Email authentication in Australian small business

Email authentication is the rare control that fails silently. A domain can be open to anyone forging mail in its name, or quietly landing its own mail in spam, with nothing bouncing and nobody told. It is also the one part of a business's posture that can be read from the outside, from the same public DNS an attacker checks, which makes it measurable across a whole sector at once.

So I read it, sector by sector. Each scan covers every organisation in a defined group, reports what their records actually do, and is published in full with the data. This page pools those scans into one picture. How the scans work sets out what is read, what each figure is counted against, and what the scan deliberately does not claim.

That is 4,336 businesses scanned, 4,320 of them with a domain that resolves, and the share has held near enough steady as the pool has grown.

Of the 4,320, 1,177 (27 percent) publish no DMARC record at all, and 1,421 (33 percent) publish DMARC set to monitor only, which reads as protection on paper while a forged sender still arrives. Only 1,722 (40 percent) reject or quarantine a forged message. Set apart from forgery, 446 (10 percent) publish no SPF record at all, and 245 more publish an SPF record grown past the ten-lookup limit, the point at which many receivers stop checking, so their own mail is at risk of failing whether or not anyone forges them.

Every figure on this page is as found, the state of the records on the day of each scan, counted one organisation at a time against the resolved base and reported with the sample floor described in the method. Segments below that floor are named and withheld, never folded in.

Eleven sectors are now large enough to publish, and they do not cluster. Independent schools and training providers are the tightest, with 53 of 174 (30 percent) open to forgery. Medical, dental and allied health are the widest, at 30 of 42 (71 percent), on the smallest sample that clears the floor. The spread between them is wide enough that industry norm looks like a better predictor of posture than business size, which is not what I expected when the first scan went out. Sectors below the sample floor are withheld rather than shown.

Some sectors have a full written deep-dive, where the sector is read on its own and the stakes are spelled out.

Where domains have been read more than once, the later record can be compared against the first. Of 1,470 domains re-checked, 9 had moved to an enforcing DMARC policy by the later read, 1 had added an SPF record, and 49 had added a discoverable DKIM signature. None had dropped an enforcing policy once they had one. The scan counts records gained and not records lost for SPF and DKIM, so those two figures can fall as well as rise between scans.

This is movement, not a sector rate. The re-scanned group is weighted toward domains that were contacted, so it is reported on its own and never mixed into the pooled figure above. It records that records changed and when, not why, because the background era of sender-requirement changes at the large mailbox providers moves records too, and that cannot be told apart from any other cause at the level of a DNS read.

Every figure here traces to a stored scan, counted one organisation at a time against the resolved base, with segments below the sample floor withheld. The full account of what is read and what it means is on the method page.