Lock Down Your Inbox: The Australian SME Guide to Microsoft 365 Email Security

Why Your Inbox Needs More Than Microsoft 365 Defaults!

Email still carries your business. You use it to talk to clients, suppliers, staff and regulators every day. When a message lands in spam, or a scammer spoofs your domain, you feel it fast. You lose revenue. You lose trust. In serious cases, you face a reportable data breach.

Microsoft 365 gives you strong tools, but it does not switch them on for you. You must configure SPF, DKIM and DMARC yourself, then keep them tuned as your business changes. Skip this step and you leave two doors open: scams reaching your team, and legitimate mail bouncing or landing in spam.

This is a genuine technical process, not a five-minute checkbox. It takes knowledge, careful testing and ongoing monitoring. If that sounds like more than your team has time for, that is exactly why Microsolve's Email Reputation Management service exists. We handle the technical work so you get the protection without the learning curve - and, as you will see below, it costs a fraction of what a breach does.

The Benefits and Challenges of Email Authentication

Good email authentication stops criminals impersonating your domain in phishing and business email compromise scams. It lifts your delivery rate, so invoices and client updates land in the inbox, not the spam folder. It also strengthens your Microsoft 365 Secure Score.

The challenge is complexity, and it is real. Most organisations send mail from more places than they realise: Microsoft 365, marketing platforms, invoicing tools, printers and line-of-business apps. Each needs its own DKIM key and a place in your SPF record. Miss one and you either block legitimate mail or leave a gap attackers can exploit. This is why DIY email authentication so often goes wrong - the setup looks simple, but the ongoing tuning is a specialist job. If you have never touched a DMARC report, that is not a gap in your ability. It is a sign you need a partner who does this every day.

Take Control of Your Domains and DNS Records

Start with a clear domain inventory. List every domain you own, including old brands and regional variants, and decide which should send mail at all. Many businesses need only one or two active sending domains - retiring the rest shrinks your attack surface instantly.

For each active domain, build accurate SPF records listing only your genuine sending services, DKIM keys for every platform, and a DMARC record starting in monitoring mode (p=none). Microsoft's guidance on email authentication and our own breakdown of the minimum settings that block most spoofing attacks both cover the technical detail - and show why most owners hand this step to a specialist. One wrong SPF entry and legitimate email stops sending, often with no warning until a client says they never got your invoice.

Once your monitoring data looks clean, tighten DMARC towards quarantine, then reject, faster if you handle sensitive information or run services clients depend on daily. Tell marketing and HR before you tighten policy so new tools get authenticated first - coordination Microsolve manages for clients every week, so nothing breaks silently.

Harden Microsoft 365 Mail Flow and Retire Legacy Authentication

Authenticated domains only work if your mail flow matches them. Document every legitimate sender - Microsoft 365, relays, SaaS platforms, line-of-business apps -since forgotten "shadow senders" cause most deliverability headaches, and finding them all takes real detective work.

Require modern authentication everywhere you can. Microsoft has already removed Basic authentication across Exchange Online (details here), so older printers or apps needing SMTP AUTH should route through a hardened internal relay with IP allow-lists, rate limits and dedicated accounts, not open access.

None of this is a weekend project! It touches identity policy, network configuration and every application that sends mail on your behalf - which is why most internal IT teams call in specialist help here. Our approach toretiring legacy sign-in without disrupting frontline staff covers the transition, and pairs with our Identity and Access Management service. Assign clear ownership either way: smaller teams usually hand this to their managed IT partner outright, while larger ones split it across messaging, security and governance, and run it on a schedule, not only after an incident.

Measure, Monitor and Prove Your Email Security Works

Track a short list of metrics: the percentage of mail passing SPF, DKIM and DMARC alignment; messages quarantined or rejected under DMARC policy; unauthenticated sending sources in aggregate reports; and trends in phishing complaints. Put these on a simple dashboard beside indicators you already track, like MFA coverage and patch compliance, and review them monthly. Reading raw DMARC XML reports by hand is genuinely unpleasant work - Microsolve's Email Reputation Management service turns them into a dashboard and an alert instead.

This discipline also supports your obligations under the Australian Privacy Principles. The OAIC's Notifiable Data Breach statistics consistently list phishing and credential compromise among the top causes of reportable breaches, and the ACSC's small business guidance treats email authentication as a baseline control.

The Cost of Doing It Yourself vs. the Cost of Getting It Wrong

Here is the number that should settle the debate. Properly authenticating and monitoring a domain with SPF, DKIM and DMARC typically costs around $30 per domain, per month — way less than the price of a coffee a week.

Now weigh that against skipping it. Per the ACSC's Annual Cyber Threat Report 2024–25, the average self-reported cost of a cybercrime incident to Australian businesses jumped 50% in a year, to $80,850, with business email compromise among the most common causes. Broken down by size: small businesses report $56,600 per incident, medium businesses $97,200, and large businesses $202,700 — up 219% on the year before.

Managed email authentication is one of the cheapest controls you will ever buy relative to the loss it prevents. You do not need to become a DNS and DMARC expert to get the benefit — you need someone who already is one.

Your Action Plan: Steps by Business Size

Small organisations (under 20 staff)

Build a domain and sender inventory, turn on SPF and DKIM for Microsoft 365, and set DMARC to monitoring. At $56,600 average incident cost, this is the cheapest insurance you will buy this year, and the tier where a managed partner delivers the fastest return.

Medium organisations (20–200 staff)

Extend DKIM to every marketing and billing platform, move DMARC to quarantine once reports look clean, and assign one owner for DNS and email security. At $97,200 average incident cost, a managed service pays for itself many times over.

Large organisations (200+ staff)

Push DMARC to full enforcement, route legacy devices through a hardened relay, and feed DMARC and sign-in data into your SIEM. At $202,700 average incident cost and climbing, this needs a dedicated owner or a specialist partner operating at scale.

Make Email a Trusted Channel, Not a Risk

Email authentication is not a one-off project - treat it like patch management, an ongoing practice you revisit as your business changes. You do not have to do this alone, and given the technical depth involved, most businesses should not try. Microsolve manages this end to end for clients across Australia: the setup, the tuning, the monthly monitoring, and the quiet work of catching problems before they become incidents. For a cost far lower than a single breach, you get a trusted inbox, better deliverability, and one less thing keeping you up at night.

Ready to see where your domains stand? Talk to Microsolve about Email Reputation Management and get a clear picture of your SPF, DKIM and DMARC status - and a plan to have us manage it from here.