WispBinderFor managed service providers in Australia · Pilot
Security you can check, for your clients' email domains
WispBinder helps small businesses protect themselves against fake invoices and business email compromise (BEC), starting with the settings that stop criminals sending email as their domain. We are looking for a few Australian MSPs to shape a pilot with us.
Why this matters
- In the Australian Signals Directorate's Annual Cyber Threat Report 2024–25, business email compromise fraud resulting in financial loss made up 15% of the top cybercrimes reported by businesses, and the average self-reported cost per cybercrime report for a small business was $56,600.
- ASD's guidance How to combat fake emails advises implementing DMARC straight away, even in monitoring mode, then moving to quarantine and, after testing, to reject. Our free domain check shows where a domain is on that path.
What you can use today
- Free domain check: SPF (with the 10-lookup limit), DMARC policy and reports, DKIM at common selectors, DNSSEC, MTA-STS and TLS reporting, explained in plain language with what to do next. It runs in your browser; the domain is looked up through Cloudflare's public DNS resolver and nothing is sent to us. Check a domain, or check up to 50 client domains at once and save the table as CSV.
- Results can be saved as a dated file, so you have a before-and-after record for each client.
The pilot we are planning with MSPs
A portal for MSPs that checks all of your clients' domains on a schedule, alerts you when a setting gets worse (for example DMARC dropping back to p=none), and produces a dated report per client. It is not built yet. We will only build it if Australian MSPs tell us it is worth paying for, so we are starting with conversations, not sales.
Where data would be stored: if we build the portal, its data will be stored in Sydney (AWS ap-southeast-2), including backups. Our team would support it remotely from Indonesia, and web traffic would go through Cloudflare. We will publish a separate privacy policy for it before any data is collected.
Time zones: we work from Indonesia (UTC+7), one to four hours behind Australian business hours depending on the state and daylight saving.
Pricing: discussed with pilot MSPs before anything is built. Nothing is charged for taking part in a conversation.
Why you can rely on us
- We check ourselves, in public: our own domain and computer, with dates and the exceptions we keep.
- We never promise "compliance" and we say what a check cannot see.
- We are hard to impersonate: how to tell a real message from us.
Talk to us
The quickest way to see if this is useful: run your clients' domains through the batch check. If you want it on a schedule, or want to take part in a 30-minute conversation, email alfrets@wispbinder.com. Please do not send client data.
WispBinder is run by Alfrets Bimbangnaung, a registered sole proprietor in Indonesia. We are not affiliated with the Australian Signals Directorate or any government agency. Sources: ASD, Annual Cyber Threat Report 2024–25, factsheet for businesses and organisations; ASD, How to combat fake emails. General information, not legal advice.