Your domain is one of your most valuable assets, and by default anyone can forge it. Without the right DNS records, a criminal can send an email that appears to come from your accounts team, your director, or your billing address, and the recipient’s inbox will show it as genuine. Spoofed invoices and impersonated executives are among the most common ways Australian small businesses lose money, and the fix is mostly configuration rather than spend.
This is part of the identity and security work we do. If you want your domain locked down properly, talk to us about cybersecurity and identity.
The three records, in plain terms
Email authentication rests on three DNS records that work together. None is sufficient alone.
SPF
Sender Policy Framework lists the servers allowed to send mail for your domain. A receiving server checks whether the message came from an approved source. The classic mistake is exceeding the ten-lookup limit by stacking too many providers, which silently breaks the record.
DKIM
DomainKeys Identified Mail adds a cryptographic signature to every message, proving it was authorised by your domain and was not altered in transit. In Microsoft 365 you enable DKIM signing per domain and publish two keys in DNS.
DMARC
DMARC ties the first two together. It tells receiving servers what to do when a message fails both checks, and it asks them to send you reports. This is the record that actually stops spoofing, because SPF and DKIM without DMARC are advisory only.
Why this is no longer optional
The major inbox providers now treat authentication as a baseline. Bulk senders without a valid DMARC record increasingly land in spam or are rejected outright, and that standard is steadily reaching smaller senders too. If your marketing email or even your ordinary business mail is quietly going to junk, weak authentication is a likely cause. Getting this right improves deliverability as much as it improves security.
The safe path to enforcement
The danger is turning on strict enforcement before your legitimate mail is fully aligned, which blocks your own newsletters, booking systems, and accounting tools. Move in stages.
- Publish DMARC at
p=none. This changes nothing for recipients but starts the reports flowing so you can see every service sending as you. - Read the reports for a few weeks. Identify each legitimate sender, from your CRM to your e-signature tool, and bring them into SPF and DKIM alignment.
- Move to
p=quarantine, thenp=reject. Once the reports are clean, tighten the policy so forged mail is quarantined and finally rejected.
Common mistakes
- Treating SPF as enough. It does not survive forwarding and does nothing on its own against display-name spoofing.
- Forgetting a sending service, so a real invoice run suddenly fails after enforcement.
- Setting and forgetting. New tools get added over time, so the records need occasional review, much like the housekeeping in a solid Microsoft 365 security baseline.
What to do this quarter
- Publish a DMARC record at
p=noneand start collecting reports for every domain you own, including ones you do not send from. - Use those reports to align every legitimate sender under SPF and DKIM.
- Once the reports are clean, move to
p=quarantineand thenp=rejectso nobody can forge your domain.
Email authentication is a low-cost, high-value control that protects your customers and your reputation at once, and it pairs naturally with phishing-resistant MFA. If you would like it configured and monitored against your tenant, book a consultation.