Email Authentication Check for Perth Estate Planning Lawyers: Reduce BEC Exposure on Client Correspondence

You handle wills, powers of attorney, and estate administration files that move significant sums between executors, beneficiaries, and trust accounts. A spoofed email purporting to come from your firm — or from a deceased client’s bank — is one of the lower-effort attacks adversaries run against estate matters. The Email Security Check is a one-shot diagnostic that tells you whether your firm’s outbound domain is configured to make that impersonation harder, and whether your inbound mail will catch the obvious attempts.

Why it matters now

The Privacy Act 1988 (Cth) applies to organisations with an annual turnover above $3 million, and to some smaller organisations including those that handle health information — a category that captures many estate practices via medical records attached to capacity assessments. The Office of the Australian Information Commissioner administers the Act and its 13 Australian Privacy Principles, which govern how APP entities handle personal information, including the obligation to take reasonable steps to protect that information from misuse, interference, loss, unauthorised access, modification, and disclosure. The Australian Cyber Security Centre publishes guidance on business email compromise and recommends domain-based email authentication (SPF, DKIM, and DMARC) as a baseline control. For estate files — where executors, beneficiaries, and counterparties communicate by email over months — weak email authentication makes impersonation of the firm cheap and detection late.

The 5-minute view

• The Privacy Act 1988 (Cth) covers organisations with annual turnover above $3 million, and certain smaller entities including health service providers, as administered by the OAIC
• Australian Privacy Principle 11 requires APP entities to take reasonable steps to protect personal information from unauthorised access and disclosure
• SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are authorised to send mail on behalf of your domain
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature so receivers can verify the message was not altered in transit
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when SPF or DKIM fails, and reports impersonation attempts back to you
• A domain published with no DMARC policy — or a DMARC policy set to p=none — gives receiving servers no instruction to reject spoofed mail using your domain
• The Australian Cyber Security Centre publishes general guidance on email authentication and BEC at https://www.cyber.gov.au/
• Estate matters are structurally exposed: long file lifespans, multiple parties, infrequent transactions per party, and large lump-sum movements at distribution

What DRMO does about it

The Email Security Check is a fixed-scope diagnostic on your firm’s primary email domain. You submit the domain (for example, yourfirm.com.au). DRMO queries the public DNS records for SPF, DKIM selectors (where discoverable), and DMARC, evaluates the published policies against the Australian Cyber Security Centre’s published guidance on email authentication, and identifies the specific misconfigurations that would let an attacker spoof your firm or that would let inbound spoofed mail reach your fee-earners’ inboxes. This is the L1 productised version of the email-hardening step that sits inside the broader DRMO Pre-Settlement Shield engagement, sold as a standalone diagnostic so a sole practitioner or small estate practice can get a defensible baseline without a discovery call.

This is an operational support service to help document email-authentication controls. It is not legal advice on Privacy Act obligations.

The deliverable

• PDF report scoped to one email domain
• Executive summary with a Red / Amber / Green status per record (SPF, DKIM, DMARC)
• Current DNS record values cited verbatim, with the specific deficiency flagged
• Recommended target configuration aligned to ACSC email-authentication guidance
• Plain-English explainer your IT provider can action without further interpretation
• Delivered via email within 1 business day of payment and domain submission

CTA

Run the Email Security Check — AUD $99

A single-domain productised offer. No discovery call required. Suitable for any Perth estate practice that wants a documented baseline on email authentication before the next distribution cycle.

Sources

1. Office of the Australian Information Commissioner — The Privacy Act: https://www.oaic.gov.au/privacy/the-privacy-act
2. Australian Cyber Security Centre — general guidance on business email compromise and email authentication: https://www.cyber.gov.au/
3. Federal Register of Legislation — Privacy Act 1988 (Cth): https://www.legislation.gov.au/

DRMO capability references:

• Email Security Check (L1 service shape) — surface-area-matrix.json
• Pre-Settlement Shield (L3 package, email-hardening step) — service-packages.md