Email security for Melbourne businesses
Email security in Melbourne: stop spoofed invoices and business email compromise, and fix SPF, DKIM and DMARC so your mail stops landing in junk. Free check.
Email security for a Melbourne business is two jobs done together: keeping fake and dangerous email away from your staff, and proving to everyone you email that messages from your domain really are yours. Key IT sets up both for businesses on Microsoft 365, from filtering and SPF, DKIM and DMARC through to mailbox-rule monitoring by Key IT's 24/7 SOC service, then keeps them maintained.
Payment redirection, where an email swaps the bank details on a genuine invoice, drew $166.8 million in reported losses during 2025, more than any scam type except investment scams, according to the ACCC's release on the National Anti-Scam Centre's Targeting Scams Report.
What does business email security include?
We build business email security in six layers, each stopping a different attack, because none catches everything alone.
| Layer | What it stops | Who it protects |
|---|---|---|
| Filtering and attachment sandboxing | Malware, spam and known-bad senders | Your staff |
| Impersonation protection | Lookalike domains and fake display names posing as your directors or suppliers | Your staff and your bank account |
| Time-of-click link checks | Links that were clean on delivery and turned malicious afterwards | Your staff |
| SPF, DKIM and DMARC | Criminals sending as your exact domain, and genuine mail failing checks | Your clients and suppliers |
| Mailbox-rule and forwarding monitoring | A hijacked mailbox quietly forwarding or hiding mail | Everyone in the payment chain |
| Phishing simulation and training | The email that slips past every filter | Your staff |
The monitoring layer is where Key IT's 24/7 SOC service earns its place, flagging new inbox rules and external forwarding, the classic fingerprints of a compromised mailbox. Training starts with a phishing simulation, a believable fake sent to your team. Our security stack names the tools behind each layer, keeping some detail private on purpose.
How do you stop spoofed invoices and business email compromise?
You stop business email compromise (BEC) by matching each control to the trick it defeats, then adding one process rule that still works when every control fails. Criminals use three tricks, and DMARC only fixes the first.
| The trick | What your staff see | What stops it |
|---|---|---|
| Exact-domain spoofing | Email that appears to come from your real address, or your supplier's | SPF, DKIM and a DMARC policy of quarantine or reject on the sending domain |
| Lookalike domain | A sender one character off, or the right name on the wrong address | Impersonation protection, the External tag in Outlook and first-contact warnings |
| Hijacked real mailbox | A genuine thread, from the genuine account, with new bank details | MFA, blocked automatic forwarding and 24/7 monitoring of sign-ins and inbox rules |
Microsoft notes that impersonation can pass SPF, DKIM and DMARC checks when the attacker registers a similar domain with valid records. Authentication proves where an email came from; it can't tell your accounts team the domain is a fake.
So the last layer is a habit, not a product: no change to bank details is actioned from an email alone. Someone rings the supplier or client using contact details you held before the request arrived, and a second staff member signs off large or first-time payments. If money does go, ring your bank first. In 2023 the AFP said the common factor in full or partial recoveries was speed: victims alerted their bank and ReportCyber usually within 24 hours of realising. We trace one from start to finish in our payment redirection scam breakdown, and AI-written lures mean hunting for typos no longer works.
Exposure is highest wherever large sums move on an emailed instruction: conveyancers handling settlements, real estate agencies holding trust money, accounting practices paying for clients, and builders processing progress claims.
Why are our invoices landing in junk?
Invoices often land in junk because the system sending them can't prove it is allowed to use your domain. Since 1 February 2024, Gmail has required everyone sending to Gmail accounts to set up SPF or DKIM, warning that unauthenticated messages might be marked as spam or rejected. Senders of more than 5,000 messages a day to Gmail accounts also need DMARC.
Three common faults push a small business's own mail into junk:
DKIM was never switched on.
Microsoft states that no DKIM signing occurs for outbound mail from custom domains until you configure it, so a domain nobody set up can have been sending unsigned mail for years.
Other systems send as you.
Accounting-software invoice emails, newsletter tools, the CRM and practice-management notifications all use your domain. Each must sign with DKIM as your domain, or use your domain as its bounce address and be listed in SPF. Otherwise its mail fails DMARC.
The SPF record is broken.
Microsoft's SPF guidance allows one SPF record per domain, and a record needing more than 10 DNS lookups fails with a permanent error, so adding one more service can tip it over.
The fix is the same work that stops spoofing, which is why we treat security and deliverability as one job. For how the three records fit together, read SPF, DKIM and DMARC explained.
What do we set up in Microsoft 365?
Our Microsoft 365 checklist runs in this order, so nothing legitimate gets blocked:
DKIM signing for every custom domain that sends mail: two CNAME records, then signing switched on.
One clean SPF record covering Microsoft 365 and every other service that sends as you, with bulk-mail tools moved to a subdomain, as Microsoft recommends.
DMARC in stages, following Microsoft's gradual rollout. Start at p=none and read the reports to find every sender, then move to quarantine, then reject. Domains you own but never email from get a reject policy straight away, including the onmicrosoft.com domain if you don't send from it.
Anti-phishing policies with spoof intelligence and the first-contact safety tip on, and senders' DMARC policies honoured. Where your licence includes Microsoft Defender for Office 365, we add impersonation protection for directors, finance staff and key supplier domains, because none are protected by default.
Link and attachment scanning.
Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, with Safe Links and Safe Attachments. Microsoft's February 2026 licensing update also added URL time-of-click protection to Business Basic and Business Standard, with rollout from mid-2026.
The External tag in Outlook, so mail from outside the business is visibly marked.
Automatic external forwarding set explicitly.
Microsoft switched the default to blocked for new organisations in 2021, but some older tenants still allow it, so we turn it off, with named exceptions only.
MFA on every mailbox, while Key IT's 24/7 SOC service watches sign-ins, new inbox rules and forwarding changes.
How is email security priced?
For managed clients, email security is one of the layers inside Key IT's managed cybersecurity, covered by the fixed monthly fee, with no lock-in (agreements run month to month). Managed IT in Melbourne generally costs between about $100 and $200 for each user every month; that is a market range, not Key IT's price, and our breakdown of managed IT support costs in Melbourne explains what moves it.
Two things change the picture for email. First, your Microsoft 365 plan: Business Premium includes Defender for Office 365 Plan 1; Basic and Standard need an add-on, an upgrade or a separate filtering layer. Second, how many systems send as your domain, since each must be fixed before DMARC can move to reject. If you only need domain authentication fixed, we can quote that as a one-off project.
Frequently asked questions
Is Microsoft 365's built-in email protection enough?
It is a solid base, not the whole job. Every Microsoft 365 mailbox gets spam, malware and basic spoofing protection, but impersonation protection and Safe Attachments sit in Defender for Office 365, which Business Premium includes and Basic and Standard don't. Settings matter as much as licences, and nobody watches inbox rules unless someone is given that job.
Do small businesses really need DMARC?
Yes. DMARC stops criminals sending email that carries your exact address, and a ten-person firm is as easy to impersonate as a large one. It also helps genuine mail get delivered, because mailbox providers lean on authentication when deciding what is junk. The DNS record costs nothing; the work is finding every system that sends as you first.
Will DMARC stop every fake email?
No. DMARC stops criminals using your exact domain, but it can't stop a lookalike domain one character off, and it can't help when a real mailbox has been taken over, because that mail passes authentication. Those cases need impersonation protection, MFA, monitoring of sign-ins and inbox rules, and a firm rule that bank-detail changes are confirmed by phone on a known number.
What should staff do if a supplier emails new bank details?
Treat the request as suspect until proven genuine. Don't reply or ring any number in the email. Ring the supplier using a phone number from your own records, confirm the change with someone you know there, and have a second person approve the first payment. Put the rule in your payments procedure so nobody feels awkward holding a payment to check.
Does email security include staff training?
It should, because the most convincing attacks are built to get past filters. Key IT runs phishing simulations with management sign-off, then short training on the lures that matter to your business, such as fake invoices, shared-file links and password-reset prompts. Results are reported as an anonymised team rate, so the focus stays on learning, not blame.
What if one of our mailboxes has already been hacked?
Disable the account or reset its password (never emailing the new one), sign it out everywhere, then check for inbox rules, forwarding and MFA methods the attacker added. Our hacked Microsoft 365 account checklist covers the full sequence. Managed clients can phone the helpdesk between 8am and 5pm on weekdays, and an on-call engineer roster covers urgent problems after hours.
150+ Melbourne organisations, looked after every day
From manufacturing and healthcare to finance, body corporate and professional services — a few of the businesses whose IT and security we run every day.
Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.