6 steps to improve your business email security

Business email security comes down to six controls, and most organizations already pay for the tools in Microsoft 365 or Google Workspace without having turned all of them on. As a Microsoft CSP partner, we set up and tune the protection already included in our clients’ Microsoft 365 licenses.

The threats come from both directions. A “vendor” sends new wire instructions from an account that really is the vendor’s, because their mailbox was taken over first. Or a busy employee replies to an address one letter off from a real client’s, and nobody notices for weeks.

1. Lock down sign-ins with strong MFA

A stolen password is the easiest way into a mailbox. Give every person a long, unique password stored in a business password manager, then turn on multi-factor authentication for every account, including admins and shared mailboxes people sign into.

Not all MFA is equal. CISA says FIDO/WebAuthn (passkeys and security keys) is the only widely available phishing-resistant option. It calls text and voice codes a last resort because of phishing and SIM swap attacks, and warns that push approvals without number matching are open to push bombing. For our clients, admin accounts use phishing-resistant sign-in such as security keys or passkeys, and everyone else uses an authenticator app with number matching.

Then turn off legacy sign-in methods that skip MFA, such as old SMTP authentication used by scanners and apps, or move those devices to a secure relay.

2. Authenticate your domain with SPF, DKIM and DMARC

These three DNS records tell other mail systems which servers may send for your domain and what to do with mail that fails the check. Together they make it far harder for someone to send a convincing fake from yourcompany.com.

• SPF lists the services allowed to send as your domain, including your newsletter tool, CRM and billing system.
• DKIM adds a digital signature that proves a message wasn’t altered.
• DMARC checks that the visible From address lines up with SPF or DKIM, and tells receivers to deliver, quarantine or reject failures.

Microsoft recommends starting DMARC at p=none, reading the reports, then moving to quarantine and finally reject. Every one of our client domains is at p=reject. Mail providers expect authentication now too: Gmail has required bulk senders to authenticate their mail since February 2024 and began rejecting more non-compliant mail in November 2025. Our DMARC guide walks through the rollout.

3. Filter spam, phishing and malware before it reaches staff

Every junk message someone has to read and delete costs a little time, and some of them carry the phishing link that leads to a breach. Every Microsoft 365 mailbox includes built-in anti-spam, anti-malware and spoofing protection. Microsoft 365 Business Premium adds Defender for Office 365 Plan 1, which includes:

• Safe Links, which checks links when they’re clicked as well as when the message arrives
• Safe Attachments, which opens unknown attachments in an isolated environment before delivery
• Impersonation protection for your executives and your domain

Turn on Microsoft’s Standard or Strict preset policies, and give staff a one-click Report button so suspicious mail gets reviewed. Some organizations add a dedicated email filtering service in front of Microsoft 365 for extra layers. Either way, someone should review what’s being quarantined and tune the rules.

4. Encrypt sensitive email and control what leaves

Plenty of email risk starts inside. Someone sends a client file to the wrong “Chris,” forwards a spreadsheet to a personal account to work from home, or replies all with information meant for one person. Departing staff sometimes take data with them on purpose.

• Microsoft Purview Message Encryption lets users send encrypted email to anyone, including Gmail and Outlook.com recipients, and admins can set rules that encrypt automatically based on content.
• Business Premium includes data loss prevention (DLP) for email and files, which can warn or block when someone tries to send things like Social Security or account numbers outside the company.
• Block automatic forwarding to outside addresses, and require approval for exceptions.
• Disable accounts and review mailbox access the day someone leaves.

For healthcare, accounting, legal and nonprofit offices, these controls are part of meeting HIPAA, the FTC Safeguards Rule and confidentiality duties. Our compliance services map them to the rules that apply to you.

5. Train people and verify payment requests

Phishing was the starting point for 16% of breaches in Verizon’s 2026 Data Breach Investigations Report, and AI makes fake messages cleaner and more convincing. Filters catch most of it. Your people catch the rest.

• Run short, regular training with realistic phishing simulations in place of one long annual video. Our post on cybersecurity training for employees covers what works.
• Set a firm rule: any new or changed bank details get confirmed by phone, using a number already on file, before money moves.
• Teach staff to check the real sender address and hover over links, and to report anything odd instead of deleting it.
• Make reporting a mistake easy and blame-free. Early reports limit damage.

Our post on business email compromise explains how these payment scams work.

6. Watch for signs of a compromised mailbox

Attackers who get into a mailbox often stay out of sight, reading mail until an invoice comes along to hijack. Keep software and email apps updated, and have someone review these signals regularly:

• New inbox rules that forward, move or delete messages, especially ones mentioning invoices or payments
• Sign-ins from unexpected countries or at odd hours
• Sent items the user doesn’t recognize, or contacts asking about strange messages from you
• Changes to MFA methods or recovery details

Our email sign-in monitoring watches a mix of signals like these, and it has caught real takeover attempts at our clients. When it flags one, we contain the account within the hour. If you find a compromised mailbox yourself, reset the password, sign the user out everywhere, remove unknown rules and MFA methods, and check whether anyone was sent payment instructions.

Business email security mistakes that undo the work

• Leaving DMARC at p=none, which reports on spoofing and stops none of it.
• Exempting one person from MFA “temporarily,” often the owner or a shared mailbox, and never revisiting it.
• Running Microsoft’s default filtering policies instead of the Standard or Strict presets.
• Letting quarantine pile up unreviewed, so real mail goes missing and junk never gets tuned out.
• Allowing automatic forwarding to outside addresses.
• Training once a year and assuming it stuck.

Checking which of these six are switched on in your tenant takes one conversation. Book a 15-minute call and we’ll go through your email settings with you, the same way our cybersecurity services start with every client.

Related reading: Secure file sharing for business: How to store and send files safely, The Goodbye Gap: An employee offboarding checklist for IT security and Microsoft 365 vs. Office 365 vs. Office 2024: What’s the difference?.