I help Sydney businesses review and improve the email systems they use for invoices, client files and everyday work. The scope includes Microsoft 365 or Google Workspace, the accounts that administer them and the DNS records that tell other mail systems who can send for your domain.
You might have missing DMARC, an SPF record nobody wants to touch, inconsistent MFA or forwarding that nobody can explain. An email security review brings those issues together so changes to one part of the setup do not leave another overlooked.
Request an email security review
What an email security review covers
Email security crosses several administrative boundaries. A former supplier may control the registrar while staff use Microsoft 365 and the website sends enquiries through a separate host. I establish who owns each part and what access is needed before making changes.
The agreed scope can include:
- Identity and recovery: MFA, privileged accounts, password reset paths and former staff or supplier access.
- Mail platform and mailboxes: forwarding, inbox rules, delegation, aliases and shared mailbox permissions, alongside available security settings.
- Domain authentication: SPF, DKIM and DMARC, including the services sending invoices, campaigns, website notifications or booking reminders.
- Business processes: who approves access and how changes to supplier payment details are verified.
This suits small businesses and professional services teams whose email configuration has grown alongside the business. Findings are prioritised around the systems you actually use.
SPF, DKIM and DMARC review and implementation
SPF authorises sending infrastructure for the envelope sender domain. DKIM adds a signature that receivers can validate against the signing domain's public key. DMARC checks whether a passing SPF or DKIM result aligns with the visible From domain, and publishes a requested handling policy for messages that fail. A valid, aligned pass from either method can satisfy DMARC.
Adding a DNS record is only part of implementation. I identify legitimate senders, check SPF records and lookup limits, verify DKIM signing and test alignment using actual messages. A CRM can pass SPF for its provider's domain without aligning with the business address customers see.
DMARC reporting helps show where legitimate senders still need attention. Policy changes should follow that evidence, with checks for occasional senders and relevant subdomains before moving towards quarantine or reject. Starting with p=none allows monitoring but does not ask receivers to block failing mail. Receiver handling can vary, and authentication does not guarantee inbox placement.
The SPF, DKIM and DMARC guide explains the records and common configuration problems. For enforcement planning, see the existing DMARC policy rollout guide and Google's recommended rollout.
Microsoft 365 email security
A Microsoft 365 review can cover administrator protection, MFA and account access alongside Exchange Online forwarding, inbox rules, delegation and shared mailboxes. I also check custom-domain authentication, mail routing and recovery arrangements within the agreed scope.
Security settings need to be reviewed against the tenant's licences. Exchange Online includes baseline mail protection; Defender for Office 365 adds capabilities such as impersonation protection and Safe Links. These are not assumed to be present in every subscription. Microsoft describes the protection layers and licensing here.
The practical work is to identify which controls are available, review relevant anti-phishing settings and agree changes that fit the business. Where identity policies need more work, MFA implementation covers registration, enforcement and recovery planning.
Google Workspace email security
For Google Workspace, the review can include administrator access, 2-Step Verification, account recovery, Gmail forwarding and delegation, and group or alias arrangements that affect who receives business mail. Former-user access and supplier responsibilities also need checking.
SPF and DKIM must account for the custom domain and third-party sending services, not just Gmail. Available security settings and investigation tools depend on the Workspace edition and administrator permissions. I establish those limits when agreeing the review, then document the configuration and any work that needs a different tool or licence.
Business email compromise and payment changes
Consider an Australian small business receiving an email asking it to pay a supplier's next invoice into a new bank account. The message might come from a compromised supplier mailbox, directly spoof the supplier's domain or use a similar-looking domain. Those situations require different technical responses.
SPF, DKIM and DMARC help with direct domain spoofing. MFA reduces account takeover risk. Neither eliminates business email compromise: a message sent from an attacker-controlled session in a legitimate mailbox may still pass authentication.
Payment changes therefore need independent verification, such as calling the supplier using a previously verified number rather than details in the new email. This is part of ASD's advice on protecting against business email compromise. A configuration review can identify weaknesses, but it cannot promise to prevent invoice fraud.
How the engagement works
- Confirm the domains, mail platforms and legitimate sending services in scope, along with authorised access.
- Review authentication, administrator privileges and recovery ownership.
- Check SPF, DKIM and DMARC against actual mail flows.
- Review agreed mailbox and platform security settings, checking unusual rules with the business.
- Explain priority findings and agree the changes, testing and any licensing requirements.
- Implement and test the agreed work, staging mail authentication policy changes as needed.
- Provide a written configuration record, remaining risks and responsibilities for follow-up.
DMARC reporting needs someone to review it after setup. The scope should state the review period and who will handle reports and future sender changes. Signs of active compromise may require a separate response scope; removing one forwarding rule is not evidence that an incident is resolved.
Request an email security review
DNS ownership and practical experience
My technical work spans cybersecurity, networking, DNS, hosting and web platforms. That matters when website forms, mail accounts and domain administration depend on one another. The experience section gives the professional background behind this service.
I check registrar access, DNS ownership and recovery paths because a well-configured mailbox still depends on the accounts that control its domain. Changes and ownership should be documented so the business can maintain the setup when staff or suppliers change.
I am based in Sydney, with onsite work available in the CBD and surrounding areas where useful. Reviews can also be practical remotely with appropriate access. Related work includes small-business cyber security reviews and private-client and executive home-office support.
Frequently asked questions
What does an email security consultant check?
The agreed review can cover domains, legitimate sending services, email authentication, MFA, administrators, mailbox access and recovery. I explain the priority issues and document agreed changes and remaining risks.
Can you review Microsoft 365 email security?
Yes. The scope can include administrator access, MFA, forwarding, delegation, shared mailboxes, domain authentication and available anti-phishing settings. Advanced protection features depend on your licences; they are not assumed to be included in every tenant.
Can you set up SPF, DKIM and DMARC?
Yes, subject to access and provider support. I identify legitimate senders, check authentication and alignment, configure reporting and plan policy changes after legitimate mail flows have been tested.
Does DMARC stop phishing or invoice fraud?
No. It helps receiving systems identify unauthorised use of your domain, but does not stop mail from a compromised legitimate account or a lookalike domain. MFA, mailbox controls and independent verification of payment changes remain important.
Can you help if our emails are being spoofed?
I can review your domain authentication and available message headers to distinguish direct domain spoofing from other impersonation. The next steps depend on what the evidence shows; DNS changes alone will not fix a compromised mailbox or a lookalike domain.
Can you check suspicious forwarding rules?
Yes, within an agreed scope and with authorised access. Forwarding and delegation can have legitimate uses, so findings need checking with the business. If there are signs of compromise, the work may need to extend beyond configuration review to containment and specialist investigation.
Do you provide onsite email security support in Sydney?
Yes, where appropriate for the scope. Much of a configuration review can also be completed remotely with authorised access. Onsite work can help when staff need guidance or account and domain ownership needs untangling.
Request an email security review
Tell me your email platform, the domains involved and what needs attention. If you use other systems to send invoices, campaigns or website messages, include those too so we can agree a useful scope.