· By Nicholas “Nick” O'Sullivan, Townsville
Why Suburban Secure exists: stopping your own name being used to phish your community
People assume a hacked email account is the scary scenario. In practice, the more common one is quieter: nobody ever finished setting up the account in the first place, so anyone can send a message that looks like it came from you, and nothing stops it.
Over fifteen-plus years working IT around Townsville — from Townsville Computer Man house calls, to a state-wide role supporting Queensland state schools, to running technology for a school today, to a few years as a volunteer Director with Northreach Community Care — I’ve watched the same failure happen on repeat. A charity, a church, a small business sets up email once, gets it working, and never comes back to finish the job. Years later, someone outside the organisation sends a message that appears to come from its domain, and a member, donor or supplier trusts it because of exactly the reputation that organisation spent years earning.
The technical gap behind almost all of it has a name: DMARC. SPF and DKIM tell a receiving mail server which servers are allowed to send as your domain, and DMARC tells it what to do when a message fails that check — quarantine it, reject it, or, the default almost everyone is quietly left on, do nothing and just report it. An unfinished DMARC record is not a minor technical detail. It is the difference between “someone tried to impersonate us and it bounced” and “someone impersonated us and a member of our own community got phished.”
Small and volunteer-run organisations are the ones this hits hardest, for reasons that have nothing to do with how careful they are. Email is usually set up once by whoever was available at the time, ownership moves between volunteers or staff over the years, and nobody is ever specifically tasked with coming back to tighten DMARC once the basics are working. That is not negligence — it is what happens when technology decisions are made by people whose actual job is running a charity, a parish or a small business, not managing DNS records.
This is also squarely inside what the Australian Signals Directorate asks organisations to get right: the ACSC’s guidance for small business and the Essential Eight both treat this class of control — knowing who can send as you, and enforcing it — as foundational, not optional. It is one of the more achievable steps on that list, and one of the ones with the clearest, most human downside when it is skipped.
Fixing it properly is a staged process, not a flag you flip: confirm every legitimate sending source first (your email platform, your CRM, your donation platform, your bulk mailer), get SPF and DKIM aligned across all of them, move DMARC to quarantine while you watch reports for anything you missed, then move to reject once you are confident nothing legitimate is being caught. Skipping straight to reject without that monitoring step is the most common way this goes wrong.
This is the actual reason Suburban Secure exists — not the pitch, the reason. It is why the free charity cyber check looks specifically at SPF and DMARC visibility, and why “who manages the email platform, domain and website day to day” is one of the first questions in almost every review.
If you look after email for a charity, church or small business and you have never specifically checked your DMARC policy — not just that email works, but what happens when someone tries to send as you — it is worth two minutes to find out.
