Email remains a major business communication channel and a common route for phishing, malware delivery and business email compromise. Technical controls should be combined with identity security, user reporting, payment verification and incident procedures.
SPF: authorised sending sources
Sender Policy Framework publishes which mail servers are authorised to send for a domain. Maintain one valid SPF record, inventory every legitimate sending platform and keep within DNS lookup limits. Unplanned third-party senders can cause authentication failures or create opportunities for abuse.
DKIM: message signing
DomainKeys Identified Mail adds a cryptographic signature to outgoing messages. Receiving systems retrieve the public key from DNS and verify that signed message components have not changed. Enable signing for each approved sending service and manage selector rotation and key protection.
DMARC: alignment and policy
DMARC evaluates whether SPF or DKIM passes with alignment to the visible From domain. Start with a monitoring policy, review aggregate reports, identify legitimate senders and fix alignment before moving gradually to quarantine or reject. Publish reporting destinations and ensure reports are reviewed.
Layer anti-phishing controls
Use secure email gateway protections, attachment and URL analysis, impersonation detection, external sender indicators and user reporting. Protect mailboxes with MFA, restrict legacy authentication and audit forwarding rules, inbox rules, OAuth grants and delegated access.
Business email compromise controls
Verify bank detail changes and urgent payment requests through a separate trusted channel. Establish dual approval for sensitive transactions. Train staff to report suspicious messages and make the reporting process simple. Email authentication reduces spoofing but cannot prove that a message from a legitimate account is safe.
Incident handling
When a malicious message is reported, identify recipients, remove or quarantine messages where supported, investigate clicks and credential submission, revoke sessions if accounts are compromised and review mailbox rules and audit logs. Preserve evidence and communicate clearly.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
Email security is strongest when domain authentication, mailbox hardening, user reporting and business process controls work together.