An email security checklist is a list of yes or no tests that show whether your email setup does what you think it does. This one has 15 checks, each with the evidence to keep and a pass test, as well as a score out of 30. An IT manager, IT head or business owner at a firm in India or the GCC can use it on the email setup they already run. It is a self-check, not an audit, a set-up guide or a certificate, and it does not explain what email security covers. The guidance behind it is from the UK’s National Cyber Security Centre (NCSC). This article makes no claim about Indian or GCC rules. The checks are all on this page, but there is no spreadsheet or PDF to download.
Last reviewed 2026-11-01 by Manish Sharma.
Email Security Checklist: The Short Answer
The checklist has 15 checks in six groups. Each one gives the evidence to keep as well as a yes or no pass test.
Key Takeaway A check earns its mark when a colleague who did not configure the control can reproduce the result, and the date is on file.
The six groups are:
- Sign-in and admin accounts (checks 1 to 3)
- Sender records and mail in transit (checks 4 to 6)
- Filtering attachments and links (checks 7 to 9)
- Forwarding and file sharing (checks 10 and 11)
- People and reporting (checks 12 and 13)
- Detection and response (checks 14 and 15)
The groups, the pass tests and the marks are Signisys’ own working method, built on NCSC guidance. Where the NCSC states something, the sentence says so. We label anything else “our check” or “our pass test”, and nothing here is a standard. The checklist does not cover other systems, such as your network or your servers.
How to Score the Email Security Checklist
Mark each check Pass (2 points) when the test is met and dated evidence is on file, Partial (1 point) when the test is met for only some mailboxes, domains or systems or the evidence is missing. Fail (0 points) means the test is not met. If you have not run a check, it scores 0. The maximum is 30.
This checklist sets no target total. Read the Fails group by group, because a good total can hide a group where every check failed.
Where a test says sample, draw three accounts from the full list and record their names, so a second person can repeat the test. If a check does not apply to your firm, such as check 11 when no files are shared by link, mark it not applicable. Lower the maximum by 2 for each one.
Save every result in a single dated folder, including who ran the test. In our view, someone other than the person who set up the control should run it.
A full score is not a promise of safety. The NCSC’s guidance on phishing (UK, reviewed February 2024) states: “Some phishing attacks will always get through”. The checks show that your controls are in place and can be shown, which is a different thing from nothing arriving. For the routes by which a message does arrive, read how business email gets attacked.
Email Security Checklist, Checks 1 to 3: Sign-In and Admin Accounts
This first group of the email security checklist tests who can sign in and with what rights. The NCSC’s phishing guidance is UK guidance aimed at staff who design and implement defences for medium to large organisations, but your firm may be smaller. Every pass test is ours.
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 1: Every mailbox needs a second step to sign in | The sign-in policy, dated, including the names of the three sampled accounts | Yes, if three accounts picked by chance and every administrator account ask for a second step at sign-in |
| Check 2: Administrator accounts are few, named and kept away from daily mail | The dated administrator list, including an owner and a reason for each | Yes, if each administrator has a separate account for mail and browsing, and the list matches the roles the mail system shows |
| Check 3: Leavers’ accounts are removed or suspended when they leave | The dated HR leaver list beside the account list, including the names of the sampled leavers | Yes, if three leavers picked from the last three months show no working sign-in and no shared-mailbox access, or all of them if fewer than three left |
On check 1, the NCSC says a second factor means an attacker can’t access an account using just a stolen password; the sample and the administrator rule are ours. For check 2, the NCSC says administrator accounts should be limited and not used to check email or browse, while the separate account and the match against roles are ours. Check 3 rests on the NCSC advice to remove or suspend accounts when they are no longer used; the three-month period and the shared-mailbox rule are ours.
Email Security Checklist, Checks 4 to 6: Sender Records and Mail in Transit
The next group tests the records that tell other servers who may send mail for your domains. SPF lists the servers allowed to send, DKIM signs outgoing mail, and DMARC tells receiving servers what to do if mail fails those two checks. TLS protects mail while it is in transit.
The NCSC’s email security and anti-spoofing guidance is UK guidance for cyber security professionals and the public sector. As of its October 2019 review, it aims at “making it difficult” for fake emails to be sent from your domains. The phishing guidance (February 2024) says the same controls “make it harder” for email from your domains to be spoofed.
Checks 4 and 5: Sender Records
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 4: Every domain you own is listed and has anti-spoofing records | The domain list matched to the registrar account, as well as a dated lookup result for each domain | Yes, if every domain on the registrar account is on the list and each shows SPF and DKIM results |
| Check 5: A DMARC policy is in place and someone reads its reports | The DMARC record for each domain, dated, including a note from the latest report review with the reader’s name | Yes, if every domain has a policy asking receivers to quarantine or reject failing mail and the review note is dated |
For this check only, our rule scores a record that asks only for monitoring as Partial. Check 4 rests on the NCSC advice to protect all your domains, including where you use a cloud email provider. Check 5 rests on its point that DMARC sets how receiving servers handle failing mail and also generates reports. The registrar match is ours, and so is the choice of quarantine or reject as the Pass mark.
A record that exists is not the same as a policy that is enforced. This is our reading: a monitoring-only record shows you the failing mail, but it does not ask receivers to hold or reject it.
Check 6: Mail in Transit
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 6: The mail service can send and receive using TLS | A dated test result for each mail domain, including the name of the test or report it came from | Yes, if the result shows the service can both send and receive using TLS |
The NCSC anti-spoofing guidance says the service should be capable of sending and receiving mail using TLS. The dated result is our evidence rule.
Checks 7 to 9: Filtering Attachments and Links
This group of the email security checklist tests settings that decide what reaches a mailbox and what a click can reach. It says nothing about what any tool does or does not catch.
Checks 7 and 8: Filtering and the Sender’s DMARC Policy
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 7: Filtering for spam, phishing and malware is on for every user | The dated filter policy, including who it covers | Yes, if the policy covers every user mailbox, including shared and service mailboxes, and three sampled mailboxes show it on |
| Check 8: Mail from a domain with a strict DMARC policy is handled as that sender asks | The setting, as well as the result of one test | Yes, if the setting is on and a test message from a test domain you control, published with a reject policy and failing its checks, is rejected or held and does not reach an inbox |
For check 7, the NCSC phishing guidance says to check that your provider’s filtering is sufficient for your needs and switched on by default for all users. For check 8, it says to honour the sender’s DMARC policy when it says quarantine or reject. The shared-mailbox rule, the samples and the test message are ours.
Check 9: Attachments and Known-Bad Websites
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 9: Risky attachment types are held or blocked, known-bad websites are set to be blocked, and the choice is written down | The rule list, including an owner and a review date, and the web-filter block setting | Yes, if a harmless test file of a held type is held or blocked, the web filter is shown set to block sites known to host malware or phishing, and the rule list names who reviews it |
For check 9, the NCSC phishing guidance lists attachment types and malware detection among the filtering techniques, notes that filtering and blocking each have a downside, and says the rules may need adjusting over time. It also suggests a proxy service to block known malware and phishing sites. The test file, the web-filter evidence and the named reviewer are ours. In our view a filter does not replace a process for payment requests, which check 13 covers.
Email Security Checklist, Checks 10 and 11: Forwarding and File Sharing
In this part of the email security checklist, the NCSC pages we read do not set out either check. Both are our checks. The NCSC mentions file sharing only as one example of changing a process: sharing files through an access-controlled cloud account rather than as attachments.
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 10: Automatic forwarding outside the firm is controlled | The dated list of every mailbox that forwards to an outside address, including an approver and a reason for each, and the setting that controls new forwards | Yes, if each listed forward has an approver, and a test account’s attempt to set a new outside forward is stopped or sent for approval |
| Check 11: Files shared by link are limited and listed | The default link setting, as well as the list of files shared outside the firm | Yes, if the default link works only for named people, and three sampled outside shares each show an owner and a review date |
If your firm shares no files by link, mark check 11 not applicable and lower the maximum by 2.
Key Takeaway Where a pass test asks for a test message or a test account, keep the dated result of that test as the evidence.
Checks 12 and 13: Staff Reports and Payment Requests
These two checks test a process, not a filter. The NCSC treats training as one layer among several. Its phishing guidance says no training or simulation can teach staff to spot every phishing email, and that blaming users for clicking does not work.
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 12: Staff have a simple way to report suspect mail, and they get a reply | The report route as staff see it, a log of reports including dates and replies, and the written note saying that reporting after a click is welcome | Yes, if the route reaches a mailbox a named person reads, three sampled reports show a reply, the note exists, and any click summary you keep also counts reports |
| Check 13: Payment, bank-detail and payroll changes are confirmed through a second channel | The written rule, as well as the confirmation record for three recent changes | Yes, if the rule names the channels and each sampled change shows a confirmation made through a number or system already on file |
Check 12 is about phishing reports reaching someone who acts on them. The NCSC asks for a report route that is clear, simple and quick, with quick feedback and no blame. It also says to measure how many people reported as well as how many clicked. The sample and the named reader are ours.
For check 13, the NCSC says to verify important email requests through a second type of communication, such as a phone call. The scope (payments, bank details and payroll), “already on file” and the sample are ours.
Checks 14 and 15: Alerts and a Practised Response
The last group asks whether you would notice a compromised mailbox, and whether you would know what to do next.
| Item | Evidence to keep | Pass test |
|---|---|---|
| Check 14: A new mail forwarding rule raises an alert that a named person receives | The alert setting, who receives it, as well as a dated test | Yes, if a test account that creates a forwarding rule produces an alert to the named person |
| Check 15: A compromised-mailbox response is written down and has been practised | The one-page plan, as well as a dated note of the practice | Yes, if the plan names who resets passwords, who removes the attacker’s rules and who tells staff, says how staff report when their own device is unusable, and the practice note is dated within the last 12 months |
On check 14, the NCSC recommends security logging to pick up incidents users are not aware of. The specific alert and the test are our check. On check 15, the NCSC says users should know how to report even if their device is compromised. It also says incident plans should be practised before an incident. The mailbox-specific tasks and the 12-month window are ours, not the NCSC’s.
From Email Security Checklist Score to Fix List
Tally the Fails in each group before you fix anything. The order below is our view, not a standard. Start with group 1, sign-in and admin accounts, followed by check 13, which is a process rule. Next come group 2, group 3, and then groups 4, 5 and 6. A Partial sits after the Fails in the same group.
For each failed check, write the owner, the fix and a date for the re-test in one table. Fixing a failed check is a separate job from finding it, and this page does not explain set-up steps. For those, follow the nine set-up steps, each with its own check.
Set a date for the next run of the checklist and file the result with the evidence. A dated result from this run gives you something to compare against when you repeat the checklist.
When a fixed check is re-run, record the new mark next to the old one and keep both results in the same folder.
When to Ask for an Outside View, and What This Checklist Does Not Cover
In our view, ask for an outside view when Fails sit in more than one group. The same goes for when no one can read the DMARC reports, or when you can’t list your own domains.
The checklist does not explain the technology, which the page linked at the top covers. It does not choose or rank tools, and it names none. For the tool decision, read built-in protection or a dedicated layer. It does not test message encryption beyond transit. For other systems, see the network security audit checklist and, for wider readiness, the ransomware readiness list. For the wider topic, see business email and collaboration security.
It is not a certificate or legal advice, and it says nothing about legal duties in India or the GCC. The NCSC pages are UK guidance.
Signisys provides email and collaboration security. Its solution page describes this as protection against phishing, malware and data leaks in everyday tools, as part of its endpoint, network and zero trust security work. Signisys agrees the exact scope for each engagement. Our Solution: Endpoint, Network and Zero Trust Security. Our Service: Cybersecurity Services.
Email Security Checklist FAQ
What should an email security checklist include?
How do I score where we stand?
Does a full score mean our email is safe?
Which check should we fix first?
Is there a spreadsheet or PDF of this checklist?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.