Email security for your business
The five settings that stop most email attacks, in plain English.
Most email break-ins use the same few doors: weak sign-in, no second factor, and settings nobody has reviewed since the account was set up. Close those doors and the common attacks, from password theft to business email compromise, stop working.
Email security best practices: the five settings that matter
Business email compromise, the attack these settings block
Business email compromise is the criminal reading or sending from a real mailbox: watching invoices, then striking with changed bank details at the right moment. It does not need malware, just one weak sign-in. The five settings above are exactly what shuts it out.
What we set up for clients
Every business on our managed support gets these settings configured, checked and monitored, with sign-in alerts watched by our team as part of identity protection. If you would rather check your own setup first, start with multi-factor authentication and work down the list.
Settings stop the machines; people stop the rest. Read our phishing guide for spotting the attacks that still get through.
Frequently asked questions
Is Microsoft 365 email secure out of the box?
The bones are good, but the defaults leave gaps: multi-factor authentication is not always enforced, old sign-in methods are often still on, and nobody is watching the sign-in reports. Secure email comes from configuration, not the licence.
What are SPF, DKIM and DMARC in plain English?
Three DNS records that let receiving email systems check a message really came from your domain. Without them, anyone can send email that appears to be from your business.
Do we need email encryption?
For most day-to-day email, transport encryption is already on. If you send sensitive personal or financial data, Microsoft 365 can encrypt individual messages so only the named recipient opens them; we set this up when a business handles regulated data.
How would we know if someone is already in a mailbox?
Warning signs include rules you did not create, messages in sent items nobody sent, and sign-in alerts from unusual places. If any of those appear, call us on 01273 806211.
Get new guides by email
One short email when a new guide goes live, and nothing else.