Email security
for your business.

01 / Account access

Protect the keys to the mailbox.

Require multifactor authentication (MFA) for all users, including administrators. Prefer phishing-resistant methods such as security keys or passkeys supported by your identity provider. Use unique passwords stored in a password manager where passwords are needed, and protect recovery methods as carefully as the primary sign-in.

Review administrator access, shared mailboxes, dormant accounts, third-party applications, and old sign-in methods. Remove access people no longer need and disable legacy authentication where feasible after checking application dependencies. Keep a small number of separately protected emergency administrator accounts and test their recovery procedure.

Enable sign-in and mailbox audit logs and alerts for suspicious access, new forwarding rules, and privilege changes where supported. Decide who reviews alerts and how long logs are retained. Keep devices and mail systems updated and use your provider’s spam, phishing, and malicious attachment protections.

02 / Domain authentication

Help receiving servers identify mail from your domain.

SPF identifies authorized sending services for a domain. DKIM signs messages so a receiver can verify a signature against a public DNS key. DMARC ties an aligned SPF or DKIM result to the visible From domain and publishes a policy for messages that fail the check. Receiving systems make their own decisions, and forwarding or mailing lists can affect authentication.

First inventory every legitimate sender: your mail provider, invoicing tools, marketing platforms, support systems, and any internal applications. Configure SPF and DKIM with each provider, then publish a DMARC monitoring policy and review aggregate reports. Investigate and correct legitimate failures before moving through quarantine to a reject policy. Test representative messages and keep monitoring after changes. Protect registrar and DNS administrator accounts with strong MFA.

Keep SPF within its DNS lookup limits, maintain only one SPF record per name, and coordinate changes to avoid interrupting legitimate mail. Consult your providers’ current instructions for DNS syntax, signing, alignment, reporting, and rollout.

03 / People and process

Make payment fraud harder.

Attackers may impersonate an executive, supplier, or customer, or use a real compromised account. Require a second person or other documented approval for sensitive payments, and verify new bank details or changes to existing instructions using a previously known phone number or another independently established channel. Do not rely on contact details supplied in the suspicious message.

Give employees a simple way to report suspicious messages without penalty, and practice recognizing unexpected login prompts, attachments, and requests for secrecy or urgency. Good spelling, a familiar display name, or a valid signature does not prove a request is legitimate. Use filtering and attachment protections as additional layers, and check legitimate messages caught in quarantine.

04 / Incident response

Know what to do when an account may be compromised.

Ask employees to report quickly to a named internal contact or service provider. If money or payment instructions are involved, contact your bank immediately using a known number and follow its fraud instructions. Preserve the message, headers, relevant logs, and a timeline for the investigation; avoid forwarding suspicious attachments unnecessarily.

An authorized administrator should follow the provider’s incident procedure: secure the account and recovery methods, reset credentials as appropriate, revoke active sessions and suspicious application access, and review sign-ins, mailbox rules, forwarding, delegated access, and sent mail. Check whether other accounts or systems were affected. Confirm the attacker’s access has been removed before returning the account to normal use.

Decide in advance who handles customer notification, legal obligations, insurance, and outside support. Maintain and test recovery procedures and backups appropriate to your retention needs. A password reset alone may not end existing sessions or remove malicious rules.

05 / Checklist

Put the essentials in place.

For the business owner

• Name an owner for email security and an incident contact.
• Require MFA and a password manager; confirm that recovery access is protected.
• Verify payment changes through a known independent channel and train staff to report suspicious requests.
• Write down the bank, provider, and support contacts needed during an incident.

For the administrator

• Review privileged access, legacy sign-ins, third-party access, and dormant accounts.
• Inventory senders; configure SPF and DKIM; monitor DMARC before enforcement.
• Enable useful logging, alerts, filtering, and a process for reviewing them.
• Test session revocation, account recovery, mailbox-rule review, and restoration procedures.