Business email security setup
Most email break-ins at small businesses don’t involve clever hacking: a reused password, no two-step sign-in, a forwarding rule nobody noticed. Securing business email is mostly about getting a handful of settings right, and keeping them right.
The short answer
Business email security means protecting three things: your domain (so nobody can forge it), your accounts (so nobody can log in as you), and your people (so phishing and malware are caught before they cause damage). We set up SPF, DKIM and DMARC, two-step sign-in for every account, filtering for phishing and attachments, and safe admin settings in Google Workspace or Microsoft 365.
What’s included
- Domain: SPF, DKIM and DMARC, moving to enforcement.
- Accounts: two-step sign-in for everyone, strong admin accounts, and old accounts removed.
- Forwarding rules checked: hidden rules that copy your email to outsiders are a classic sign of a break-in.
- Filtering: phishing, spam, malicious links and attachments, tuned in your email service.
- Admin settings: who can share, forward and connect apps, and alerts for suspicious sign-ins.
- A security report with what we found, what we changed, and what to watch.
How we do it
- Review your domain, accounts and email service settings.
- Fix the urgent issues first (open forwarding, missing two-step sign-in).
- Set up authentication and filtering.
- Lock down admin settings and alerts.
- Hand over a short report and a checklist for new staff.
The signs of a compromised mailbox
- Customers receive invoices "from you" with different bank details.
- Replies to emails you never sent.
- New forwarding or filter rules you didn’t create.
- Sign-ins from countries where you have no staff.
Security that doesn’t get in the way
Good email security shouldn’t slow your team down. Two-step sign-in takes seconds once set up, and warnings on outside emails help staff rather than block them. We set it up so it protects you quietly. For just the domain side, see email authentication setup.
Common questions
We’re a small company. Are we really a target?
Yes. Small businesses are targeted precisely because they tend to have fewer protections, and a single fake invoice can cost more than years of security.
Do you work with Google Workspace and Microsoft 365?
Yes, both, and with most other business email services.
Is this a one-time setup?
The setup is one-time, at a fixed price. We can also check it periodically, since new staff and new tools change things over time.