What does all this mean for an Australian small business?

There's a persistent assumption that the 2024 and 2025 sender rules are an American problem. They're not. The requirements attach to the mailbox receiving the message, so the moment you email a customer on Gmail, Hotmail or Outlook.com — which is most Australian consumers — you're in scope.

What is genuinely local is the shape of the risk, and one piece of legislation worth knowing.

Invoice redirection is the local threat that matters

The scam pattern is consistent: an email that appears to come from a supplier, sent to their customer, advising that bank details have changed. The customer pays the new account because the message looks exactly like every other message from that supplier. Scamwatch categorises this under payment redirection and false billing, and it disproportionately hits small businesses and the trades.

The reason it works is that most small business domains publish either no DMARC policy or one set to p=none — which explicitly instructs receiving servers to take no action on messages that fail authentication. Moving to p=reject removes the mechanism entirely for anyone impersonating your domain.

The money is usually lost by your customer. The relationship damage is entirely yours.

The Spam Act, briefly

Australia's Spam Act 2003 governs commercial electronic messages sent to Australian addresses. Three requirements: consent to send, accurate identification of the sender, and a functional unsubscribe facility honoured promptly. The ACMA enforces it.

Conveniently, all three overlap with what Gmail and Microsoft now demand. One-click unsubscribe, honest sender identity and a consenting list keep you both compliant and deliverable. Buying a list, by contrast, breaks the law and destroys your complaint rate simultaneously.

This isn't legal advice — check with someone qualified if you're running large campaigns — but the practical direction is unambiguous.

Local specifics worth knowing

.com.au domains work identically

Same SPF, DKIM, DMARC and MX records as any other domain. The registrar and the eligibility rules differ; the email standards don't.

Old ISP-hosted mail is a common finding

Businesses still relaying through Telstra, Optus or a legacy web host from a decade ago, with the records to match.

Local web hosts and shared reputation

Sending website mail through a small shared host means sharing whatever reputation everyone else on that server has earned.

Xero and MYOB are near-universal

Both send invoices as you and both need explicit authorising, which makes them the most common single cause of missing invoices in Australian businesses.

Government and enterprise clients check

If you invoice government departments, universities or large corporates, their inbound filtering is stricter than average and your unauthenticated mail is likelier to be stopped.

A sensible order for an Australian small business

1. 01

   Read what you publish today

   Check your domain's SPF, DKIM, DMARC and MX. It takes seconds, and it tells you which of the following steps you actually need.

2. 02

   Cover Xero, MYOB and the booking system

   Whatever sends invoices and confirmations to your customers is the highest-value thing to authenticate first.

3. 03

   Publish DMARC with reporting

   Start at p=none with rua= set, so you find out what's really sending as you before you enforce anything.

4. 04

   Move to reject within a month or two

   This is the step that stops someone invoicing your customers in your name. Everything before it is preparation.

5. 05

   Keep an eye on it

   New tools, staff changes, a helpful developer editing DNS. Configuration drifts, and the failure mode is always silent.