Email Security Checklist for Small Teams

Email is still the front door. Attackers do not need a zero-day when they have your receptionist's inbox and a well-spoofed invoice. This checklist covers the two layers that matter: the authentication layer you fix in an afternoon (SPF, DKIM, DMARC) and the human layer you maintain forever. Both are checklistable; neither is optional.

The technical checklist — one afternoon of work

1. Publish SPF, but end with -all. A TXT record listing every service allowed to send as your domain, ending in -all (or ~all while you observe). Most small-team domains are either blank or end in +all, which is the DNS equivalent of leaving the door open with a sign saying "spoof us freely". Audit every SaaS that sends email for you first — a missing helpdesk in SPF means bounce-backs, and bounces make people quietly delete the hard fail.
2. Turn on DKIM and keep the key rotated. One 2048-bit selector per sending service, published in DNS, verified by sending a test message to a check service and reading the d= signature. DKIM survives forwarding; SPF does not — that alone justifies the extra fifteen minutes.
3. Ship DMARC in stages: none → quarantine → reject. Start with p=none and aggregate reports for two weeks so you catch the marketing tool nobody remembered, then move to p=quarantine, then p=reject with aspf/s=r to start. DMARC is the only one of the three that tells receivers what to do with failures; without it the other two are decoration.
4. Read the DMARC reports for a month, then set a calendar reminder. The XML is ugly; load it into a viewer or a spreadsheet. Every sender you do not recognize in the report is either a forgotten vendor or someone testing your spoofing posture. This is the highest-signal half hour in email security.
5. Enforce MFA on every mailbox, and app passwords do not count. The credential-stuffing lists are tens of billions of records deep, and password reuse does the rest. MFA on email is worth more than MFA anywhere else, because email is the recovery path for everything else — "reset my password" links land there.
6. Set a forwarding and auto-forward audit alarm. The classic business-email-compromise persistence trick is a hidden auto-forward to an attacker address. Google Workspace and Microsoft 365 can both alert on new forwarding rules; turn that alert on before you need it.
7. Make sender display names meaningless as a trust signal. Turn off display-name-only previews, and teach staff that the display name is attacker-controlled free text. The real identity is the address behind it — and if you have DMARC at p=reject, the identity is the address plus the pass.

The human checklist — the patterns that beat filters

8. Train on the four shapes, not on fear. Nearly every phishing email worth falling for is one of: (1) urgency with authority ("the CEO needs this paid before 5"), (2) an unexpected login or MFA prompt, (3) a payment-detail change on an existing relationship, (4) a document that demands a sign-in to view. Run a fifteen-minute demo of each, not a fear seminar.
9. Verbal-verify every payment-change request. A rule with no exceptions: new bank details are confirmed by phone, on a number already on file, not one from the email. Vendor email compromise is the most profitable phish in the world precisely because teams skip this one call.
10. Report-one-click beats report-twenty-emails. A "report phishing" button that forwards to the security mailbox (or just IT) turns every employee into a sensor. Track the report count going up after training — rising reports with no incidents is winning, not failing.
11. No MFA prompts to approve what you did not start. If an MFA prompt appears, the password is already burned. Deny it, then change the password, then check the forwarding rules. Push-bombing works because people tap "approve" to make it stop; deny-and-rotate is the drill.
12. Compromise sequence, memorized: revoke → audit → rotate → recover. On a confirmed mailbox compromise: revoke all sessions and app passwords, audit sent items and rules (especially delete-after-read rules), rotate the password and every credential that mailbox could reset, then recover any money or data in flight. Do not reply to the attacker, ever — even to buy time, it tells them you are live.

One-page scorecard

The three rules that make the checklist work

• Email is the recovery path for everything — so it gets the strongest lock. Every other account can be reset through the mail; the mail cannot be reset through anything. MFA, forwarding alerts, and session revocation on email are worth ten of the same on any other system.
• Authentication failures should be rejected, not filed. SPF, DKIM, and DMARC only work at p=reject. A DMARC policy stuck at none forever is a security survey, not a control.
• The human layer is a cadence, not an event. One training session decays in weeks; a quarterly fifteen-minute drill plus a one-click report button keeps the sensors warm. Small teams win here by being small: everyone hears about the latest attempt within the hour.

---

The Ops Starter Kit Vol. 2 ($27) is the advanced incident-management pack — the DR plan, evidence log, comms templates, and the tabletop scenarios that turn this checklist into muscle memory — launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout (ends Sep 11, 23:30 ACST).