SMB1001: A cyber defense standard for small and medium businesses

What is SMB1001?

SMB1001 is a multi-level cybersecurity framework designed specifically for small and medium-sized businesses. It gives growing organizations a practical, phased path to stronger security.

SMB1001 was developed in 2023 and updated in October 2025. It originated in Australia and became a global standard in January 2025. The framework is maintained by Dynamic Standards International (DSI), a company focused on designing accessible cybersecurity guidance for SMBs.

Instead of setting a single benchmark that every business must meet immediately, SMB1001 uses a tiered model. This approach lets you progress to higher tiers as your security posture improves. Each tier builds on the last, moving from essential controls to more advanced, resilient practices.

SMB1001 certification shows that an organization:

• Follows a recognized cybersecurity framework tailored to SMBs.
• Has implemented defined controls and repeatable processes.

For customers, cyber insurers, and regulators, SMB1001 certification signals that a company takes cybersecurity seriously and has clear controls in place to manage risks.

How email security fits into SMB1001

Part of SMB1001 compliance includes securing email communications to prevent impersonation. Modern email authentication supports this and relies on three protocols:

• Sender Policy Framework (SPF) identifies which servers are permitted to send email on behalf of a domain. Receiving email systems can use this information to verify whether a message was sent from an authorized source.
• DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing messages. Receiving servers validate the signature using a public key. This confirms that the message hasn’t been altered and that it genuinely originates from a specific domain.
• Domain-based Message Authentication, Reporting, and Conformance (DMARC) builds on SPF and DKIM. DMARC lets domain owners publish a policy that instructs receivers how to handle messages that fail authentication checks and provides reports so they can see who’s sending email on their behalf.

With SMB1001:2026, email authentication requirements are explicitly included in the standard:

Level 2

• Requires a valid SPF record that lists all authorized email-sending services.
• Requires a DMARC policy of p=none (monitor).
• DKIM signing and DMARC reporting are recommended.

Level 3

• Requires DKIM signing on all outbound emails.
• Requires a DMARC record with a reporting address.
• Requires a DMARC policy set to p=quarantine or p=reject.

This is where Sendmarc fits directly into your SMB1001 journey. To achieve and maintain compliance, you need to:

• Know every service that sends email for a domain.
• Configure SPF and DKIM correctly for each service.
• Move DMARC from monitoring to enforcement without disrupting legitimate email.
• Demonstrate that these controls are implemented, effective, and maintained over time.

Sendmarc helps you manage each of these steps with confidence, making the email-related requirements of SMB1001 far easier to meet.

How Sendmarc supports your SMB1001 journey

Sendmarc’s solution is designed to make email authentication practical for businesses of all sizes, as well as for the managed service providers (MSPs) that support them. Instead of manually interpreting DMARC XML reports or managing complex DNS updates, you get guided workflows and clear, ongoing visibility.

Sendmarc helps you:

Gain visibility into all sending services

DMARC reports are collected, interpreted, and displayed in a user-friendly way, so you can immediately see all sources sending on behalf of a domain.

Configure SPF, DKIM, and DMARC safely

• Step-by-step guidance helps you update DNS records without disrupting important emails such as invoices, password resets, or support tickets.
• You can move from monitoring to DMARC enforcement (p=quarantine or p=reject) with confidence, easily aligning with SMB1001 level 3 requirements.

Monitor continuously and resolve issues quickly

• Alerts notify you when there are configuration changes or new senders on a domain, so you can review and address them before they affect deliverability or security.
• Historical reporting helps you show auditors and insurers that controls are correctly configured and consistently maintained over time.

For MSPs, Sendmarc makes it easier to manage multiple client domains in one platform, apply a consistent approach to email security, and provide clear, customer-friendly reporting.

Talk to our team to see how Sendmarc can help you support your SMB1001 certification goals, whether you’re securing your own domain or an entire client portfolio.