How to Run an SMB Email Security Audit
An email security audit is a systematic review of your email system's configuration, access controls, and threat protection. It's not a certification or compliance stamp. It's a snapshot of your current state and a roadmap to
Introduction
An email security audit is a systematic review of your email system's configuration, access controls, and threat protection. It's not a certification or compliance stamp. It's a snapshot of your current state and a roadmap to improve.
Most SMBs never audit email. They assume Microsoft 365 or Google Workspace is secure because it comes from a major vendor. Default configurations are built for broad compatibility, not maximum security.
Run an audit yourself or hire an external auditor. The goal is the same: identify gaps, prioritize risks, and close the critical ones first.
This article covers a basic SMB email audit you can run in a few hours. It covers seven critical areas every SMB should review.
Table of Contents
- What an Email Security Audit Is and Is Not
- Seven Areas to Audit
- SPF, DKIM, and DMARC Configuration
- Spam Filter Configuration
- MFA Enrollment
- Access Control Review
- Email Retention Policies
- Incident Response Readiness
- User Awareness
- After the Audit: Prioritization and Action
- FAQ
What an Email Security Audit Is and Is Not
An audit IS:
A review of your current email system configuration and security controls.
A comparison of your current state against best practices.
A list of gaps, risks, and recommendations.
An action plan for closing the biggest gaps first.
A repeatable process you can run quarterly or annually.
An audit IS NOT:
A certification. Completing an audit does not earn you a compliance badge.
A penetration test. An audit reviews what you have configured. It does not attempt to attack your system.
A security assessment done by experts. A DIY audit is a starting point, not a comprehensive security evaluation. For that, hire professionals.
A fix. An audit identifies problems. It does not fix them automatically. You still have to take action.
Scope of this audit:
This audit covers email configuration, access control, and basic threat protection. It does not cover advanced areas like email forensics, malware analysis, or incident response procedures.
For a more comprehensive audit, work with a professional firm. For a quick internal review to identify obvious gaps, this audit works.
Seven Areas to Audit
A basic SMB audit covers:
- SPF, DKIM, and DMARC configuration
- Spam filter settings
- MFA enrollment
- Access controls and admin permissions
- Email retention policies
- Incident response readiness
- User awareness training
Complete this audit in a single day. Budget two to four hours.
SPF, DKIM, and DMARC Configuration
SPF, DKIM, and DMARC are email authentication protocols that prevent attackers from spoofing your domain.
What to audit:
Check if your domain has SPF, DKIM, and DMARC records in DNS. Log into your DNS provider and look for TXT records starting with "v=spf1", "v=DKIM1", or "v=DMARC1".
SPF record:
An SPF record specifies which mail servers are authorized to send email from your domain. Example: "v=spf1 include:_spf.google.com ~all" means "Google's servers can send email from this domain, nothing else should."
Check that your SPF record includes all servers that send on your behalf: your email provider (Microsoft 365, Google Workspace), email marketing platform (Mailchimp, Constant Contact), transactional email service (Sendgrid, Mailgun).
DKIM record:
DKIM cryptographically signs outbound email so receivers can verify it came from you.
Check that DKIM signing is enabled in your email provider. In Microsoft 365, go to Settings > Domains > DKIM. In Google Workspace, go to Security > Authenticate email > DKIM and enable signing.
You need one DKIM record per domain. If you use subdomains, each needs its own record.
DMARC record:
DMARC tells receiving servers what to do if an email fails SPF or DKIM. You can quarantine, reject, or report.
Create a basic record: "v=DMARC1; p=quarantine; rua=mailto:security@yourdomain.com"
This tells servers to quarantine failed authentication emails and send you daily reports. Over time, strengthen it to p=reject.
How to validate:
Use an online DMARC checker (like MXToolbox) to validate your records.
Audit result:
If all three are configured, pass. If any are missing, add them. Priority: high.
Spam Filter Configuration
Your email system has a built-in spam filter. The question is whether it's configured optimally.
What to audit:
Log into your email admin console. In Microsoft 365, go to Exchange admin center > Protection. In Google Workspace, go to Security > Phishing and malware > Email authentication.
Review your anti-spam policy. It should include:
Bulk complaint level (BCL) threshold set to 5 or lower (lower = more aggressive).
Spam confidence level (SCL) threshold set to 5 or lower.
External email warnings enabled (adds a warning banner to emails from outside your organization).
Advanced phishing settings enabled.
Review your anti-malware policy. It should include:
Malware scanning enabled.
Quarantine suspected attachments.
Block password-protected archives (attackers use these to bypass scanning).
Review your Advanced Threat Protection settings (Microsoft 365 or equivalent in Google Workspace):
Safe Links enabled (rewrites URLs to check them at click time).
Safe Attachments enabled (detonates files in a sandbox).
Campaign detection enabled (finds coordinated phishing campaigns).
Audit result:
If all settings above are enabled, pass. If any are disabled or set to weak values, enable them. Priority: high.
MFA Enrollment
Multi-factor authentication is the single most impactful security control. If you don't have it, enable it now.
What to audit:
In Microsoft 365, open the Microsoft Entra admin center and review each user's registered authentication methods and Conditional Access coverage.
In Google Workspace, go to Security > Enforce login challenges and check whether 2-Step Verification enforcement is enabled.
Count how many users have MFA enabled. Aim for 100%. If you're below 80%, you have a gap.
Check which MFA methods are configured. Authenticator apps and hardware keys are preferred. SMS is weaker but acceptable. If users have no method configured, focus on those.
Audit admin accounts specifically. Every admin (Exchange admin, Global admin, Gmail admin) must have MFA. Non-negotiable.
Audit result:
If all users have MFA, pass. If any user lacks MFA (especially admins), enable it immediately. Priority: critical.
Access Control Review
Who can access your email system? Read other people's emails? Create forwarding rules? These are access control questions.
What to audit:
In Microsoft 365, open the Microsoft Entra admin center, then review Roles and administrators. Are there too many admins?
For each admin, ask: does this person need this permission? If someone left, are their permissions still active?
Best practice: use role-based access control. Have a Global Admin, an Exchange Admin, and a Compliance Admin. Most organizations don't need more than three elevated accounts.
Check delegation rules. Can someone access another person's mailbox? If so, is it documented and justified?
In Microsoft 365, go to Exchange admin center > Mailbox delegation.
In Google Workspace, go to Users and check "Organizational unit" and "Admin privileges" for each user.
Check email forwarding rules. Users can forward all mail to an external address. Is there a policy? Can users create rules or only admins?
Audit result:
If access is restricted to necessary personnel, pass. If there are excessive admins, dormant accounts with access, or suspicious forwarding rules, fix them. Priority: high.
Email Retention Policies
Email retention policies govern how long emails are kept live, when they're archived, and when they're deleted.
What to audit:
In Microsoft 365, go to Compliance > Retention and check if policies are applied.
In Google Workspace, go to Security > Org-wide settings > User email settings and check if retention is configured.
Define your retention policy. Example: "Keep emails live for two years. Archive emails older than two years. Delete archived emails after five years."
Document the policy in writing. Share with your team. Everyone should know how long emails are kept and why.
Check that retention is actually applied. In Microsoft 365, run a retention report. In Google Workspace, spot-check a few mailboxes.
Audit result:
If a policy exists and is enforced, pass. If no policy exists, create and document one. Priority: medium.
Incident Response Readiness
If an email account is compromised or an employee accidentally forwards sensitive information, what happens? Do you have a plan?
What to audit:
Create a written incident response plan for email. It should include:
Who do you call if there's a breach (IT, Security, Management)?
How quickly do you respond (within an hour, same day)?
What do you do if an account is compromised (change password, check mailbox rules, export email, review access logs)?
How do you notify affected users?
Do you involve law enforcement?
Do you involve your cyber insurance carrier?
You don't need 50 pages. A one-page checklist is enough.
Test your plan. Run a tabletop exercise. Walk through what would happen if an account was compromised. Does everyone know what to do? Are there gaps?
Check that you have investigation tools. Can your IT team access mailbox logs in Microsoft 365? Search for emails with specific keywords? Export a mailbox for forensic analysis?
Audit result:
If a plan exists and you've tested it, pass. If no plan exists, create one. Priority: medium.
User Awareness
User awareness is the human element of email security. No filter catches all phishing. Employees are the last line of defense.
What to audit:
Do you send regular phishing simulations to staff? Best practice is monthly or quarterly.
Do you provide training on spotting phishing? One annual session minimum. Quarterly is better.
Do you have a way for employees to report phishing? Can they forward suspicious emails to security or do they just delete?
Track phishing report metrics. How many phishing emails are reported monthly? Is the rate increasing or decreasing (increasing is good)?
Check if your email system has anti-phishing features enabled. But also check if employees understand when to trust a warning banner.
Audit result:
If you have a phishing awareness program and employees are engaged, pass. If you have no program, start one. Priority: high.
After the Audit: Prioritization and Action
After completing the audit, you have a list of gaps. Prioritize them.
Risk levels:
Critical: impacts your ability to respond to breaches or protect against common attacks. Examples: no MFA, no anti-malware, no audit logging.
High: leaves you vulnerable to common attacks. Examples: weak spam filter settings, excessive admin access, no retention policy.
Medium: improves security but isn't an immediate threat. Examples: SPF/DKIM/DMARC missing, no incident response plan, no user awareness training.
Low: nice to have but low risk. Examples: email retention longer than necessary, redundant tools.
Action plan:
Fix all critical gaps in the next 30 days.
Fix all high gaps in the next 90 days.
Fix all medium gaps in the next six months.
Review low gaps annually.
Assign owners. Who fixes each gap: your IT team, security consultant, or email vendor?
Set deadlines and stick to them.
When to Bring in an Outside Auditor
You can run a basic audit yourself. When should you hire professionals?
Bring in professionals if:
You don't have IT staff with email expertise. Professionals can review without relying on your team.
You're preparing for a compliance audit (HIPAA, PCI DSS, SOC 2). Professional assessments are more defensible.
You've experienced a security incident and need to understand what went wrong.
You have multiple email systems (on-premises and cloud, multiple providers).
You have complex compliance requirements beyond standard PIPEDA.
DIY is fine if:
You have at least one IT staff member who understands email and authentication protocols.
You're not facing a compliance audit in the next few months.
You have a simple setup (one provider, one system).
You want to identify obvious gaps without a comprehensive assessment.
How Often to Audit
Minimum frequency: Once per year.
Recommended frequency: Every six months.
After an incident: Within one week of discovering the incident.
After infrastructure changes: When you migrate email providers, add new systems, or change major configurations.
When onboarding new email tools: When you add spam filtering, archiving, or other email security tools.
FAQ
Q: How long does an audit take?
A: A basic DIY audit takes two to four hours. A professional audit takes one to two weeks depending on complexity.
Q: Do we need to hire an auditor, or can we do this ourselves?
A: If you have IT staff, do it yourself first. That takes a few hours. If you need a second opinion or a more comprehensive review, hire a professional.
Q: What should we do with the audit report?
A: Distribute it to management and the IT team. Discuss the findings in a meeting. Create an action plan with owners and deadlines. Track progress over time.
Q: Are audit findings confidential?
A: Yes. If you hire an external auditor, the report is privileged information (attorney-client privilege in some cases). Do not share it outside your organization.
Q: What if we fail the audit?
A: That is normal. Most SMBs discover gaps in their first audit. That is the whole point. Now you have a roadmap to improve. Start with critical gaps and work your way through.
Q: How does an audit differ from a penetration test?
A: An audit reviews your configuration and settings. A pentest actually tries to break in. A pentest is more aggressive and more expensive. Most SMBs start with an audit, then do a pentest once basic controls are in place.
Q: Can we use this audit for compliance purposes?
A: This audit is a starting point, not a compliance assessment. If you need to prove compliance to regulators or customers, hire a professional who can issue a compliance report or certification.
Q: What if the audit finds that our email system is insecure?
A: That is valuable information. Now you know what to fix. Develop an action plan, prioritize by risk, and close gaps systematically. Do not panic. Most email breaches happen because of known, preventable issues. Fix them and your risk drops dramatically.
Conclusion
An email security audit takes a few hours and identifies the gaps most likely to be exploited. Even a simple self-guided audit reveals problems: admins who shouldn't have access, weak spam filter settings, MFA not enabled on critical accounts.
Run your first audit in the next 30 days. Complete the seven sections. List your gaps. Prioritize by risk. Create an action plan. Follow through on critical items in the next month. You'll be significantly more secure.
As you improve, audit every six months. Each audit builds on the last. In a year, your email security posture will be substantially stronger.
If you need help or want a professional assessment, start with Quantm's free 15-minute M365 Posture Review. We can identify the most important identity, email, and response-readiness questions to investigate next.
Book your free M365 Posture Review to get a practical starting point for your next steps.