Email Security Basics for Small Businesses
A practical email security baseline covers domain authentication, MFA, threat policies, privileged access, reporting, endpoint protection, and response ownership.
Email security basics are the controls that reduce common compromise paths and make incidents easier to detect and contain. For a small business, the baseline should include domain authentication, strong sign-in protection, configured threat policies, limited administrator access, user reporting, endpoint protection, logging, and a written response procedure.
The baseline is not a product list. Each control needs an owner, a configuration standard, and evidence that it is operating.
Authenticate your sending domains
SPF identifies systems authorized to send for a domain. DKIM signs outbound messages so recipients can verify their integrity. DMARC tells recipients how to handle messages that fail alignment and provides reports that help the domain owner find legitimate and unauthorized senders.
Configure all three for each active, parked, and sending domain. Inventory marketing, invoicing, CRM, ticketing, and application services before increasing DMARC enforcement. A rushed policy can block legitimate mail.
Protect every account, especially administrators
Require MFA for email, file storage, and remote access. Prefer phishing-resistant methods where the platform and business allow them. Start with administrators and users who handle payments or sensitive records, then close all remaining enrolment gaps.
CISA's small-business MFA guidance recommends the strongest available method and identifies email codes as the weakest common option.
Use separate administrator accounts, least privilege, and a small number of emergency accounts. Review role assignments and authentication methods on a schedule.
Configure email threat policies
Review anti-spam, anti-malware, anti-phishing, impersonation, Safe Links, Safe Attachments, quarantine, and user-reporting settings supported by the current licence. Do not assume every feature is enabled because it appears in the admin portal.
Microsoft's business email and collaboration security guidance provides a current configuration path for Microsoft 365.
Make suspicious messages easy to report
Employees should use a supported report button or documented workflow. Avoid asking them to forward suspicious mail to a shared inbox because forwarding can change message context and expose another person to the content.
Define who reviews reports, expected response times, and what happens if someone clicked, entered credentials, approved MFA, opened a file, or sent money.
Protect devices and business actions
A malicious message may lead to activity on a laptop or phone. Maintain endpoint protection, supported operating systems, application updates, browser controls, and device-compliance rules. For payment and account changes, require independent verification through a known channel.
Keep the evidence needed for response
Confirm that the response owner can access message trace, audit logs, sign-in records, mailbox rules, forwarding settings, OAuth grants, endpoint alerts, and retention settings. Licence level affects the depth and duration of evidence, so document the actual capability rather than assuming it.
Baseline checklist
| Area | Baseline evidence |
|---|---|
| Domains | SPF, DKIM, and DMARC records plus sender inventory |
| Identity | MFA coverage, authentication methods, role assignments |
| Threat policy export or screenshots, quarantine ownership | |
| People | Training record and report-phishing workflow |
| Endpoints | Device inventory, protection status, alert owner |
| Response | Current contact list, containment steps, test record |
These basics address several common email threats but they still require maintenance. Use the SMB email protection guide as the program anchor, then request a review of your Microsoft 365 security posture to compare the baseline with the tenant's actual state.