A Yearly Email Authentication Review That Matches Today's Threat Landscape

Email remains the soft underbelly of most Australian organisations, from suburban accounting practices in Parramatta to remote cattle stations in the Pilbara. A yearly review of your email authentication records is not a box-ticking exercise; it is the foundation of a credible defence against the spoofing and phishing attempts that now target every sector. This article walks through the practical steps of auditing SPF, DKIM and DMARC, then updating them for the threats that have emerged over the past twelve months.

The threat picture has shifted noticeably. Scammers increasingly register lookalike domains just days before launching them, and business email compromise attempts have grown more polished, often mimicking the tone and timing of genuine local suppliers. For Australian senders, the Australian Cyber Security Centre regularly publishes advisories reminding entities that email remains the primary vector for initial access. Treating your SPF, DKIM and DMARC records as living documents, rather than set-and-forget configurations, is the first move towards keeping your domain off growing blocklists.

What follows is a structured walkthrough designed for security leads, IT managers and small business owners who want a sensible annual cadence. Each section gives you a concrete action, the questions to ask, and the small habits that make next year's review far easier.

Auditing Your SPF record

Begin with the Sender Policy Framework record, the simplest of the three and the one most likely to have drifted out of date. Pull your current TXT record and check the included mechanisms: the ip4, include, mx and redirect entries. The classic mistake is to keep adding new sending sources without auditing the old ones, so a hosted marketing platform from three years ago might still have permission to send as you.

A useful prompt is to ask whether every listed source is still in active use. In Australia, many organisations rely on a mix of local transactional providers, global CRMs and Australian-based marketing platforms. If your CRM switched providers mid-year, the old include statement should be retired. The SPF specification caps you at ten DNS lookups, and exceeding that will cause some receivers to reject your mail outright, even though the record itself looks valid on paper.

Finally, retire the softfail (~all) or neutral (?all) default and move to a hardfail (-all) once you are confident that every legitimate sending source is captured. Hardfail tells receivers to reject anything that does not match, which is exactly what stops a scammer in Sydney or Perth from forging your domain for a fake invoice run.

Checking DKIM signing and rotation

DomainKeys Identified Mail gives each outbound message a cryptographic signature, but a signature is only as trustworthy as the key behind it. Pull up your DKIM records for each sending service and check the public key length. Anything shorter than 2048-bit RSA is now considered weak, and most security frameworks recommend planning a move to 2048-bit or longer.

Key rotation is the next habit to build. Many Australian IT teams leave the same DKIM key in place for years, which means a compromise of that single key can be used to forge convincing messages for the lifetime of the record. A yearly rotation cycle, ideally aligned with your annual review, limits the blast radius if a key is ever leaked through a misconfigured cloud bucket or a former staff member's laptop.

Do not forget to check the selector naming. Predictable selectors such as selector1 or k1 tell an attacker exactly where to look. Renaming selectors on rotation, perhaps to something tied to the financial year like fy25-q3, gives a small but useful layer of obscurity, particularly against targeted spear-phishing campaigns aimed at local firms.

Tightening Your DMARC policy

A DMARC record is where your authentication strategy becomes a real-world instruction to receivers. The three policy options are none, quarantine and reject, and the right choice depends on how thoroughly you have validated your SPF and DKIM coverage. Start by reviewing twelve months of aggregate reports, which most receivers now make available through free postmasters' tools or paid reporting platforms.

For Australian organisations subject to the Notifiable Data Breaches scheme, a strong DMARC policy is more than a technical preference. Demonstrating that your domain rejects unauthenticated mail can form part of the evidence you provide when assessing whether a breach is likely to cause serious harm. A reject policy at p=reject signals that no email pretending to be you should ever land in an inbox.

Watch for subtle misconfigurations, particularly in organisations that send from multiple subdomains. A subdomain policy of sp=reject applies that rule across every subdomain, which is usually what you want, but it can hide sloppy records on legacy systems. A useful habit is to send a test message from a long-forgotten test environment, just to see whether the signature still passes and the SPF still resolves.

Watching for newly registered domain threats

The phishing landscape has tilted heavily towards domains registered in the previous forty-eight hours. A handy newly registered domain checklist can keep your team sharp when something unusual lands in an inbox. Many Australian scams now mimic logistics providers, energy retailers and even myGov-style government branding, all from fresh domains that will not appear on traditional blocklists.

Yearly authentication work is the right time to subscribe to alerts from your registrar and from trusted feeds that flag freshly registered domains matching your brand or sector. Reviewing the data each quarter, even informally, builds a habit that catches fraudulent sign-ups before they are weaponised against local customers.

It is also worth revisiting your subdomain strategy. Attackers love to register variations such as accounts-, billing- or support- as prefixes to a known brand, then send from mail servers that your legitimate authentication would not cover. Listing your authorised subdomains and checking that each has its own SPF and DKIM configuration closes that avenue without blocking legitimate operational email.

Updating anti-spoofing measures beyond the big three

SPF, DKIM and DMARC are the foundation, but they are not the whole house. Modern anti-spoofing protection practice now extends to BIMI for brand display in supported inboxes, MTA-STS for opportunistic TLS, and TLS-RPT for visibility into delivery failures caused by certificate issues. Each of these records deserves a place in your yearly review, particularly if your organisation has moved workloads between cloud regions over the past twelve months.

BIMI adoption, supported by verified mark certificates, gives Australian brands a visible trust signal in Gmail and Apple Mail, and it only works when DMARC is at quarantine or reject. Walking through the prerequisites during the yearly review is a useful checkpoint, particularly for brands that rely on visual recognition with retail and consumer audiences.

As you wrap up the cycle, document every change in a short report that can be shared with executives, insurers and, if relevant, the Office of the Australian Information Commissioner. A clean yearly record shows due diligence, helps with cyber insurance renewals, and gives the next reviewer a head start.