SPF and DKIM passes do not clear suspicious URLs

Why a domain that passes both SPF and DKIM but has a suspicious URL pattern needs scrutiny comes down to a crucial distinction: SPF and DKIM validate authorised sending infrastructure, not the safety of every URL in the message. A perfect authentication result is therefore evidence about the envelope and signature, not a guarantee that a link is genuine.

In Australia, that distinction matters because many organisations use .com.au or .au addresses and conduct business through emailed invoices, delivery notices and account updates. A Sydney bookkeeper, Melbourne online retailer or Brisbane supplier could all receive an authentic-looking message whose button leads to an unrelated destination. Domain trust should be judged separately from link trust.

Authentication answers a different question

SPF checks whether the sending server is authorised to represent the envelope domain. It does not test the visible From address on its own, and it never opens a hyperlink. Passing SPF means the infrastructure check succeeded for the domain used in the relevant SPF evaluation.

DKIM checks a cryptographic signature, usually linked to a signing domain through the d= tag. It helps detect message alteration but says nothing about whether the destination domain has a reputation for phishing or credential theft. Even a passing DMARC alignment check does not inspect the URL. An attacker operating a hijacked mailbox or authorised sending service can still generate valid SPF and DKIM results.

Suspicious destinations hide in plain sight

The useful warning signs are structural. Look for a display address that differs from the actual target, a registrable domain buried beneath unrelated subdomains, a lookalike domain, encoded characters, an IP address, an unusual port, a URL shortener or a deceptive redirect. In a .com.au example, accounts.mycompany.com.au may be legitimate, while mycompany.com.au.payment-check.net is not controlled by the same organisation.

Do not treat every unusual string as proof of fraud. A trusted URL can also be compromised. The stronger case for caution comes from a combination of signals: urgency, a changed bank account, a request for credentials or one-time codes, and a destination that does not belong to the organisation named in the email.

Inspect links before acting

On a desktop, hover over a link to preview its target and identify the registrable domain rather than relying on the label. On a phone, long-press the link or use the browser’s link preview. Expand shortened URLs before deciding. If the message concerns mygov, Medicare, the Australian Taxation Office, Australia Post or a bank, open the official app or enter the known address yourself instead of following the message link.

If a link was opened, close the page and verify the destination through a trusted channel. If credentials, card details or a one-time code were entered, change the password, revoke active sessions, enable multi-factor authentication and contact the relevant institution promptly. Treat a possible account takeover as a security incident, not merely a suspicious click.

Bulk checks expose provider-wide risk

Domain-level checks are most useful before staff or customers encounter a risky sender. The free Trusted Sender Score platform reviews SPF, DKIM, DMARC and reputation signals, while its bulk trust checking guide explains how to assess an entire email-provider list in one workflow. That helps teams identify a newly suspicious provider instead of checking each sender in isolation.

Bulk results still need context. A provider can have a good domain score but a compromised account, or an imperfect configuration that leaves customers exposed. Domain owners should monitor authentication records, alert on unexpected sending sources and combine reputation findings with internal reports about suspicious content. APIs can carry the same verification into ticketing, procurement and customer-support systems.

Turn DMARC evidence into action

DMARC reports add another layer because they expose failed authentication and unexpected sending sources. Its DMARC failure analysis guide explains how to trace those failures, separate configuration errors from compromise and prioritise remediation without hiding useful evidence.

For Australian organisations, a suspected phishing incident can be reported to the Australian Cyber Security Centre through ReportCyber, with Scamwatch providing consumer guidance. Banks and payment providers should be contacted quickly when funds are at risk. If personal information may have been exposed, assess the organisation’s obligations under the Australian Privacy Act and notify affected people and the Office of the Australian Information Commissioner where required.