What ASD’s latest threat report means for the resellers running small business email

Where resellers fit in

The report also flags the growing reliance on third-party providers and shared digital infrastructure, which makes a compromise harder to contain once it starts. A small business might deal with several third parties. The one managing its domain, DNS and email often has admin access to all three at once.

For agencies and MSPs offering white-label email hosting, choosing a platform means making security decisions on the client’s behalf. Those decisions include how spam and malware are filtered, where mail data is stored, and how much DNS control the reseller ends up with. DNS control matters later, when authentication records need to be set up. If any of these turns out to be inadequate, the client generally won’t find out until something goes wrong.

Email is still the biggest problem

In last year’s report, the two most common types of cybercrime reported by businesses both involved email. Email compromise without a financial loss accounted for 19 per cent of business reports. Business email compromise (BEC) fraud that did result in a loss made up another 15 per cent, so together they were roughly a third of the total.

The usual defence has been staff training, which teaches people to look for poor spelling, strange formatting and generic greetings. Generative AI removes most of those clues. Picture an email asking to update a supplier’s bank details, written in that supplier’s usual tone and referring to a real invoice. It’s unreasonable to expect a busy bookkeeper to catch it. That’s where technical controls earn their place, because they don’t rely on anyone noticing anything.

Getting SPF, DKIM and DMARC right

Most of the work of stopping domain spoofing comes down to three DNS records:

• SPF lists the mail servers allowed to send on a domain’s behalf.
• DKIM adds a cryptographic signature that receiving servers can check.
• DMARC sits over both. It tells receiving servers what to do with messages that fail, and sends reports back to the domain owner.

Things tend to fall down at the DMARC policy. A domain set to p=none is only being monitored, and messages that fail the checks are still delivered. Domains are often set to p=none during an email migration, with the intention of tightening them later, and then nobody comes back to them. Protection only starts at quarantine or reject. Getting there without breaking legitimate email means going through the reports to find every service that sends on the business’s behalf, such as the CRM or the accounting software. Each one needs to pass before the policy is changed.

The big mailbox providers have been heading the same way. Google and Yahoo brought in authentication requirements for bulk senders in 2024. Since May 2025, Microsoft has enforced SPF, DKIM and DMARC for domains that send more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses. Few small businesses send anywhere near that volume, but low volume doesn’t stop someone impersonating them.

Parked domains

Domains that never send email are often forgotten. A business might hold a few variations of its name, or an old brand it no longer trades under. Those domains can be spoofed just as easily as the main one. Publishing an SPF record that authorises no senders, plus a DMARC policy of reject, prevents that. For a reseller managing dozens of these on behalf of clients, it’s a quick job.

Admin accounts and access

The report names compromised credentials as a recurring cause of successful attacks, alongside unpatched systems and social engineering. ASD recommends multifactor authentication or passkeys as a core control. A stolen password does more damage at a reseller than at a single business. One management panel login can give access to the DNS, mailboxes and hosting of every client in that account.

None of the fixes are new:

• Switch on MFA for every reseller, registrar and hosting control panel login.
• Give each staff member their own account, not a shared one.
• Remove access as soon as someone leaves.
• Store API keys securely and rotate them from time to time.

It’s also worth checking client mailboxes for forwarding rules. Attackers who get into a mailbox often set one up quietly. That lets them read incoming mail and wait for the right moment to send a fake payment request.

Websites need attention too

The report also found that attackers successfully exploited a vulnerability first identified in 2008. The number of publicly reported common vulnerabilities and exposures rose by 30 per cent over the year. Small business websites are a common source of this kind of old, unpatched weakness, usually through an out-of-date content management system, plugin or theme. Once a site is compromised, it can host fake login pages or send phishing from a domain the business’s customers already trust.

When comparing reseller web hosting options, ask three things: how the provider handles server-level patching, what firewall and DDoS protection is in place, and where the servers are located. Patching the sites themselves is a separate job. It generally falls to whoever built or maintains them. Resellers should have a regular update schedule, and an agreement with each client that says who is responsible.

Where to start

For agencies and MSPs, most of what this year’s report points to is unglamorous maintenance work:

1. Audit SPF, DKIM and DMARC across every client domain, including the parked ones.
2. Move each DMARC policy to enforcement once that client’s legitimate senders are passing.
3. Make sure MFA is on for every admin login, and clean out old accounts.
4. Check mailboxes for unexplained forwarding rules.
5. Put a patching schedule in writing.

ASD’s report repeats the message that everyone is responsible for cyber security. Agencies and IT providers look after email and websites for many small businesses. For them, that responsibility often goes well beyond what the service agreement covers, and most of the work involved costs time more than money.