Email Security Best Practices: How to Set Them Up

Email security best practices work best in a set order. This guide gives nine steps, each with a yes/no check that it worked. It is written for an IT manager at a firm in India or the GCC. Microsoft 365 serves as the worked example. Each step states the control neutrally first, and that statement holds on any platform. The last step turns your choices into a short email security policy. This order is Signisys’ own. The NCSC’s email security and anti-spoofing guidance (UK guidance, 7 October 2019, written for cyber security professionals and the public sector) supplies the individual controls, not the sequence. It is not the NCSC’s own implementation plan. This guide covers email only, not chat, shared files or tool choice. While a passing check shows a setting works as intended, it does not show that the firm is safe.

Email Security Best Practices in Short: Nine Steps, in Order

The nine steps fall into three groups: sign-in; stopping fake mail from your domain; and filtering, forwarding and people. Each gets its own section below.

Email Security Best Practices, Steps 1 and 2: Protect the Sign-In

These two settle who can open a mailbox and what an administrator account can do.

Email Security Best Practices, Step 1: Put a Second Check on Mailbox Sign-In

Ask for a second check every time someone signs in to a mailbox. Also close the older sign-in routes that have no way to ask for one. Multi-factor authentication means proving who you are with something more than a password. The NCSC’s phishing guidance is UK guidance, reviewed 13 February 2024 and written for cyber security professionals, large, small and medium-sized organisations and the public sector. With a second factor, it says, an attacker holding only a stolen password does not get into the account.

In Microsoft 365: Microsoft Entra security defaults switch on a set of basic controls (as of November 2026). The set covers MFA registration, MFA for administrators and a block on legacy authentication. Legacy sign-in means older mail protocols such as IMAP, POP3 and SMTP. In the Microsoft Entra admin center, go to Entra ID > Overview > Properties > Manage security defaults. Look at the setting before you change it, because tenants created on or after 22 October 2019 might already have it on. Depending on your licences, Microsoft says security defaults are probably not right for you and points to Conditional Access. Before enabling them, confirm that administrators and devices that send mail do not rely on older protocols. Your email security policy should say who must use the second check and which old routes stay closed.

Step 2: Give Administrators Their Own Accounts and Remove Leavers

Keep administrator access to the few people who need it, on accounts used for nothing else. Also end access for people who leave. Privileged access means accounts that can change settings or reach other people’s data. The NCSC says the damage an attacker can cause is proportionate to the privileges of the credentials they steal. It advises against using administrator accounts to check email or browse the web. It also says to review privileges “regularly” (its word, not an interval we set) and revoke them when no longer needed. Accounts of people who leave or move, it adds, need removing or suspending. Record the administrator list and the leaver rule in your email security policy.

In Microsoft 365: the security defaults page lists the administrator roles that must do MFA at every sign-in once security defaults are on. The list includes roles such as Global Administrator, Exchange Administrator and Security Administrator. It also recommends separate accounts for administration and everyday tasks. The preset security policies page says to limit Global Administrator to emergency scenarios or to cases where no other role will do. Use the role that fits the task.

Signisys puts this step second because the later steps change settings that administrators control.

Email Security Best Practices, Steps 3 to 5: Stop Anyone Faking Your Domain

These three make it hard for fake mail to go out as your domain, and they share one DNS host.

Step 3: Publish SPF for Every Domain You Own

Publish one SPF record for each domain you own, parked ones included, listing every service allowed to send as that domain. SPF is a DNS record listing the servers trusted to send mail for a domain. A parked domain is one that sends no mail. Our encyclopedia page explains what the three records mean in plain words. The NCSC says to protect all of your organisation’s domains, and that SPF publishes the sending addresses trusted for the domain. Of the three domain steps, this is the first, and it depends on a full list of your senders.

In Microsoft 365: no Microsoft admin portal handles SPF, so the TXT record goes to wherever the domain’s DNS lives. Microsoft’s SPF page shows the record as v=spf1 include:spf.protection.outlook.com -all. It recommends the hard-fail ending -all, because it also recommends DKIM and DMARC. Use one SPF record per domain or subdomain, because two records cause a permanent error. Keep to no more than 10 DNS lookups (Microsoft: more than 10 gives a permanent error). Microsoft suggests a subdomain for senders outside your control, such as bulk mail, and v=spf1 -all for parked domains.

Email Security Best Practices, Step 4: Sign Your Mail with DKIM

Turn on DKIM signing for each domain that sends mail, so receivers can check that your domain signed the message. DKIM is a digital signature added to outgoing mail and checked against a public key published in DNS. The NCSC says DKIM lets you cryptographically sign mail to show it is from your domain. It also says DKIM can support forwarded mail.

In Microsoft 365: Microsoft says no DKIM signing occurs for outbound mail from custom domains, so you set it up yourself. Create two CNAME records (selector1 and selector2) at the DNS host, using the values shown in the Microsoft Defender portal or Exchange Online PowerShell. The signing toggle in the Defender portal comes last (Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM tab). Microsoft says detecting the new records takes a few minutes or possibly longer. Parked domains get no DKIM record, but each sending subdomain needs its own set-up.

Signisys puts DKIM here because DMARC reads the SPF and DKIM results.

Step 5: Move DMARC from Watching to Rejecting

Publish DMARC at none to watch the reports and fix what they show. The later stages, quarantine and reject, follow below. DMARC is a DNS policy telling receivers what to do with mail when it fails the SPF and DKIM checks. It also asks for reports. An aggregate report summarises who sent mail as your domain.

The stages are the NCSC’s (UK guidance, 7 October 2019). Every domain, parked ones included, starts at none.

In Microsoft 365: Microsoft’s DMARC set-up page (updated 17 July 2026) puts the record in a TXT record named _dmarc at the DNS host. The form is v=DMARC1; p=<none|quarantine|reject>; pct=<0-100>; rua=mailto:.... Microsoft recommends a gradual approach: a low-volume subdomain to start, the parent domain last, and pct moved in steps (10, 25, 50, 75, 100). Subdomains inherit the parent record unless they have their own. For parked domains Microsoft suggests v=DMARC1; p=reject;, whereas the NCSC starts every domain at none; pick one for each parked domain and record the choice in your email security policy.

Email Security Best Practices, Steps 6 to 9: Filter, Contain and Report

These four deal with mail that reaches the firm, mail that leaves it, and the people who sit between.

Step 6: Keep Filtering On for Every Mailbox

Check that spam, phishing and malware filtering is on for every user, and set it deliberately. The NCSC (phishing guidance, layer 1) says to filter or block mail before it reaches users. It also says to honour the sender’s DMARC policy: if it says quarantine or reject, do as requested when validation fails. For a cloud email provider, check that its filtering is sufficient and on by default for all users. The NCSC gives the trade-off. Filtering to junk leaves users a large volume to manage, while blocking can lose legitimate mail. You may have to change the rules over time. This is the step where you choose that trade-off.

In Microsoft 365: preset security policies apply Microsoft’s recommended threat settings at two levels, Standard and Strict. Microsoft says virtually all of their settings are not configurable. Standard and Strict are off until you turn one on. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies. Turn Standard or Strict on, and pick the recipients: all users, or chosen users, groups or domains. Depending on your licences, some protections apply only to eligible users. Microsoft’s own test: a message identified as spam (not high-confidence spam) goes to the Junk Email folder under Standard and to quarantine under Strict.

Email Security Best Practices, Step 7: Decide Who May Forward Mail Outside

Decide which mailboxes, if any, may forward mail automatically to an outside address. Switch it off for the rest and keep a list. In Signisys’ view, automatic forwarding copies mail to an address the firm does not control. Your email security policy should name who may forward.

In Microsoft 365: the outbound spam policy has an Automatic forwarding rules setting (Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-spam). Its three values are Automatic – System-controlled (the default), On and Off. Microsoft says System-controlled was equivalent to On when introduced. In 2021 it changed to Off for new organisations and for existing ones not actively using forwarding, while existing users can remain equivalent to On. Because behaviour can differ by organisation, Microsoft says to set On or Off. Off blocks all automatic external forwarding, including Inbox rules and mailbox (SMTP) forwarding, and leaves forwarding between internal users alone (as of November 2026).

Step 8: Make Reporting Easy and Check Unusual Requests

Give people one clear way to report a suspect message, answer every report, and confirm important requests through a second channel. This step depends on people more than on settings, and your email security policy should name the reporting address.

The NCSC (phishing guidance, layer 2) asks for a reporting process that is clear, simple and quick to use, with quick feedback and no blame. It says not to reprimand users who struggle to recognise phishing. For important requests such as payment changes, it advises verification by a second type of communication, such as a phone call or in-person confirmation. It also suggests counting how many people reported a phishing email as well as how many clicked. Our entries on phishing and business email compromise define both terms.

The NCSC also cautions that no training package, including phishing simulations, can teach users to spot every phishing attempt. It adds that simulations can create legal risk and erode trust between employees and security. It says to check with HR first. This guide sets no interval and recommends no simulation.

In Microsoft 365: this step needs no platform route in this guide.

Signisys puts reporting after the technical steps because people see what the filters let through.

Email Security Best Practices, Step 9: Write a Short Email Security Policy and Re-Check

Write the choices from steps 1 to 8 on one page and name an owner. An email security policy, in this guide, is a one-page record of decisions, not a template.

The page records who must use the second check and which old sign-in routes stay closed. It also records who may hold administrator access, and which domains and senders you authorise, with the DMARC stage each has reached. It also holds the filtering level, who may forward outside, and where staff report and who answers. Written down, these are the answers to the nine checks, kept in one place: your email security policy.

The policy also names its owner, where it lives and its review date. The review is Signisys’ own step, while the NCSC’s continuous-improvement page (UK, 7 October 2019) says to keep SPF and DKIM current whenever sending services come and go. It also says to use report tools to spot new senders. This guide sets no interval.

In Microsoft 365: this step needs no platform route in this guide.

What This Guide Does Not Cover, and Where to Go Next

This guide covers email only: the sign-in, the sending domain, filtering, forwarding, reporting and a written policy. It leaves out chat, shared files and meetings, message encryption, data loss prevention, archiving, the risks themselves, a full tick-list, tool choice, and Indian or GCC rules. For the choice of tool, read built-in protection or a dedicated layer. TLS in transit is the NCSC’s second aim. Where a cloud provider hosts the email, the NCSC says it will likely already be in place, so confirm it with your provider (UK guidance, 7 October 2019). For the threats these steps answer, read the ways business email gets attacked.

If a check fails and nobody owns the fix, take it to the owner named in your email security policy. Once the nine steps are in place, a full tick-list of yes-or-no tests can re-test them. Get specialist help if a check is not possible to run, or if DMARC reports show a sender nobody can name.

These email security best practices are a starting order of work. For the wider picture, see how to secure business email and collaboration tools, the same order of work for devices and an office network and tests for ransomware prevention, backup and recovery.

Signisys helps organizations protect devices, networks and remote access with coordinated endpoint, network and zero trust security, and the solution includes email and collaboration security: protection against phishing, malware and data leaks in everyday tools. The exact scope is agreed for each engagement. We provide this through our Endpoint, Network and Zero Trust Security solution and our Cybersecurity Services page.

Email Security Best Practices FAQ