Guides

How to vet an unexpected invoice domain safely
An unexpected invoice attached to an email deserves careful scrutiny, even when the message appears to come from a familiar supplier. Payment redirection…
What a 512-Bit DKIM Key Says About Sender Security
A DKIM key length of 512 bits reveals that a sender is relying on an outdated level of cryptographic protection. DomainKeys Identified Mail (DKIM) adds a…
Build a daily digest of brand-matching domains
A newly registered domain can imitate a familiar Australian brand before its owner sends a message. It may use a plausible business name, a misleading…
Valid DMARC and No Alignment Still Leave Impersonation Risk
DMARC is often mistaken for a guarantee that an email genuinely came from the named organisation. In reality, it is a shared rule for authenticating domain use…
How to Detect Punycode Lookalike Domains Bypassing Visual Inspection
Lookalike domains have become one of the quietest threats in email security. Attackers register domains that visually mimic a trusted brand, then use them in…
What SPF Hard Fail Reveals About Email Infrastructure
An SPF record with a permanent hard fail can reveal far more than whether a message passed a single authentication check. The -all mechanism tells receiving…
Use an API to Flag Overnight SPF Changes
SPF tells recipients which hosts may send for a domain. Attackers can imitate senders while studying visible policies, and an unauthorised change can weaken…
Why DMARC Alignment Alone Is Not Proof of Legitimacy
Email authentication helps establish whether a message was authorised by the domain in its From header. It does not establish that the sender is trustworthy,…
What a sudden drop in domain trust score means for inbox placement
A sudden fall in a domain’s trust score is an early warning that mailbox providers may be less confident about messages sent from that domain. It does not…
Reading Email Headers to Spot Return-Path and From Mismatches
Phishing campaigns targeting Australians have become more sophisticated, with scammers frequently impersonating the Australian Taxation Office, myGov, and…