Finding SPF-Active Domains That Still Lack DKIM Through Bulk Checks

Email authentication is one of those quiet back-office tasks that Australian IT teams keep pushing down the to-do list until something goes wrong. A bulk domain scan can surface the exact gap where SPF is published but DKIM is silently missing, which is far more common than most admins assume.

When SPF is in place but DKIM is not, outbound mail passes a sender check while the message body remains completely unsigned. Attackers who have stolen valid credentials can forge content that still aligns with your domain, because nothing inside the headers proves the message was actually generated by your mail servers.

Why SPF Alone Leaves a Real Authentication Gap

SPF only validates the envelope sender, the return-path address that most recipients never see. DKIM, by contrast, applies a cryptographic signature to the message body and selected headers, so the receiving server can confirm that the email was not altered in transit.

A domain can look healthy on a quick check while still being wide open to spoofing. Many Australian organisations relying on legacy filtering or basic cloud platforms assume that publishing an SPF record is the finish line. It is not. Without DKIM, business email compromise becomes trivially easy, which is why working through business email compromise detection notes is so valuable once the gap is identified.

Building the Domain List for a Bulk Audit

Start by exporting every domain your organisation owns or manages, including parked variants, subsidiary names, and those old .com.au registrations that nobody has touched since the Sydney office rebranded. Pull them from your registrar, internal DNS console, or marketing platform.

Then load the list into a bulk domain checker that queries both SPF and DKIM records at scale. Aim for a tool that returns per-protocol status rather than just an overall pass or fail. Many providers also flag DMARC alignment, which is the third leg of the stool and worth reviewing in parallel.

The goal is to produce three buckets: domains with SPF only, domains with DKIM only, and domains missing both. The first bucket is the one that causes the most headaches, because it gives a false sense of security.

Reading the Output Without Misleading Yourself

A common mistake is to treat "SPF found" as a green tick. SPF can be valid in syntax yet still fail to authorise the mail servers your marketing team or transactional platform actually uses. Conversely, a domain may publish DKIM but rotate selectors so frequently that bulk tools miss it on a single pass.

Run the check more than once across different days, particularly if your organisation operates across AEST and AEDT time zones and outsources mail to overseas providers. A one-off scan can return misleading data simply because a DNS TTL happened to expire mid-query.

Also remember that some bulk tools cache old results. If a record was added recently, you might be looking at stale information, which can send you chasing a ghost for hours.

Patterns That Show Up Often in Australian Domains

Across hundreds of scans run for Aussie businesses, a few patterns repeat. Franchise networks operating out of Brisbane and Perth often have a parent domain with DKIM properly configured, while franchisee subdomains publish only an SPF entry copied from a template years ago.

Government-adjacent bodies using .gov.au sometimes run strict policies, yet their project subdomains are wildly inconsistent. The same goes for marketing microsites launched for a single campaign and forgotten about once the campaign wraps. These are the gaps phishers love most.

In the education sector, many universities publish SPF for student portals but have never rolled out DKIM for alumni mailing lists. That is a soft target, especially during enrolment season when inboxes across Melbourne and Adelaide are flooded with legitimate-looking mail.

Prioritising What to Fix First

Once the spreadsheet is built, sort domains by traffic and reputation. A low-traffic vanity domain is a low priority compared to your primary transactional domain sending password resets and invoices every day.

For each SPF-only domain, draft the missing DKIM entry using your mail provider's selector format, then publish it in DNS and verify before tightening any policy. Avoid jumping straight to a quarantine or reject DMARC rule until you have proof of DKIM alignment.

Monitor delivery for at least a week after each rollout, since Australian recipients using older Telstra or Optus mail relays occasionally cache policy changes for longer than expected.

Embedding Bulk Checks Into Ongoing Workflows

A one-time scan is useful, but a continuous approach is what really protects your brand. Many security teams schedule weekly bulk jobs, pipe the output into a ticketing system, and assign remediation tasks to whoever owns each domain.

Pair that workflow with anti-spoofing tools that monitor lookalike registrations and fraudulent use of your brand in the wild. Together, the two layers create a feedback loop where new gaps surface quickly and old ones get closed before they cause harm.

For organisations running an in-house SOC or working with a managed security provider, integrating these checks via API means the audit never falls behind, even when someone quietly spins up a new subdomain on a Friday arvo.