Email Authentication Setup: SPF, DKIM and DMARC for Perth Businesses
That sinking feeling hits when a client forwards you an email that looks like it came from your business — except you never sent it. A Perth accounting firm discovered this the hard way when their domain was being spoofed to send fake invoices demanding payment to overseas bank accounts. Their clients were getting convincing emails that passed basic email checks, complete with the firm's branding and realistic invoice formatting.
The problem? Missing email authentication. Most Perth businesses have SPF, DKIM, and DMARC either completely wrong or not configured at all. Without proper email authentication setup, your domain becomes a sitting duck for spoofing attacks that damage your reputation and potentially cost your customers money.
What SPF, DKIM and DMARC Actually Do
Think of email authentication as a three-layer security system for your domain. Each layer catches different types of fraud attempts.
SPF (Sender Policy Framework) tells the world which servers are allowed to send email from your domain. It's like having a guest list at the front door — if an email claims to be from your business but comes from a server not on your list, receiving email systems know something's fishy.
DKIM (DomainKeys Identified Mail) adds a digital signature to your outgoing emails. The receiving server checks this signature against a public key published in your DNS records. If the signature doesn't match, the email's been tampered with or forged.
DMARC (Domain-based Message Authentication) is the bouncer that decides what happens when SPF or DKIM checks fail. It can quarantine suspicious emails, reject them outright, or just monitor and report back to you about authentication failures.
You need all three working together. SPF without DMARC is like having a guest list but no bouncer to enforce it. DKIM without SPF protection leaves gaps that scammers exploit. Running just one or two of these creates a false sense of security while leaving your domain vulnerable to spoofing.
Setting Up SPF Records Step by Step
SPF configuration starts in your DNS management panel. For most Perth businesses using shared hosting, this means logging into cPanel or your hosting provider's control panel and finding the DNS Zone Editor.
Your SPF record is a TXT record that lists which mail servers can send email from your domain. For Microsoft 365 users, your SPF record should look like this:
v=spf1 include:spf.protection.outlook.com -all
The -all part is crucial — it tells receiving servers to reject emails that don't match your approved senders. Some guides suggest ~all (soft fail) but that's too permissive for business use.
If you're using both Microsoft 365 and your hosting provider's email, you'll need to include both:
v=spf1 include:spf.protection.outlook.com include:yourhostingprovider.com.au -all
Replace yourhostingprovider.com.au with your actual hosting provider's SPF include statement. Check their documentation or ask support for the correct syntax.
Common mistake: multiple SPF records. You can only have one SPF record per domain. If you need multiple mail services, combine them into a single record with multiple include statements.
Testing Your SPF Setup
Once published, SPF records can take up to 24 hours to propagate. Test your configuration using online SPF checkers or the command line:
nslookup -type=TXT yourdomain.com.au
Look for your SPF record in the results. If it's not there after a few hours, double-check your DNS settings.
DKIM Configuration Walkthrough
DKIM setup varies depending on your email provider, but the process follows the same pattern: generate a key pair, publish the public key in DNS, and configure your mail server to sign outgoing emails with the private key.
Microsoft 365 DKIM Setup
In the Microsoft 365 admin center, navigate to Email & collaboration > Exchange > Protection > DKIM. Select your domain and click "Create DKIM keys." Microsoft generates two CNAME records that you need to add to your DNS:
selector1._domainkey.yourdomain.com.auselector2._domainkey.yourdomain.com.au
Copy these records exactly as shown and add them as CNAME records in your DNS management panel. The values will point to Microsoft's DKIM infrastructure.
After adding the DNS records, return to the DKIM page in Microsoft 365 admin and enable DKIM signing for your domain. The status should change to "Enabled" within a few hours.
cPanel DKIM Configuration
Many Perth businesses using shared hosting can enable DKIM directly in cPanel. Look for "Email Authentication" or "Email Deliverability" in the Mail section. Enable DKIM for your domain and cPanel automatically creates the necessary DNS records.
If your hosting provider doesn't support automatic DKIM, you'll need to generate keys manually and create the DNS records yourself. This is more complex and worth getting proper IT support to handle correctly.
DMARC Policy Setup and Monitoring
DMARC ties SPF and DKIM together with a policy that tells receiving servers what to do with emails that fail authentication checks. Start with monitoring mode to understand your email traffic before enforcing restrictions.
Your initial DMARC record should look like this:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.au; ruf=mailto:dmarc@yourdomain.com.au; fo=1
This policy (p=none) monitors authentication failures without blocking emails. The rua and ruf tags specify where to send aggregate and forensic reports about DMARC failures.
Add this as a TXT record for _dmarc.yourdomain.com.au in your DNS settings.
Moving from Monitoring to Enforcement
After running in monitoring mode for at least a week, review the DMARC reports to identify legitimate email sources that might be failing authentication. Fix any SPF or DKIM issues for your legitimate senders.
Once you're confident all legitimate email passes authentication, upgrade your DMARC policy to quarantine (p=quarantine) and eventually reject (p=reject) for maximum protection.
Common Setup Mistakes to Avoid
Perth businesses make the same email authentication errors repeatedly. Here's what to watch out for:
Too many SPF lookups: SPF has a 10 DNS lookup limit. Including too many third-party services breaks SPF validation. Consolidate includes or use SPF flattening if needed.
Missing subdomain protection: Scammers often spoof subdomains like mail.yourdomain.com.au. Add SPF records for common subdomains or use DMARC subdomain policy.
Ignoring DMARC reports: Those XML reports contain valuable intelligence about email spoofing attempts against your domain. Set up proper parsing or use a DMARC monitoring service.
Weak DMARC policies: Staying in monitoring mode forever provides zero protection. Move to enforcement once you've sorted legitimate senders.
Email authentication isn't optional anymore. Perth businesses without proper SPF, DKIM and DMARC setup are gambling with their reputation and their customers' security. Get this sorted properly, monitor the reports, and stop giving scammers a free pass to impersonate your business.
