Email domain security checklist

Review existing email security settings

• Do you have a complete inventory of your registered domains?
• Have you identified which are sending and which are non-sending email domains?
• Have you evaluated each domain for vulnerability to email domain impersonation?
• Are you aware of your existing Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), Domain-based Message Authentication, Reporting and Conformance (DMARC) and mail exchanger (MX) records?
• Do you actively monitor your email security Domain Name System (DNS) records for unauthorised changes?
• If you use Microsoft 365, have you reviewed whether to switch on Reject Direct Send to block unauthenticated mail spoofing your domain?

Implement SPF (Sender Policy Framework)

SPF verifies that emails from your domain are sent by authorised mail servers.

• Does each domain have an SPF record configured with only authorised sending services?
• Have you confirmed that each authorised sending service is domain aligned?
• Do sending domains end their SPF record with a soft-fail (~all), so that receiving servers evaluate DKIM and DMARC before rejecting a message?
• Do non-sending domains publish ‘v=spf1 -all’ and a DMARC reject policy?

Note: on sending domains a hard-fail (-all) can cause some receivers to reject legitimate mail, such as forwarded messages, before DKIM and DMARC are checked. Use DMARC at quarantine or reject to stop impersonation.

Set up DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails, verifying they have not been altered in transit.

• Is DKIM configured for each authorised sending service?
• Have you verified that each sending service’s DKIM signature is domain aligned?

Configure DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC helps protect against domain impersonation and gives visibility of potential unauthorised use of your domains.

• Does each domain have a DMARC record configured with reporting (using the RUA, or aggregate report, tag)?
• Do you track the enforcement status (for example none, quarantine or reject) for each domain?
• Are authorised sending services passing DMARC consistently before you move to the first enforcement level (for example quarantine)?
• Do you have a plan to move each domain to a DMARC policy of reject?
• Do you monitor unauthorised attempts to impersonate your domains to understand potential attack vectors?
• If you send more than 5,000 emails a day to Gmail, Yahoo or Outlook.com addresses, do you meet their bulk sender rules (SPF, DKIM, DMARC, one-click unsubscribe and low spam complaint rates)? Non-compliant mail can now be rejected.
• Do third-party senders (marketing, CRM and invoicing platforms) send with DKIM aligned to your domain?

Prevent typosquatting

• Do you regularly search for variations of your domains (for example yourbusiness.co.uk and yourbusiness.com) that could be used maliciously?
• Have you considered buying variants and misspellings of your domains?

Secure your inbound email traffic with TLS

A Mail Transfer Agent Strict Transport Security (MTA-STS) policy tells sending mail servers whether your domain requires encrypted Transport Layer Security (TLS) connections for email delivery.

• Have you checked whether MTA-STS is enabled for each registered domain that receives email?
• Has the policy been run in testing mode, reviewed through TLS-RPT reports and then moved to enforcement?
• Have you set up TLS reporting (TLS-RPT), and do your mail servers support TLS 1.2 or later with valid, monitored certificates, so that enforcement does not block legitimate mail?

Enable two-factor authentication (2FA)

Add an extra layer of security to email accounts.

• Is 2FA enabled as standard for all email users?
• Are you using authenticator apps such as Microsoft Authenticator or Google Authenticator, or phishing-resistant methods such as passkeys, across the business?
• Is 2FA required for all employees?
• Have you blocked legacy authentication protocols that bypass 2FA?

Monitor for phishing and spoofing attacks

• Are takedown services in use?
• Do you monitor regularly for phishing domains?
• Are teams trained to recognise phishing attempts?

Review logs regularly

Monitor email and domain logs for suspicious activity.

• Are automated alerts set up for unauthorised access attempts?
• Is there a process and governance around regular review of DMARC reports?
• Are anomalies investigated immediately?

Incident response plans

• Are teams prepared to respond quickly to a breach?
• Are there clearly defined roles for incident response?
• Is contact information for takedown providers and domain registrars easily accessible if needed?
• Is the action plan updated annually and after any incident?
• Do you know your reporting obligations, including to the ICO within 72 hours for personal data breaches?