Email Security – Best Practices

Email remains one of the most critical attack vectors in modern IT environments. Phishing, spoofing, malware, and ransomware campaigns often originate via email, targeting unsuspecting users. As IT professionals, it’s our responsibility to protect organizational email systems, whether hosted on-premise, in the cloud, or in a hybrid configuration.

A compromised email system not only jeopardizes sensitive business information but also threatens compliance, SLA adherence, and overall organizational reputation. Implementing a layered approach to email security is essential, combining technical safeguards, policy enforcement, and user education.

Start With DNS: The Foundation of Email Security

Many IT teams overlook DNS, yet it is foundational for email authentication and deliverability. Critical DNS settings include:

1. Reverse DNS (PTR) Records

A reverse DNS lookup ensures the IP address sending the email matches the sending domain. Many receiving email servers check PTR records to validate authenticity. A mismatch often results in rejected or flagged emails.

Real-world tip: When migrating to a new email server or public IP, always verify the PTR record and ensure it aligns with your sending domain to prevent email delivery issues.

2. SPF (Sender Policy Framework)

SPF is a DNS TXT record that defines which servers are authorized to send emails for your domain. Without SPF, attackers can spoof your domain, increasing phishing risks.

Best practices:

• Include all legitimate email-sending services (on-premise servers, cloud providers, marketing platforms).
• Avoid overly broad SPF rules, as they can lead to false positives and rejected emails.

3. DKIM (DomainKeys Identified Mail)

DKIM uses cryptographic signatures to validate that an email originates from your domain and has not been altered. This improves deliverability and builds trust with recipient servers.

Implementation advice:

• Ensure your DKIM keys are rotated regularly.
• Verify alignment between DKIM and SPF to maximize security.

4. DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC tells receiving servers how to handle emails failing SPF or DKIM checks. Policies can include:

• none – monitor without action
• quarantine – send suspicious emails to spam
• reject – block emails failing checks

Pro tip: Start with a none policy to monitor, then gradually move to quarantine or reject as confidence increases. Use DMARC reports to identify unauthorized senders.

Implement Robust Spam and Malware Filtering

A modern cloud-based or on-premise email security solution is essential for filtering spam, malware, and phishing attempts.

Cloud-based solutions (Microsoft 365 ATP, Mimecast, Proofpoint):

• Reduce load on internal infrastructure
• Scale easily for growing organizations
• Include advanced threat detection like sandboxing and link scanning

Key outbound controls:

• Prevent infected machines from sending spam via rate limiting or RAID control
• Enable geo-IP filtering to block emails from high-risk countries
• Implement content filters to block sensitive data (credit card numbers, personal information)

Example: During a ransomware outbreak, I’ve seen cloud spam filters prevent hundreds of malicious emails from reaching end users, significantly reducing the risk of compromise.

User Education: The Human Firewall

Even with technical protections in place, user behavior is often the weakest link.

Best practices:

• Educate users to inspect sender addresses and hover over links before clicking
• Discourage posting work emails on public websites or unverified services
• Train users to identify suspicious attachments and phishing attempts

Real-world observation: Organizations that conduct quarterly phishing simulations see a measurable drop in click-through rates and report an increase in reported suspicious emails.

Office 365 and Exchange: Leveraging Built-in Security

Office 365

Microsoft provides Basic and Advanced Threat Protection (ATP):

• ATP features: Link scanning, sandboxing, anti-phishing, anti-spoofing
• Licensing: E5 plan includes ATP; E3 users can add ATP for ~$2/mailbox/month

Recommendations:

• Enable multi-factor authentication (MFA) to reduce credential compromise
• Configure mail flow rules to prevent sensitive data leaks
• Regularly review audit logs for suspicious login attempts

Exchange On-Premise

On-premise Exchange servers require:

• Correct firewall rules (allow email traffic only on port 25 for legitimate servers)
• Optional anti-spam and malware agents for additional protection
• Regular patching and updates to avoid vulnerabilities

Tip from experience: Combine SPF, DKIM, DMARC, and a dedicated anti-spam gateway for maximum protection, especially if email is exposed to external networks.

Layered Security Approach: Beyond Basic Protections

Email security is not just a single solution but a layered defense strategy:

1. Authentication: SPF, DKIM, DMARC
2. Filtering: Spam, malware, and outbound data controls
3. Monitoring: Audit logs, DMARC reports, and unusual activity detection
4. User Awareness: Phishing simulations and security training
5. Incident Response: Predefined procedures for compromised accounts

Real-world insight: In an enterprise I managed, implementing all five layers reduced phishing-related incidents by over 70% in six months, demonstrating the value of a multi-layered strategy.

Continuous Review and Improvement

Email security is not a “set-and-forget” process. Threats evolve daily, so IT teams must:

• Regularly review SPF, DKIM, and DMARC settings
• Update spam filtering policies to adapt to emerging threats
• Track failed delivery and rejection reports to identify misconfigurations
• Conduct annual user awareness refreshers to reinforce safe behavior

Pro tip: Use automated reporting tools to generate monthly summaries for management, highlighting trends in spam, phishing, and system compliance.

Email security is a daily operational responsibility for IT professionals. By combining technical safeguards, policy enforcement, and user education, organizations can mitigate threats and maintain high levels of trust and productivity.

Key takeaways:

• Start with DNS-based authentication (SPF, DKIM, DMARC)
• Implement robust inbound and outbound filtering
• Educate users regularly on phishing and safe email practices
• Leverage Office 365 ATP or equivalent tools for advanced protection
• Monitor, report, and continuously refine your email security posture

By following these best practices, your organization can stay ahead of evolving threats, maintain compliance, and ensure secure, reliable email communication for all employees.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.