Monitor upstream domains with Trusted Sender Score

Trusted Sender Score helps Australian teams monitor the domains of your upstream email delivery partners and spot spoofing exposure before fraudulent messages reach customers. Its free tools check domain reputation, DKIM and DMARC, while bulk checks and an API support repeatable workflows. Early warning is the goal; a single score cannot prove intent.

Begin with an owned inventory of the domains and sending subdomains each supplier may use. Record the service, purpose and technical owner, then combine platform findings with email headers, provider updates and support contacts. You gain usable evidence when chasing up a sender without adding friction to legitimate campaigns.

Understand what belongs in scope

Upstream delivery partners can include bulk senders, transactional platforms, CRMs, payment systems and outsourced marketing teams. Some send under your branded domain; others use a vendor domain in the visible From address. Monitor identity domains and shared sending infrastructure separately, because compromised credentials and weak DNS controls require different responses.

This matters in Australia, where businesses often combine Google Workspace or Microsoft 365 with specialist campaign tools. A Sydney booking team may use a transactional provider while a Melbourne marketing team uses another platform. Assign an internal owner and supplier contact to every relationship so warnings reach the right person.

Build a useful domain register

Create a register listing each domain, supplier, purpose, business owner, technical owner and support channel. Include priority sending subdomains, not every tracking domain encountered. Note whether your organisation receives a unique subdomain or shares a provider pool. For Australian businesses, remember that .com.au and .au both exist; confirm ownership through contracts or registry records, not the prefix alone.

Record the DKIM selector and DMARC location, but never store private keys or mailbox credentials in the register. Use consistent labels—healthy, investigate, critical or inactive—so operations teams can chase up exceptions while maintaining an audit trail. Mark a domain inactive when its service ends.

Check reputation and infrastructure

Check each material domain and priority subdomain for reputation signals and spoofing exposure. Compare results with bounce rates, complaints and the partner’s delivery reports. Treat a warning as an investigative signal, not proof of malicious activity. Confirm anomalies through internal telemetry and supplier confirmation before suspending a service that might send customer-critical messages.

Investigate unusual hostnames instead of trusting the logo in an email signature. The platform's reverse MX lookup guide explains how to identify mail infrastructure associated with a domain and where the evidence has limits. Shared hosting can make one server look suspicious for reasons unrelated to your sender, so timestamp findings and review them with the partner.

Verify the authentication chain

Confirm that the partner signs with DKIM linked to an authorised domain and publishes a DMARC policy that covers it. SPF or DKIM should align with the visible From address. Ask for the current selector, signing host and policy outcome, then compare them with public DNS. If a partner sends as your brand, you still own the visible identity even when it operates the mail servers.

Record failed alignment, absent signatures and permissive policies as distinct findings: valid DKIM that fails DMARC alignment is not the same as an unsigned message. Use guidance from the Australian Signals Directorate’s ACSC to benchmark anti-spoofing controls. Authentication can still pass when a legitimate account is abused, so retain credential and sender-verification checks.

Automate continuous domain checks

Bulk domain checking creates a repeatable view once the inventory is stable. Set frequency by criticality: transactional domains may need frequent checks, while low-risk newsletters can follow the business cycle. Preserve dates, scores and DNS observations, and record scheduled sends in Google Calendar or Outlook so unusual tests can be matched with a known campaign.

For larger fleets, the API can submit approved domains, retrieve results and send exceptions to a case-management or security workflow. The platform's guide to automated incident response shows how spoofed-email findings can be handled quickly. Protect API credentials, apply request limits and define human review thresholds so automation cannot silently disable a revenue-critical sender.

Respond when trust changes

When an alert fires, preserve the message and full headers before acting. Compare visible From, Return-Path, Received hops and Authentication-Results with the inventory, then check for a new reputation or DNS change. Ask the partner for incident details and affected infrastructure. If abuse is likely, block at the gateway, revoke exposed credentials and route legitimate traffic through a verified service where possible.

Use local escalation channels alongside internal response. If an Australian organisation has lost money or exposed personal information, follow ACSC and ReportCyber guidance and assess regulatory notification duties under the Privacy Act 1988. For teams spanning Sydney, Melbourne and Brisbane, page across Australian Eastern Standard Time and Australian Eastern Daylight Time, but keep one incident owner and a UTC timeline to avoid confusion.

Maintain governance and readiness

Review the register monthly and after every material supplier change, including a new sending domain, DNS migration, acquisition or contract end. Require advance notice and pre-launch authentication checks. Remove inactive domains promptly because an old trusted subdomain can become an attacker’s target. Keep evidence with the organisation’s risk records under its normal retention policy.

Run a quarterly exercise using a simulated impersonation attempt against one partner. Confirm who can pause campaigns, approve an emergency block and contact the provider after hours. Australian teams often say it is time to “chase up the provider now” rather than wait for another meeting. Include domain-transfer contacts, contractual notice periods and service credits in the plan before a pressured incident occurs.