Email Security Check for Perth Sole-Practitioner Lawyers and Conveyancers: SPF, DMARC and DKIM Aligned to ARNECC Subscriber Obligations

You are a one- or two-person practice. You sign as Subscriber on PEXA, you operate the trust account, and you read every email yourself. When a payment-redirection email arrives in the last week before settlement, there is no second pair of eyes. The Email Security Check is a one-shot diagnostic on your firm’s email domain that tells you whether the three standard authentication records — SPF, DMARC and DKIM — are correctly configured so spoofed mail claiming to come from your firm is rejected by recipient mail servers.

Why it matters now

The Australian Registrars’ National Electronic Conveyancing Council publishes the Model Participation Rules under the Electronic Conveyancing National Law. Subscribers — the lawyers and conveyancers who sign workspaces — must comply with the Participation Rules determined by the Registrar in each jurisdiction, including the security obligations covering the Subscriber’s digital certificate, password and the integrity of communications associated with the Subscriber’s account. For a sole practitioner, the practical surface area of those obligations is small but unforgiving: the email domain is the channel through which clients confirm trust account details, lenders send payout figures, and the other side’s representative sends instruction changes. The Australian Cyber Security Centre publishes general guidance on business email compromise at https://www.cyber.gov.au/, and ScamWatch tracks payment-redirection scams targeting professional services at https://www.scamwatch.gov.au/. Misconfigured SPF, DMARC and DKIM records make it materially easier for a third party to send mail that appears to come from your firm.

The 5-minute view

• ARNECC’s Model Participation Rules Version 7 (January 2024) is the current model for Subscriber obligations across Australian jurisdictions
• A Subscriber is the person or firm that signs documents in an Electronic Lodgment Network — typically the practitioner of record
• SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are authorised to send mail for your domain
• DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outbound mail so receivers can verify it has not been altered in transit
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that fails SPF or DKIM checks, and provides reporting so you can see attempted spoofs
• A DMARC policy of p=none is monitoring-only; spoofed mail is still delivered. Policies of p=quarantine or p=reject instruct receivers to filter or block failures
• The Australian Cyber Security Centre publishes guidance on configuring these records as a baseline email hardening control
• This check covers your firm’s sending domain only; it does not assess the inbound mail security of parties you correspond with

What DRMO does about it

The Email Security Check is a fixed-scope diagnostic on a single email domain. You provide the firm’s primary sending domain (the part after the @ in your professional email address). DRMO runs public DNS lookups for the SPF, DKIM and DMARC records, parses them against the standards, and flags the specific defects — missing records, overly permissive +all SPF policies, p=none DMARC enforcement, alignment failures between the records, and absent reporting addresses. This is the L1 productised version of the diagnostic that runs as the first step of the Pre-Settlement Shield consulting engagement, packaged for sole practitioners who want a clear baseline check without booking a discovery call.

The check is a technical configuration review of public DNS records. It does not constitute legal advice on your Participation Rule obligations; it provides operational support for the Subscriber’s responsibility to maintain the security of communications associated with the account.

The deliverable

• PDF report covering one email sending domain
• Status summary for each of the three records: SPF, DKIM, DMARC
• The raw record contents retrieved from public DNS, with timestamp
• Per-defect explanation in plain English with the recommended fix
• Prioritised remediation list (what to fix first, what is monitoring-only)
• Delivered via email within 1 business day of domain submission and payment

CTA

Run the Email Security Check — AUD $99

A single-domain productised offer. No discovery call required. Suitable for sole-practitioner lawyers and conveyancers who want a baseline check of their firm’s email authentication posture before the next settlement.

Sources

1. Australian Registrars’ National Electronic Conveyancing Council — Model Participation Rules: https://www.arnecc.gov.au/publications/model-participation-rules/
2. Australian Cyber Security Centre — general guidance on business email compromise and email hardening: https://www.cyber.gov.au/
3. Australian Competition and Consumer Commission — ScamWatch, payment-redirection scams targeting professional services: https://www.scamwatch.gov.au/

DRMO capability references:

• Email Security Check (L1 service shape, SPF/DMARC/DKIM diagnostic)
• Pre-Settlement Shield (L3 Shield package, of which the email authentication check is Step 1)