From a finding to a fix.
See what your IT team would need: the evidence, the owner and the next step. This fictional example.com report is not a customer result or a live scan.
Three priorities. Clear owners.
DNS configuration only. DKIM and inbox placement remain untested.
- 01
Consolidate duplicate SPF records
- Evidence
- Two TXT records start with v=spf1. Receivers require a single SPF policy.
- Why it matters
- SPF evaluation can return a permanent error.
- Owner
- DNS administrator
- Next step
- Inventory authorised senders, combine them into one policy, and check the lookup budget before publishing.
- Verify
- Re-run the DNS check and confirm one valid SPF record.
- 02
Review DMARC enforcement
- Evidence
- The sample policy is v=DMARC1; p=none.
- Why it matters
- The policy requests monitoring, not quarantine or rejection of unauthenticated mail.
- Owner
- Email administrator
- Next step
- Identify legitimate sending sources and confirm alignment before considering enforcement. Do not change policy blindly.
- Verify
- Review aggregate reports and test each authorised sending source.
- 03
Add a reporting destination
- Evidence
- No rua destination is present in the sample DMARC policy.
- Why it matters
- The domain owner is not requesting aggregate DMARC reports.
- Owner
- Email administrator
- Next step
- Choose a monitored reporting destination, review data handling, and add a valid rua tag.
- Verify
- Check the published record and confirm reports arrive when providers send them.
What a deeper audit adds.
Proposed scope includes sending-source mapping, DKIM checks using known selectors or a test send, seed testing, and a prioritised written action plan. Seed tests describe those tests, not every recipient’s inbox.
From A$799 is indicative only. Scope, access requirements, delivery date, final quote and GST must be agreed before any work. Implementation and ongoing monitoring are not included unless agreed separately. Paid audits are not on sale yet.