Email is the highest-value attack surface in any business — the source of most ransomware, business email compromise (BEC), and credential theft. This guide focuses on the technical controls every business should have on top of user-side phishing awareness: SPF, DKIM, DMARC, sandboxing gateways, impersonation detection, and the configuration mistakes that leave even well-intentioned organizations exposed.
The 5 Layers of Email Security
| Layer | What It Does | What It Catches |
|---|---|---|
| 1. Protocol authentication (SPF, DKIM, DMARC) | Verifies senders cryptographically | Domain spoofing |
| 2. Email security gateway | Filters before delivery; sandboxes attachments and URLs | ~95% of bulk phishing and malware |
| 3. In-mailbox protections | External-sender banner, impersonation detection | BEC and lookalike-domain attacks |
| 4. User awareness | Training and phishing simulation | Targeted spear-phishing that gets through filters |
| 5. Post-delivery response | EDR, conditional access, ZAP (zero-hour auto purge) | Threats discovered after delivery |
SPF, DKIM, and DMARC — The Authentication Trio
- SPF (Sender Policy Framework): DNS record listing which IP addresses are authorized to send for your domain. Most domains have this; few have it correctly scoped.
- DKIM (DomainKeys Identified Mail): Cryptographic signature on outbound messages. Microsoft 365, Google Workspace, Mailgun, SendGrid, and HubSpot each need their own DKIM key configured.
- DMARC (Domain-based Message Authentication): Policy that tells receivers what to do with mail that fails SPF or DKIM.
p=noneis monitor-only;p=quarantinesends failures to spam;p=rejectdrops them.
The Email Security Gateway Layer
| Vendor | Best For | Notes |
|---|---|---|
| Microsoft Defender for Office 365 P2 | M365-stack businesses | Bundled with E5; sandboxing, URL rewrite, attack simulator included |
| Proofpoint | Mid-market and enterprise | Strong impersonation and BEC detection |
| Mimecast | Established mid-market | Long history; strong continuity features |
| Abnormal Security | BEC-focused mid-market | AI-driven; strong on impersonation |
| Avanan / Check Point Harmony | Cloud-native organizations | API-based instead of MX-record-based |
Configuration Mistakes That Leave You Exposed
- DMARC stuck at
p=none. Monitor-only policy that does not actually block anything. - SPF too permissive.
+allor overly broad include statements neutralize the protection. - Missing DKIM keys for legitimate senders. Marketing automation, transactional providers, third-party CRMs all need to be added.
- External-sender banner disabled. Easy quick win; one click in Defender / Workspace admin.
- Impersonation protection not configured. Add executive names, custom domains, lookalikes to the watch list.
- Anti-phishing policies set to default. Strict policies catch substantially more than default policies.
- Attachment sandboxing limited to known-bad file types. Modern attacks use HTML, OneNote, ZIP-with-LNK, ISO files.
- Auto-forward to external addresses still allowed. The most common BEC persistence mechanism.
30-Day Email Security Hardening Plan
- Day 1–3: Audit DNS — confirm SPF, DKIM, and DMARC records exist on every domain you own and every legitimate third-party sender.
- Day 4–7: Move DMARC to
p=quarantineafter 7 days of monitoring withp=none. - Day 8–14: Enable strict anti-phishing and impersonation protection policies; add executive names and lookalike domains.
- Day 15–21: Enable safe attachments (sandboxing) and safe links (URL rewrite). Block auto-forwarding to external addresses.
- Day 22–28: Roll out external-sender banner; deploy phish-report button.
- Day 29–30: Move DMARC to
p=rejectafter 30 days of clean reports.
Frequently Asked Questions
What is the single highest-impact email security improvement?
Moving DMARC to p=reject on every owned domain. It is free, blocks domain spoofing entirely, and dramatically reduces phishing volume.
Do we need a third-party gateway if we have M365 E5?
Defender for Office 365 P2 is competent for most SMBs. Mid-market and regulated firms often layer Proofpoint or Abnormal on top for BEC detection.
What about email encryption?
Use TLS for transport (default in M365 and Workspace), and add S/MIME or message-level encryption (Microsoft Purview, Virtru) for healthcare and legal use cases where PHI or privileged content travels by email.
Bottom Line
Most organizations have email security tools deployed but configured at the default level. A 30-day hardening pass — DMARC at reject, strict policies, sandboxing, external banner, no external auto-forward — closes 80% of the configuration gaps.
Need help hardening your email security stack? ACS configures and manages email security for U.S.-based SMBs and mid-market firms. Contact us.
