Email Security Audit
91% of cyber attacks begin with a phishing email. Our audit checks your SPF, DKIM, and DMARC configuration, tests whether attackers can spoof your domain, and assesses your organisation's resilience to email-based threats.
Why Email Security Matters for Your Business
Attacks Start Here
91% of all cyber attacks begin with a phishing email — making your email infrastructure the most critical security boundary to defend
BEC Loss Average
Business Email Compromise cost Australian organisations an average of $2.7 million per incident in 2025 — often through spoofed executive emails
Domains Unprotected
67% of Australian business domains lack proper DMARC enforcement, meaning anyone can send emails that appear to come from your company
Affordable Protection
A comprehensive email security audit at $300 identifies gaps before attackers exploit them — typically the highest-ROI security investment available
What Our Email Security Audit Covers
SPF Configuration Analysis
Sender Policy Framework (SPF) tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain. We analyse your SPF record for common misconfigurations — overly permissive rules (using +all instead of -all), exceeding the 10-lookup limit, missing authorised senders, and conflicting records. A misconfigured SPF record is worse than none at all because it creates a false sense of security while leaving your domain spoofable.
DKIM Signing Verification
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing emails, proving they have not been tampered with in transit. We verify that DKIM is properly configured for all your sending sources — your primary mail server, marketing platforms (Mailchimp, Brevo, HubSpot), transactional email services, and any third-party systems sending on your behalf. We also check key strength (minimum 2048-bit RSA) and key rotation practices.
DMARC Policy Assessment
Domain-based Message Authentication, Reporting & Conformance (DMARC) ties SPF and DKIM together and tells receiving servers what to do with emails that fail authentication — monitor (p=none), quarantine, or reject. We assess your DMARC policy strength, reporting configuration (rua/ruf), alignment settings, and subdomain coverage. Most organisations start at p=none and never progress to enforcement — we provide a roadmap to reach p=reject safely without blocking legitimate email.
Domain Spoofing Simulation
We conduct controlled spoofing tests — attempting to send emails that appear to originate from your domain to test whether your authentication controls actually block impersonation in practice. This real-world validation goes beyond configuration review, revealing whether receiving mail servers honour your SPF/DKIM/DMARC policies. Many organisations have technically correct records that still allow spoofing due to alignment issues or overly permissive rules.
Phishing Resilience Assessment
Beyond technical controls, we assess your organisation's human defences against phishing. This includes reviewing email filtering effectiveness, examining whether dangerous attachment types are blocked, checking if URL rewriting and sandboxing are active, and assessing whether external email warning banners are displayed. We test common phishing techniques — lookalike domains, compromised reply chains, and urgency-based social engineering — against your email gateway.
Mail Server Hardening Review
We examine your mail server configuration for security weaknesses — TLS enforcement (opportunistic vs mandatory), cipher suite strength, open relay testing, SMTP enumeration vulnerabilities, and MX record security. For Microsoft 365 and Google Workspace environments, we review tenant-level security settings including conditional access, legacy authentication protocols, and admin account protection that could allow account compromise even with strong email authentication.
See How AI Can Transform Your Operations
Get a personalized demo and ROI assessment for your business in a free 20-minute consultation.
Email Security Audit Process
Configuration Discovery
- Enumerate all domains and subdomains used for email sending
- Retrieve and analyse SPF, DKIM, and DMARC DNS records
- Identify all legitimate email sending sources (mail servers, marketing tools, SaaS platforms)
- Review MX records and mail server configurations
- Check TLS settings and certificate validity
- Map email flow through any gateways, filters, or proxies
Testing & Simulation
- Conduct controlled domain spoofing simulation
- Test SPF/DKIM/DMARC enforcement from multiple external sources
- Attempt delivery of common phishing payload types
- Test email filtering against known malicious attachments and URLs
- Check for open relay and SMTP enumeration vulnerabilities
- Validate DKIM signing across all authorised sending sources
Reporting & Remediation Roadmap
- Compile findings with risk ratings and exploitation evidence
- Provide corrected DNS records ready for copy-paste implementation
- Deliver DMARC enforcement roadmap (none → quarantine → reject)
- Produce executive summary with business impact assessment
- Conduct findings walkthrough call with your IT administrator
- Offer 30-day follow-up check to verify implementation
Email Security Audit FAQs
Stop Attackers Impersonating Your Domain
A $300 email security audit reveals whether your business is vulnerable to spoofing, phishing, and business email compromise — with a clear roadmap to fix it.