How to protect against business email compromise with DMARC and DKIM

Business email compromise (BEC) remains a serious risk for Australian organisations. Attackers impersonate executives, suppliers, payroll teams and customers to redirect payments, obtain sensitive data or persuade staff to bypass normal approval procedures. A convincing message can cause significant damage before a traditional email filter recognises anything suspicious.

DMARC and DKIM provide a technical foundation for reducing email impersonation. DKIM adds a verifiable digital signature to outgoing messages, while DMARC tells receiving mail systems what to do when a message fails authentication. Used with SPF, these controls make it harder for criminals to send convincing messages from a company’s domain.

Authentication is only one part of a wider BEC defence strategy. Organisations also need strong payment procedures, employee awareness, domain monitoring, incident response and visibility across Microsoft 365 or Google Workspace. This layered approach is particularly important for businesses operating across Sydney, Melbourne, Brisbane and other Australian commercial centres.

Why business email compromise succeeds

BEC attacks often rely on trust rather than malware. A criminal may register a lookalike domain, compromise a genuine mailbox or copy the writing style of a finance manager. The request may arrive during a busy period, such as the end of the financial year, a major project deadline or a supplier payment cycle.

Email security gateways may block obvious spam, but they cannot always identify a legitimate account that has been taken over. DMARC can prevent unauthorised senders from impersonating your domain, yet it cannot independently stop an attacker who has gained access to a real employee account. Identity protection, multifactor authentication and mailbox monitoring must therefore operate alongside domain authentication.

How DKIM verifies outgoing messages

DomainKeys Identified Mail, or DKIM, attaches a cryptographic signature to selected parts of an email. The receiving server checks that signature against a public key published in the sender’s DNS records. If the message was altered or sent by an unauthorised system, the verification can fail.

Businesses should create separate DKIM keys for approved platforms such as Microsoft 365, Google Workspace, CRM systems, marketing tools and payment platforms. Keys need secure management and periodic rotation. A careful inventory is essential because forgotten services can continue sending email on behalf of a domain without being covered by the organisation’s security controls.

How DMARC turns authentication into policy

DMARC checks whether a message passes SPF or DKIM and whether the authenticated domain aligns with the visible “From” address. This alignment is valuable because an attacker may otherwise pass a basic SPF check using a different domain while still appearing to represent the business.

A sensible rollout begins with p=none, allowing security teams to review aggregate and forensic reports without rejecting messages. Once legitimate senders are identified and corrected, the organisation can move towards p=quarantine and then p=reject. Reports should be sent to a monitored mailbox or analysis platform rather than ignored, since they reveal unauthorised senders, misconfigured vendors and possible spoofing attempts.

Connect email controls to business processes

Technology should reinforce financial controls. Australian companies commonly deal with suppliers, contractors and customers across multiple states, and invoice fraud can exploit time zones, urgent payment requests or unfamiliar banking details. Any change to a supplier’s account should be independently verified using a trusted telephone number or an established procurement record.

Staff should be trained to challenge unusual requests for gift cards, payroll amendments, confidential files or urgent transfers. Clear escalation routes help employees report suspicious messages without fear of blame. Organisations can also review device use controls so personal activity, unmanaged applications and risky forwarding rules do not weaken the wider email security model.

Monitor domains, mailboxes and identity activity

BEC prevention requires continuous monitoring. Security teams should review DMARC reports, newly registered lookalike domains, unusual forwarding rules, impossible travel alerts, mass mailbox searches and unexpected OAuth application consent. These signals may expose account takeover even when the attacker sends messages through a legitimate account.

Australian organisations should align the programme with the Australian Signals Directorate’s Essential Eight and relevant privacy obligations under the Privacy Act. Financial institutions may also need to consider APRA expectations, while healthcare providers should protect sensitive patient information and maintain reliable incident records. A documented response plan should define how to suspend accounts, revoke sessions, preserve evidence, contact banks and notify affected parties.

Practical controls for a resilient email programme

A managed security service can combine email authentication, identity telemetry, threat intelligence and 24/7 alert handling. Independent vulnerability assessment and penetration testing can further identify weak authentication settings, exposed administration interfaces and unsafe integrations. Regular testing is especially useful after mergers, domain changes or the adoption of new cloud platforms.

Prioritise these actions:

• Catalogue every service authorised to send email for each company domain.
• Publish SPF, enable DKIM and review DMARC reports before enforcing rejection.
• Require multifactor authentication and disable legacy sign-in protocols.
• Apply dual approval and out-of-band verification to payment or bank-detail changes.
• Monitor lookalike domains, mailbox rules, forwarding activity and suspicious logins.
• Train finance, executive support, procurement and payroll teams with realistic simulations.

A mature control set should be tested rather than treated as a one-time configuration. Security teams can measure how quickly suspicious messages are reported, how many unauthorised senders appear in DMARC data and whether staff follow verification procedures under pressure.

Infoziant Security helps organisations assess email, cloud, network and identity risks through tailored security reviews, SIEM monitoring, threat intelligence and penetration testing. Request a VAPT assessment or discuss a trial engagement to identify authentication gaps and strengthen protection against business email compromise.