Email authentication

Email authentication is the rare control that fails silently. A domain can be sending mail that quietly lands in spam, or be open to anyone forging mail in its name, with nothing bouncing and nobody told. The records meant to prevent it, SPF, DKIM and DMARC, are usually present and usually not enforcing, which reads as protection and is not.

It is also the one part of your posture that can be checked from the outside, before any engagement, using only your public DNS. That is the same information an attacker reads to decide whether a domain is worth forging.

It runs across whole sectors. In a June 2026 scan, 59 percent of 252 Australian law firms were open to a forged settlement email.

A read of your public records in plain English: what is published, what it actually does, and whether your domain can currently be forged. It tells you what is wrong and why. It does not tell you how to fix it, because knowing what correct looks like and verifying it afterwards is the work.

If you would rather have it handled than pass the findings to your own IT provider, the fix is a fixed AUD 650 + GST. One engagement, no retainer, scheduled and verified, with you keeping control of your systems throughout. The price covers the expertise and the verification, not the keystrokes.

The read is yours to keep either way. If you would like it handled, the contact details are below.