SPF · DKIM · DMARC · Microsoft 365
Email security and DMARC setup
Lock down your email domain so nobody can impersonate you, protect clients from fake invoices, and get your legitimate email back into the inbox.
Do I need DMARC for my business email?
Yes, if your organisation sends email. DMARC, together with SPF and DKIM, lets receiving mail servers reject messages that falsely claim to come from your domain, which stops much of the invoice fraud and phishing sent in your name. Google, Yahoo and Microsoft now expect it from bulk senders. To protect you, DMARC must progress from p=none to quarantine or reject.
Why email domain security matters
If your domain does not have SPF, DKIM and an enforced DMARC policy, anyone can send email that looks like it came from you. Criminals use that to send fake invoices to your clients, change bank details and trick your own staff.
The same gaps are why legitimate email quietly disappears into spam. Fix the authentication and you protect your clients, your reputation and your deliverability at the same time.
Red flags
- No DMARC record, or DMARC stuck at p=none
- Clients asking whether an invoice really came from you
- Emails landing in spam or vanishing without a bounce
- Mailboxes without multi-factor authentication
- Unknown forwarding rules in staff mailboxes
// How we fix it
How we set it up
- 01
Discover
Find every service that sends as your domain: Microsoft 365 or Google, your website, CRM, newsletters, invoicing and more.
- 02
Authenticate
Publish correct SPF, enable DKIM for each sender and add a DMARC record with reporting.
- 03
Monitor
Read DMARC reports to catch forgotten senders and spoofing attempts.
- 04
Enforce
Move DMARC to quarantine and then reject, so spoofed email is blocked.
- 05
Harden the mailbox
MFA, forwarding rule checks, anti-phishing policies and staff awareness on payment redirection.
// Services
Email and domain security services
SPF, DKIM and DMARC setup
Correct records for every legitimate sender, staged safely to an enforced policy.
DMARC monitoring
Ongoing review of DMARC reports so new senders and spoofing attempts are caught early.
Microsoft 365 and Google hardening
MFA, admin roles, forwarding rules, legacy authentication and anti-phishing policies.
Payment fraud awareness
Short training on verifying bank detail changes and spotting impersonation.
// FAQ
Common questions
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature proving a message was not altered. DMARC tells receiving servers what to do with messages that fail those checks, and sends you reports showing who is sending as you.
Is DMARC p=none enough?
No. A policy of none only monitors; it does not stop anyone spoofing your domain. The goal is to move to quarantine and then reject once every legitimate sender is properly authenticated.
Why are our emails suddenly going to spam?
Usually because SPF, DKIM or DMARC is missing or misconfigured, a new sending service was added without authentication, or your domain or server reputation has been damaged. Since 2024 Google and Yahoo have required authentication for bulk senders, and Microsoft has followed.
What is business email compromise?
It is when criminals take over or impersonate a real mailbox, then use it to redirect payments, change bank details on invoices or request sensitive data. It is one of the most costly scams for Australian businesses.
Can you secure Microsoft 365 or Google Workspace?
Yes. We review MFA, admin roles, mailbox forwarding rules, external sharing, anti-phishing settings and legacy authentication, and work with your IT provider on changes.
// Keep going
Related services
Website Security & Maintenance
Website security and maintenance plans for Perth businesses: hardening, daily monitoring, tested updates and off-server backups for WordPress, Joomla and more.
Cyber Incident Response
Cyber incident or data breach? We help Perth organisations contain, investigate, recover and meet OAIC and ASD reporting obligations. Call 1300 566 652.
Cyber Security Consulting
Independent cyber security consulting in Perth: risk assessments, Essential Eight, Privacy Act, incident readiness and board reporting. From $1,500.
// Next step
Talk to us about Email Security & DMARC
Tell us what you run and what you are worried about. We will come back within one business day and, if it helps, send you a fixed-price quote.
- No-obligation first consult
- Fixed scope and price before work starts
- A clear written report and next steps
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
