Verify email security across every active domain using bulk lookup
Running a portfolio of domains without a clear view of each one's authentication state is asking for trouble. Threat actors increasingly piggyback on legitimate-looking domains that lack proper email authentication records, turning a small oversight into a major breach.
The platform's bulk domain checking feature was built for exactly this scenario. Submit a list and receive a consolidated snapshot of trust signals across every active domain. Pair that with the Trusted Sender Score checker and you scale from a handful of internal assets to hundreds of marketing microsites without losing oversight.
Australian organisations feel this pressure. The ACSC logs thousands of email-borne compromises each year, and ACCC Scamwatch lists ATO and myGov impersonation campaigns among the most reported scams. Under the Notifiable Data Breaches scheme, a spoofed email that escalates to wire fraud can quickly become a reportable incident. Bulk verification helps security leads in Sydney, Melbourne, and Brisbane triage risk before regulators get involved.
This guide covers preparing a domain inventory, interpreting SPF, DKIM, and DMARC results, spotting weak entries, prioritising remediation, and turning a one-off scan into continuous monitoring.
Building a clean domain inventory before you start
Before uploading anything, gather every domain your organisation actually sends mail from, including production marketing domains, transactional subdomains, customer-support aliases, and forgotten newsletter platforms. Walk through DNS records, talk to marketing teams, and check archived transition notes. Legacy domains sitting in a shared inbox can still receive mail from the public.
Format the list as a plain text or CSV file with one hostname per line. Strip non-mail-sending subdomains since they skew the summary. Bulk checks tolerate hundreds of entries at once, but a tidy inventory produces cleaner output. Schedule the first run during business hours in AEST so the team can review findings the same arvo.
Record what you expect to see for each domain. Core corporate domains should show strict DMARC, active DKIM keys, and tight SPF entries, while legacy marketing domains may tolerate weaker results pending decommissioning. These expectations turn the scan into a focused gap analysis you can action the same day.
Interpreting SPF, DKIM, and DMARC across a portfolio
The bulk tool evaluates each domain against the same checks a manual lookup would, but at scale. Treat SPF, DKIM, and DMARC as three independent signals that together describe whether a sender can be trusted.
| Authentication Layer | Healthy State | Common Weak State | Risk if Neglected |
|---|---|---|---|
| SPF | Lists every authorised sender, ends in -all or ~all, under DNS lookup limit | Missing, ends in +all, or references unverified third parties | Attackers can send unauthenticated mail impersonating the domain |
| DKIM | Active key pair, signatures present on outbound mail, key rotated periodically | Key record missing or revoked, signatures stripped by intermediaries | Message integrity cannot be verified, content tampering goes unnoticed |
| DMARC | Published policy with rua reporting, alignment on both SPF and DKIM | Policy of p=none or no record at all | Spoofed mail delivered without quarantine, no forensic feedback loop |
Group the output by authentication layer rather than by domain. This makes it easier to see whether a weakness is structural, like every domain missing DMARC, or a one-off oversight for a single campaign asset. Cross-reference surprises against the DMARC cross-check workflow to confirm whether weak authentication is producing real spoofed mail downstream.
Spotting domains that invite abuse
Some weak configurations are worse than others. Domains with no DMARC record and SPF ending in +all are effectively open relays for spoofing. They sit quietly in a portfolio while criminals harvest goodwill associated with the brand.
Watch dormant domains that still resolve to active mail servers. A Brisbane-based retailer may have parked an old product line years ago, but if the MX record remains valid, attackers can register lookalike display names and target customers expecting invoices from that brand. The trust scoring ranks these edge cases lower than fully configured domains.
Treat the scan output as a triage list rather than a verdict. A small newsletter domain with p=none may be acceptable for now, while a public-facing transactional domain with the same posture should jump the queue. The legitimate domain abuse guide explains why a weak posture on a familiar domain is often more dangerous than a clumsy spoof from an unknown sender.
Prioritising remediation across the portfolio
Once ranked, focus on fixes that deliver the highest security return first. Domains with missing DMARC and SPF ending in +all are the highest priority, since they offer criminals the most surface area with the least resistance. Add DKIM coverage next, because signed mail gives downstream filters stronger signals.
Coordinate changes across multiple domains in a single window rather than rolling out DNS updates one at a time, which spreads risk. Batch the edits, validate them with the bulk tool, and monitor delivery from a mail server in Sydney to confirm nothing regresses. Track each fix in a register capturing the previous state, the change made, and the verification timestamp; the bulk tool provides consistent data that makes audit trails easy when the OAIC asks for evidence of due diligence.
Turning one-off scans into continuous monitoring
Bulk lookup becomes genuinely useful only when it runs on a schedule. Set up a recurring job that pulls a fresh domain list from your DNS or registry records and pushes results into a dashboard the security team reviews weekly. The API supports this directly, returning structured JSON that maps onto ticketing systems.
Tie remediation to ownership. Each weak domain should map to a named admin responsible for publishing a corrected SPF, DKIM, or DMARC record. Review status during a regular stand-up using the scan output as the agenda. Over time the weekly delta shrinks, and remaining weak entries become easier to manage.
Keep historical snapshots for at least twelve months; archived results help during an OAIC audit or an internal post-incident review, showing hardening was deliberate and tracked across the portfolio.