For most small businesses, email is how quotes go out, invoices come back, and purchase orders get approved. It is also how many cyber attacks start. As major providers such as Google and Microsoft tighten their requirements for email authentication, small organisations that ignore DMARC, SPF and DKIM are increasingly exposed to both security risk and deliverability issues.
Managed email authentication platforms (for example Sendmarc and similar services) exist to solve this in a structured, low-friction way. This article explains, in practical terms, why small businesses should be using one of these services, either directly or via their managed service provider (MSP).
For many small organisations, almost everything important passes through email:
The same channel is heavily abused by attackers. Phishing and business email compromise (BEC) campaigns routinely impersonate legitimate domains to send fake invoices, payment redirections or credential-harvesting links. When an attacker can easily send mail that appears to come from @yourbusiness.com.au, it is much easier for staff, customers and suppliers to be tricked.
At the same time, major providers such as Google and Microsoft now expect senders to authenticate their email correctly. Their public guidelines state that domains which lack proper SPF, DKIM and (for higher-volume senders) DMARC are more likely to see messages rejected or routed to spam. Over time, this directly affects cashflow when quotes, invoices and approvals no longer reach the inbox reliably.
The practical takeaway is simple: if you do not actively manage SPF, DKIM and DMARC, you are more likely to be both impersonated by attackers and penalised by mail providers.
Before deciding whether to use a managed service, it helps to understand what these mechanisms actually do.
SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When a receiving server gets a message from @yourbusiness.com.au, it checks the SPF record to see if the sending server is authorised. If it is not on the list, that message is more likely to be rejected or treated as suspicious.
DKIM adds a digital signature to your outgoing email. The public key is stored in DNS, and receiving servers use it to verify that the message has not been tampered with and genuinely comes from an authorised source. When DKIM is configured correctly, messages from your domain are much harder to forge convincingly.
DMARC ties SPF and DKIM together and adds policy and reporting. It lets you tell receiving servers what to do if a message claiming to be from your domain fails authentication:
p=none – only monitor and reportp=quarantine – treat failures as suspicious (often sent to spam)p=reject – block failures outrightDMARC also generates detailed reports that show who is sending mail using your domain, which systems pass or fail, and where abuse is coming from. These reports are the main way to see whether your policies are working as intended.
While it is technically possible to configure all of this by hand, doing so across multiple services and domains, and then interpreting raw DMARC XML reports, is rarely practical for a small business.
Attackers deliberately target small organisations because they often combine three characteristics:
Common scenarios include:
If your domain is not protected by properly enforced SPF, DKIM and DMARC, it is much easier for attackers to send email that appears to come from you. In many cases, the first time you hear about it is when a customer calls to ask why you sent them a suspicious message or when a supplier chases an unpaid invoice you have already “paid” to an attacker.
On paper, implementing SPF, DKIM and DMARC is just a matter of publishing a few DNS TXT records. In reality, the ongoing management is where most small businesses struggle.
Typical pain points include:
For a small internal team or business owner, this becomes an ongoing technical burden. For MSPs, building an internal DMARC analytics and reporting platform is often not cost-effective when specialist solutions already exist.
Managed email authentication platforms are built specifically to handle the complexity described above. While each vendor has its own strengths, most of them provide a core set of capabilities that directly address the pain points.
Instead of dealing with raw XML reports, you see dashboards that summarise:
DMARC is most effective when your policy is set to quarantine or reject unauthenticated messages. That change can be risky if you are not confident your legitimate senders are configured correctly. Managed platforms typically guide you through a staged approach:
p=none to collect data without impacting delivery.quarantine and then reject.This reduces the risk of accidentally blocking your own invoices or marketing campaigns.
Many platforms offer SPF “flattening” or equivalent capabilities. They maintain a clean, provider-managed SPF record for you, keeping it under technical limits and adjusting automatically when underlying services change their published records. This avoids brittle, manually edited SPF entries that silently fail over time.
Small businesses often have multiple domains (for example a .com and a .com.au), and Managed Service Providers may manage dozens or hundreds of domains for their clients. Managed DMARC platforms are designed for this reality. They provide multi-domain dashboards, consistent policy templates and alerting when a new domain starts to be used for email.
Modern services integrate with Microsoft 365, Google Workspace and common marketing and transactional email platforms. This allows them to:
The result is a more robust configuration with less manual effort and a lower risk of human error.
Security is only one side of the story. The other is deliverability: whether your legitimate messages reach the inbox rather than the junk folder.
Both Google and Microsoft have made it clear that properly authenticated email is more likely to be accepted and placed in the inbox. Over time, domains that consistently fail SPF, DKIM or DMARC checks can accumulate a poor reputation. That reputation applies across the board, not only to bulk mail. Even simple one-to-one messages such as quotes and purchase orders can be affected.
Managed platforms improve deliverability by helping you close authentication gaps quickly, monitor trends in pass and fail rates, and keep your configuration aligned with current best practice. The net effect is that your legitimate mail is more likely to be seen and acted upon.
When your domain is abused in a phishing or fraud campaign, the impact is not limited to the immediate incident. Customers and partners remember that the fraudulent message appeared to come from you. Repeated incidents damage trust, and in some cases can influence whether organisations are comfortable continuing to do business with you.
There is also a growing expectation from insurers, auditors and enterprise customers that basic security controls are in place. While SPF, DKIM and DMARC are not formal legal requirements for small businesses, they are increasingly considered part of reasonable technical due diligence. Having a managed authentication service in place makes it easier to demonstrate that you are taking email security seriously.
For a typical small organisation using Microsoft 365 or Google Workspace, a sensible end-state looks like this:
For many small businesses, this level of maturity is only realistic when a managed DMARC/SPF/DKIM service is in place, usually supported by an MSP.
There are several reputable managed DMARC, SPF and DKIM providers internationally, including platforms such as EasyDMARC, Sendmarc, PowerDMARC and others. While features vary, the evaluation criteria for a small business are relatively consistent.
Key points to consider:
In practice, many small organisations will rely on their MSP to select and manage the platform. The important part is that a structured, monitored service is in place, rather than a one-off DNS change that is never revisited.
When presenting this to owners or directors, the case for a managed DMARC/SPF/DKIM service can be summarised as follows.
Email remains the primary channel through which money and instructions move in and out of small businesses. Attackers know this, and so do the major email providers. SPF, DKIM and DMARC have shifted from “nice to have” technical extras to basic security hygiene.
For most small organisations, the most reliable way to reach and maintain that standard is to adopt a managed DMARC/SPF/DKIM service, either directly or through an MSP like Milnsbridge Managed IT Services. It turns a complex mix of DNS records and raw logs into a controlled, visible and auditable safeguard for your brand, your customers and your cashflow.
Aussie small and medium businesses face a turbulent cyber climate. Recent forecasts show organisations are…
Why does Cyber Resilience for Australian SMEs matter? A small business breach happens every 11…
A Sydney business can now lose a week of productivity because a single staff member…
Discover how Anthropic is disrupting AI espionage with innovative safeguards, empowering safer AI development. Learn…
Discover how IT infrastructure upgrades can boost your Sydney business’s efficiency, security, and growth.
Discover what happens now that Windows 10 support has ended and learn essential steps to…