Email Authentication for Australian SMEs: A Practical SPF, DKIM and DMARC Checklist

Email spoofing is a business risk, not only an email administrator issue. A criminal can make a message appear to come from your domain and use it to request a payment change, collect a password or damage trust with customers and suppliers.

What SPF, DKIM and DMARC do

SPF publishes which services are allowed to send email for your domain. DKIM adds a digital signature to outgoing messages. DMARC checks whether the visible sender aligns with those protections and tells receiving systems what to do when a message fails. Together, they make spoofing harder and give you better visibility of unauthorised sending.

Start with an accurate sender inventory

List every platform that sends mail for the domain, including Microsoft 365 or Google Workspace, your website, CRM, accounting software, newsletters, booking tools and support systems. Remove old services and confirm who owns each DNS record. An incomplete SPF record or an unconfigured DKIM service can cause legitimate messages to fail.

Use DMARC as a staged control

1. Publish a DMARC record in monitoring mode and nominate a mailbox or reporting service.
2. Review reports to find unknown senders and configuration mistakes.
3. Correct legitimate services and remove unnecessary permissions.
4. Move carefully towards quarantine or reject when the evidence is clean.

Connect email controls to business processes

Technical controls do not replace staff verification. Keep a separate approval process for bank-detail changes and urgent payment requests. Verify through a known phone number, not a number supplied in the suspicious message. Train staff to report unusual requests without fear of blame.

Questions to ask this week

Which systems send email for our domain? Who can change DNS? Are SPF, DKIM and DMARC monitored? Do our website, CRM and marketing tools still need sending access? Can finance staff verify payment changes outside email?

Sources

• Cyber.gov.au: How to combat fake emails
• Cyber.gov.au: Malicious email mitigation strategies
• business.gov.au: Create a cyber security policy