12 October 2026
Can someone send email pretending to be your business? SPF, DKIM and DMARC for Australian SMBs
Most Australian SMBs I talk to assume that if an email says it’s from their domain, it must have come from them. It doesn’t work that way. Email was built on trust, and anyone can type your domain into the From line of a message. Three DNS records, SPF, DKIM and DMARC, are how the receiving mail server tells your real mail from the fakes, and what it should do with the fakes.
Most Microsoft 365 tenants I look at have SPF. Fewer have DKIM switched on for their own domain. And DMARC is often missing, or sitting at “monitor only” years after someone set it up. I help SMBs fix that in plain English. Paths below match Microsoft Learn and vendor docs as of writing. Not legal advice.
Can someone send email pretending to be your business?
Yes. Without these records, a receiving server has no reliable way to know whether a message claiming to be from yourbusiness.com.au really came from you. With them, it can check, and DMARC lets you tell it to junk or reject anything that fails.
Scamwatch describes the pattern behind fake invoice scams: scammers either get into the real business’s email or impersonate its email address, copy the logo and ABN, and change only the bank details. SPF, DKIM and DMARC deal with the “impersonate the address” half. The other half is covered further down.
How much does email fraud cost Australian businesses?
From the original reports:
- ACSC Annual Cyber Threat Report 2024–25: more than 84,700 cybercrime reports through ReportCyber. The average self-reported cost of cybercrime per business report was $80,850 ($56,600 for small businesses, $97,200 medium, $202,700 large). The top self-reported cybercrimes for businesses were email compromise without financial loss (19%), business email compromise fraud with a financial loss (15%) and identity fraud (11%).
- Scamwatch: payment redirection scams, where someone changes the bank details on an invoice, were one of the top scam types by reported losses in 2024.
- Scamwatch: small businesses reported $13.1 million in scam losses in 2024, 24% lower than in 2023.
These are reported figures, and the costs are self-reported. The ACSC assesses that “the vast majority of cybercrime continues to go unreported”.
What’s the difference between SPF, DKIM and DMARC?
| Record | What it does | Plain English | What it doesn’t do |
|---|---|---|---|
| SPF | Lists the servers allowed to send mail for your domain | The guest list | It checks the hidden “envelope” sender, not the From address people see, and it breaks when mail is forwarded |
| DKIM | Adds a digital signature to each message | A tamper-evident seal | It doesn’t tell the receiver what to do if the seal is missing |
| DMARC | Checks the visible From domain lines up with SPF or DKIM, says what to do with failures (none, quarantine or reject), and sends you reports | The rule, plus the report card | It doesn’t stop lookalike domains or a real mailbox that’s been taken over |
One detail trips people up. SPF and DKIM can both pass and DMARC can still fail, because DMARC also needs one of them to align with the From address. Microsoft’s DMARC guide has a table of these alignment failures and how to fix each one.
How do I check my domain in 5 minutes?
| Minutes | Check | What you want to see |
|---|---|---|
| 0–1 | MXToolbox’s free SPF Record Check and DMARC Check tools (mxtoolbox.com). Enter your domain | One SPF record; a DMARC record that exists |
| 1–3 | Command line: run the three commands below | One v=spf1 record; a v=DMARC1 record; a DKIM CNAME (Microsoft 365) |
| 3–4 | Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab | Your own domain shows Enabled, not just the onmicrosoft.com one |
| 4–5 | Send a test email to a Gmail address. In Gmail, next to Reply, click More → Show original | In the headers, spf=pass, dkim=pass and dmarc=pass |
nslookup -type=txt yourdomain.com.au
nslookup -type=txt _dmarc.yourdomain.com.au
nslookup -type=cname selector1._domainkey.yourdomain.com.auIf DMARC is missing, or shows p=none and nobody reads the reports, you’re publishing a rule that asks receivers to do nothing.
Is DKIM turned on automatically in Microsoft 365?
Only for your *.onmicrosoft.com domain. Your own custom domain, the one on your business cards, needs two DKIM CNAME records (selector1._domainkey and selector2._domainkey) published in your DNS. Then you switch DKIM from Disabled to Enabled on the DKIM tab in the Defender portal.
Microsoft also notes that even if you only send from onmicrosoft.com, you still need to add the DMARC record for it yourself, in the Microsoft 365 admin center.
How do I set up SPF, DKIM and DMARC in Microsoft 365?
- SPF: one TXT record at the root of your domain. For most Microsoft 365-only businesses, Microsoft’s example is
v=spf1. Add aninclude:spf.protection.outlook.com -all include:for each other service that sends as your domain. - DKIM: publish the two CNAMEs the Defender portal gives you (copy them exactly), then toggle DKIM to Enabled on the DKIM tab.
- DMARC: a TXT record at
_dmarc.yourdomain.com.au, starting with something likev=DMARC1;. Send the reports to a dedicated mailbox, not someone’s inbox.p=none; pct=100; rua=mailto: dmarc-reports@yourdomain.com.au - Inbound protection: in Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-phishing, check that Honor DMARC record policy when the message is detected as spoof is on. Microsoft selects it by default when you create a policy and recommends it on. It’s worth confirming in your own tenant.
On Google Workspace instead? DKIM is in the Google Admin console under Apps → Google Workspace → Gmail → Authenticate email. Generate the record, publish it in DNS, then start authentication.
Will DMARC break my Xero, MYOB or Mailchimp emails?
Check each one before you tighten DMARC. What matters is whose domain is in the From address.
| Service | What its own docs say | What it means for your DMARC |
|---|---|---|
| Xero | Emails sent through Xero always come from messaging-service@post.xero.com, and that can’t be changed. You set the reply-to address and display name | Xero invoice emails aren’t sent as your domain, so your DMARC policy doesn’t apply to them |
| MYOB AccountRight | Emails sent directly from AccountRight come from an @apps.myob.com address, which can’t be changed. MYOB signs them with DKIM and protects the domain with SPF. Emails sent through Outlook come from your Outlook address | Direct AccountRight emails aren’t affected. If you send through Outlook, that’s your Microsoft 365 mail |
| Mailchimp | Domain authentication for your custom domain: two CNAME records for DKIM, plus a DMARC TXT record | Authenticate your domain in Mailchimp before you move to quarantine, or campaigns sent as your domain may be junked |
Then work through everything else that sends as your domain: website contact forms, your CRM, booking systems, and scanners or printers that email PDFs. Each one either goes in your SPF record, signs with DKIM on your domain, or moves to sending from its own domain.
What DMARC policy should a small business start with?
Start at p=none, read the reports, then tighten. That’s the order both Microsoft and the ACSC recommend.
| Stage | Record (example) | What happens to fakes | Move on when… |
|---|---|---|---|
| 1. Monitor | v=DMARC1; p=none; rua=mailto:… | Nothing. You just get reports | Reports show all your real senders passing. Microsoft only says “after enough time monitoring” and suggests reviewing reports weekly at first |
| 2. Quarantine | v=DMARC1; | Marked as spam or junked | No legitimate mail is landing in junk. You can start at a lower pct and work up to 100 |
| 3. Reject | v=DMARC1; p=reject; rua=mailto:… | Refused outright | Keep reading the reports. New senders appear over time |
| Parked domains | SPF v=spf1 -all • DMARC p=reject | Everything claiming to be from that domain is refused | Straight away, for domains you own but never send from |
Swap in your own domain and reporting address.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com.au
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourbusiness.com.au
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourbusiness.com.auThe ACSC’s ISM (control ISM-1540) sets the end state as DMARC configured so that email failing DMARC is rejected, including for subdomains. How long you spend at each stage depends on your reports. Microsoft doesn’t give a number, and I won’t make one up.
What are the most common SPF and DMARC mistakes?
- Two SPF records, often an old one from the web host plus a new one for Microsoft 365. Microsoft says multiple SPF records cause a permerror. Merge them into one.
- More than 10 DNS lookups in SPF after adding a few services. Each
include:costs at least one lookup, and nested includes cost more. Over 10 is a permanent fail. +allor?allin SPF. The ACSC says never use them: with+all, SPF never fails, so every email passes the DMARC check.- DKIM never enabled on the custom domain in Microsoft 365, because onmicrosoft.com was already signing.
- Jumping straight to
p=rejectbefore checking third-party senders. - Relying on SPF alone. Microsoft notes that forwarding breaks SPF alignment, and breaks DKIM too if the message body gets changed. A message passes DMARC if either SPF or DKIM aligns, so set up both.
What won’t DMARC stop?
- Lookalike domains. Microsoft notes that impersonation can pass SPF, DKIM and DMARC if the attacker registers a lookalike domain and publishes valid records for it. Your DMARC only protects your exact domain.
- Display-name tricks. A message can carry your name with a completely different email address behind it. Impersonation protection in Defender for Office 365 (in Business Premium) targets this. The baseline spoof settings available to every Microsoft 365 mailbox don’t.
- A real mailbox that’s been compromised. If the scammer is inside your actual mailbox (or your supplier’s), the mail passes all three checks, because it really is from that account. Scamwatch’s fake invoice alert describes exactly this. The defences are MFA on every mailbox, cleaning up old accounts and leftover guest access, and a firm rule that any change to bank details is confirmed by phone on a number you already have.
DMARC reporting also doesn’t stop malicious email sent to you. The ACSC says it gives you visibility of attempts to spoof your domain, which is the point.
Do Gmail’s sender rules apply to my small business?
Mostly not the bulk rules. From 1 February 2024, Google requires senders of more than 5,000 messages a day to Gmail accounts to have SPF, DKIM and DMARC set up, with the From domain aligned. Most SMBs send far less. But Google asks all senders to keep their spam rate below 0.3%, and newsletter platforms such as Mailchimp recommend authenticating your domain and setting up DMARC anyway. Doing this properly also helps your real invoices land in the inbox.
What should I do this week?
- One SPF record that includes Microsoft 365 and every real sender, ends in
-allor~all, and stays under 10 lookups - DKIM CNAMEs published and DKIM Enabled for each custom domain in Microsoft 365 (or Authenticate email in Google Workspace)
- Domain authentication set up in Mailchimp and any other platform that sends as you
- A
_dmarcrecord with a reporting address, and someone named to read the reports - A plan to move from none → quarantine → reject
- Parked domains locked down with
v=spf1 -alland DMARC reject - Honor DMARC record policy on in your anti-phishing policy
- MFA on every mailbox, and bank-detail changes confirmed by phone
When I do a Security Health Check for an Australian SMB, these three records are one of the first things I look up, because it takes a minute from the outside and it’s often the cheapest fix on the list. If you want a second pair of eyes on your domain, your Microsoft 365 setup or your wider security, without the big-firm theatre, see how I help with security and Microsoft 365, or get in touch.