Security notice to clients
Anyone could be emailing your clients as you.
Here’s what we’re doing about it.
We’re adding managed DMARC protection as standard for every domain we manage — because without it, nothing stops someone else forging your domain and emailing your clients and suppliers as if it were you.
How to opt outThe threat
Your domain can be forged without anyone touching your systems.
Email was never built to check who’s really sending a message. Anyone, anywhere, can put your domain name in the “From” field of an email they send from their own systems — no hack, no breach, no access to your network required. Unless the receiving mail server can check whether that email was actually authorised by you, it has no reason to doubt it.
This is how a huge amount of invoice fraud and business email compromise actually happens — not through a break-in, but through a forged sender address that looks completely legitimate to the person reading it.
Domain forged
An attacker sends email claiming to be from your domain — nothing on your side is compromised.
Nothing blocks it
Without DMARC, receiving mail servers have no way to confirm the email is genuinely from you.
It reaches inboxes
The forged email lands in your clients’ or suppliers’ inboxes looking entirely legitimate.
Trust and money lost
Invoice fraud, credential theft, or reputational damage — and it’s your domain name attached to it.
Not switched on by default
Having Microsoft 365 doesn’t stop someone else emailing as you.
What Microsoft 365 covers
- Delivering and filtering the email sent to your own inbox
- Platform uptime and infrastructure security
- Patching Microsoft’s own software
What’s on you to configure
- Proving to other mail servers that email claiming to be from your domain is genuine
- Monitoring for anyone attempting to forge your domain
- Deciding what happens to email that fails that check
DMARC, DKIM, and SPF are DNS records, not something Microsoft 365 sets up for you automatically. Until they’re configured and actively monitored, your domain has no defence against being forged — regardless of how secure your own mailbox is.
What we’re adding
Managed DMARC. Switched on as standard.
DMARC, DKIM & SPF
Email authentication, properly configured
We set up and maintain the DNS records that let receiving mail servers verify email sent from your domain is genuine. Policy is moved gradually from monitoring through to full enforcement, so legitimate mail keeps flowing while forged mail gets blocked — not switched to full enforcement overnight, which is how deliverability problems happen.
Ongoing monitoring
Visibility into who’s using your domain
You get regular reporting on every system sending email using your domain — including anyone attempting to spoof it. If something changes or a new attempt to forge your domain shows up, we see it and act on it. This is fully managed — you don’t need to touch DNS or interpret a report yourself.
Pricing & timing
What it costs and when it starts.
If you have one domain registered, that’s a one-off $400 + GST setup and $80 + GST per month. If you have multiple domains — for example, three — setup is $1,200 + GST in total, and the ongoing cost is $240 + GST per month, since DMARC is configured and monitored per domain, not per business. You don’t need to do anything to be protected. If you’d like to opt out, see the section below.
Opting out
You can opt out. We’d rather you understood the trade-off first.
Without managed DMARC in place, nothing stops someone else forging your domain and emailing your clients, suppliers, or staff as if it were you. Invoice fraud and business email compromise attempts using your own domain name can run for a long time before anyone notices — and by then, the damage is to your reputation, not just a mailbox.
Important: if you opt out and your domain is used to defraud a client or supplier
Incident response and recovery services may be charged at up to 3x our standard hourly rate. This reflects the reduced visibility and significantly increased effort required to investigate a domain-spoofing incident without DMARC reporting in place. Opting out confirms that Nectar has recommended this protection and you’re accepting the increased risk.
To opt out, get in touch and we’ll send you a short agreement to sign. Once it’s signed, the opt-out is confirmed — and you can switch protection back on at any time.
Contact us to opt outQuestions about what this covers?
Call us on 0508 632 821 or email [email protected] — we’re happy to walk through what this monitors and how it fits your situation.
Call us on 0508 632 821