What is email security for a small business?
Email security is the set of settings that stop someone sending email in your name or reading your mailboxes. For a small business it comes down to three records in your DNS settings, two-step sign-in on every mailbox and a habit of checking payment requests by phone.
Last read from the sources at the foot of this page.
What does email security mean for a business?
Two things go wrong with email. Someone outside sends messages that look like yours, or someone gets into a real mailbox. Both end in the same place: a client or a colleague trusts a message they should not.
Three records protect your address from being forged. SPF lists the servers allowed to send for your domain. DKIM signs each message. DMARC tells receiving servers what to do with a message that fails both.
Three security protocols act jointly to protect email domains from being spoofed: Sender Policy Framework (SPF); DomainKeys Identified Mail (DKIM); and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
What should you do first?
While policies of none and quarantine can help you gather information and configure your systems, only a policy of reject at 100% will prevent all illegitimate messages from being delivered.
- Publish SPF, DKIM and DMARC for your domain.Start DMARC at p=none, read the reports, then move to reject.
- Turn on two-step sign-in for every mailbox, starting with the people who approve payments.
- Confirm any change of payment details by phone, on a number you already have.
- Check the domains you own but do not use for email.They need a record that says they send nothing.
Where is the change made?
Your DNS settings, for SPF, DKIM and DMARC. Your email account settings, for two-step sign-in. Neither needs new software.
What else do people ask about this?
Do cyber insurers ask about email security?
Many application forms ask whether you filter incoming email and whether you publish DMARC. The questions and how to answer them are on our insurance questions pages.
Is a spam filter enough?
A spam filter protects your own inbox. It does nothing for the people who receive email forged in your name. That protection comes from the DMARC record your domain publishes.
Where does this come from?
- Canadian Centre for Cyber Security, Implementation guidance: email domain protection (ITSP.40.065)cyber.gc.caRead 16 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.