -qi "outlook.com"; then
  echo "✅ Autodiscover points to Microsoft"
elif echo "$AUTODISCOVER" | grep -qi "google"; then
  echo "⚠️  Autodiscover points to Google — needs update"
else
  echo "ℹ️  Autodiscover: $AUTODISCOVER"
fi

echo ""
echo "--- Microsoft 365 Readiness Checklist ---"
echo "Before migration:"
echo "  [ ] Verify Microsoft 365 tenant and domain ownership"
echo "  [ ] Assign Exchange Online licenses to all users"
echo "  [ ] Create service account for Google Workspace API access"
echo "  [ ] Test mail flow to [user]@$TENANT_GUESS.mail.onmicrosoft.com"
echo ""
echo "DNS changes needed during cutover:"
echo "  [ ] Update MX: $TENANT_GUESS.mail.protection.outlook.com"
echo "  [ ] Update SPF: v=spf1 include:spf.protection.outlook.com ~all"
echo "  [ ] Update Autodiscover: autodiscover.outlook.com"
echo "  [ ] Configure DKIM in Microsoft 365 Defender"
echo ""
echo "Done. Review output and plan DNS changes accordingly."

Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (HIGH)