DMARC for Australian organisations — ASD ISM email controls
Email authentication (SPF, DKIM, DMARC) is not one of the Essential Eight — it sits alongside it, in the ASD Information Security Manual and ASD’s guidance on combating fake emails. SpoofSentry monitors those controls, produces the evidence, and guides your organisation from p=none to full enforcement.
Where email authentication fits alongside the Essential Eight
A common misconception: the Essential Eight does not include email authentication. Its eight mitigation strategies are application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. SPF, DKIM, and DMARC are not among them.
Email authentication is instead an ASD Information Security Manual (ISM) control — see the ISM’s Guidelines for email (SPF, DKIM, DMARC, and opportunistic TLS) — and part of ASD’s broader Strategies to Mitigate Cyber Security Incidents and its How to combat fake emails guidance. It complements the Essential Eight rather than being counted within it.
SpoofSentry monitors these ISM email controls continuously, tracks policy progression from p=none to p=reject, and generates evidence bundles mapped to the relevant ISM controls — ready for your assessment.
SMB1001 compliance support
For small and medium businesses in Australia, the SMB1001 cyber security standard provides a practical framework. SpoofSentry's compliance evidence bundles include SMB1001-aligned reports covering email authentication, sender governance, and domain protection.
Use the built-in checklist to track your progress through SMB1001 requirements and generate evidence for auditors or insurers.
Guided enforcement for Australian domains
Australian domain adoption of DMARC has grown rapidly, but enforcement remains low. SpoofSentry's Enforcement Center shows readiness gates, impact simulation, and sender authorization workflows to safely move from p=none to p=reject.
See exactly which senders would be affected before you change policy. Approve changes through a structured workflow with audit trail.
Sender discovery and classification
Discover all services sending email on behalf of your domains — including third-party SaaS platforms, marketing tools, and transactional email providers. SpoofSentry auto-detects 26+ common email service providers and classifies senders by risk level.
AI-powered classification helps identify unknown senders and recommends appropriate SPF and DKIM configuration for each.
Australian use cases
SpoofSentry is used by Australian organisations across government, healthcare, financial services, and education to monitor DMARC posture and drive enforcement. Our compliance evidence bundles support ACSC assessments, insurance questionnaires, and supply chain due diligence.
For detailed information about our security controls and data handling, see the Trust Center.
Frequently asked questions
Does the ASD Essential Eight require SPF, DKIM, and DMARC?
No — email authentication is not one of the Essential Eight strategies (which are application control, application patching, Office macro configuration, user application hardening, restricting admin privileges, OS patching, MFA, and backups). SPF, DKIM, and DMARC are ASD Information Security Manual (ISM) controls under the ISM’s Guidelines for email, and feature in ASD’s How to combat fake emails guidance. SpoofSentry monitors those ISM controls continuously and generates mapped evidence.
Does SpoofSentry support SMB1001 for smaller Australian businesses?
Yes. Its compliance evidence bundles include SMB1001-aligned reports covering email authentication, sender governance, and domain protection, with a built-in checklist to track progress for auditors or insurers.
How does SpoofSentry help move Australian domains to enforcement?
The Enforcement Center provides readiness gates, impact simulation, and sender authorization workflows so you can move safely from p=none to p=reject, seeing exactly which senders would be affected before you change policy.
Can I produce evidence for ACSC assessments and insurance questionnaires?
Yes. SpoofSentry generates ASD ISM and SMB1001-aligned evidence bundles that support ACSC assessments, insurance questionnaires, and supply-chain due diligence. See the Trust Center for security and data-handling detail.