Email security checklist for small businesses in 2026

Email is how most small businesses get attacked. CISA's small business guidance puts it plainly: "phishing is consistently the most cost-effective way for attackers to compromise systems." The good news is that the defenses are well known, and most of them take an afternoon, not a budget.

This checklist pulls together guidance from CISA, NIST and the FTC, and turns it into concrete steps for a business running Microsoft 365, Google Workspace or a hosted mail server.

The checklist at a glance

Work through it in order. The first five items stop the most common attacks.

How do you secure email accounts?

1. Turn on multifactor authentication everywhere

A stolen password is the easiest way into a mailbox. MFA means that password alone isn't enough. CISA's Cyber Essentials says to use MFA "for all users, starting with privileged, administrative and remote access users." Its small business page adds that "any form of MFA is better than no MFA," and that phishing-resistant FIDO authentication is the strongest option.

1. Enable MFA for every admin account today.
2. Enable it for every user mailbox, including shared mailboxes that people sign in to directly.
3. Turn off older sign-in methods that can't use MFA, such as basic authentication for legacy mail apps.
4. Check enrollment in your admin console. CISA says to mandate MFA "using technical controls, not faith," and to check MFA status regularly. If your team works from home, see email security for remote teams.

2. Keep admin rights separate and access current

Use a separate admin account for admin work, not your daily mailbox. When someone leaves, block their sign-in the same day and decide who takes over their mail. Review admin roles every quarter. Small businesses often find a former contractor still has global admin.

How do you protect your domain from spoofing?

Attackers can send mail that claims to come from your exact domain. Three DNS records let receivers spot it. The FTC's small business guidance explains them in one line each: SPF lists the servers allowed to send for your domain, DKIM "puts a digital signature on your outgoing mail," and DMARC checks that these match the "from" address people see.

3. Publish one correct SPF record

List every service that sends mail as your domain: your mailbox provider, your website, your invoicing tool, your newsletter platform. Keep it to one record and within the 10 DNS lookup limit. Our SPF Checker counts lookups for you.

4. Turn on DKIM for every sender

Microsoft 365 and Google Workspace both support DKIM signing with your own domain, but you have to switch it on. Do the same in each third-party tool that sends for you. Check the result with the DKIM Checker.

5. Publish DMARC and move it to enforcement

DMARC (RFC 9989) tells receivers what to do when mail fails: nothing (p=none), quarantine, or reject. Start with p=none and a reporting address, fix any legitimate service that fails, then move to p=quarantine and p=reject. Our step-by-step guide on moving DMARC from none to reject covers the timeline.

This isn't only about protection. Google's sender guidelines require SPF or DKIM from everyone sending to personal Gmail accounts, and SPF, DKIM and DMARC from bulk senders. Setting up a brand-new domain? Follow our new domain email setup checklist.

Plenty of large organizations still haven't finished this step. In our scan of the top 1,000 domains in October 2026, 38.3% didn't enforce DMARC.

6. Lock down the registrar and DNS host

Whoever controls your DNS controls where your mail goes. Turn on MFA at your domain registrar and DNS host, enable registrar lock, and make sure the renewal contact is a shared address that won't vanish when one person leaves.

How should small businesses filter incoming email?

7. Filter spam, malware and risky attachments

NIST's phishing guidance says to "utilize email filters." At a minimum, check that:

• Spam and malware filtering are on and set to quarantine high-risk mail rather than just tag it.
• Risky attachment types, such as executables and macro-enabled Office files, are blocked or quarantined.
• External senders are clearly labeled, so a message pretending to be from your boss stands out.
• Your mailbox provider can't be reached directly, skipping the filter. If you use a separate filtering service, follow our guide to blocking direct-to-tenant bypass.

If you're not sure how the layers work, read how spam filters work.

8. Make quarantine useful

A quarantine nobody reviews loses real mail. Send users a regular digest of what's held for them, so they can release a real invoice without calling IT. Decide who reviews malware and phishing quarantines, since users usually can't release those.

How do you protect your email data?

9. Back up, and test the restore

Ransomware and account takeovers can delete or encrypt mail. CISA's Cyber Essentials says to "establish regular automated backups and redundancies of key systems," and its small business page adds: "It's critical to regularly test partial and full restores."

1. Find out how long your provider keeps deleted mail, and how you'd recover it.
2. Decide how far back you'd need to recover after an incident.
3. If the provider's retention isn't enough, add a backup service.
4. Restore one mailbox and one folder as a test. Note how long it took.

How do you prepare your team?

10. Train people on phishing and payment fraud

Technology misses some attacks, especially messages sent from real, compromised accounts. CISA says all staff "must be formally trained" on security. Keep the training practical (our guide to email security awareness training covers simulations and reporting culture):

• Verify payment and bank detail changes by calling a known number, not one in the email. NIST says to "verify the request by using known contact information."
• Be wary of urgency. "Pay today" and "keep this confidential" are pressure tactics.
• Check the sender's real address, not just the display name.
• Never enter a password after following a link in an email you didn't expect.
• Don't rely on spelling mistakes. Generative AI writes fluent, personal phishing; our guide to AI phishing emails covers what still gives it away.
• Treat a sudden inbox flood as an attack. Email bombing can bury a fraud alert or set up a fake IT support call.

Business email compromise relies on exactly these moments. Our guide on preventing business email compromise adds process controls for finance teams.

11. Make reporting easy

Give everyone one obvious way to report a suspicious message, such as the built-in report button in Outlook or Gmail, or a shared address. Thank people who report, including false alarms. Early reports let you remove a phishing message from other mailboxes before someone else clicks.

What should your email incident plan include?

12. Write the plan before you need it

CISA calls an incident response plan "your action plan before, during and after a security incident" and recommends reviewing it regularly and practicing it. For email, one page is enough:

1. Who to call. An internal owner, your IT provider, your bank's fraud line, and your cyber insurer if you have one.
2. First hour for a compromised mailbox. Reset the password, sign out all sessions, check MFA methods, and remove unknown inbox rules and forwarding.
3. Money at risk. Call the bank immediately if a payment was sent. Speed matters most here.
4. Who to tell. Customers or suppliers who may have received fraudulent mail from you. In the US, report the crime to the FBI's Internet Crime Complaint Center, as NIST advises.
5. Afterwards. Write down what happened and what you'll change.

If someone has already clicked, follow what to do after clicking a phishing link.

13. Watch for quiet changes

Attackers who get into a mailbox often add a forwarding rule or an inbox rule that hides replies. Attackers who get into DNS can change your MX records. Turn on alerts for new forwarding rules in your admin console, and monitor your MX, SPF and DMARC records. iBlockSpam's domain monitoring sends drift alerts when they change.

Next steps

1. Today: confirm MFA is on for every admin and user account.
2. This week: run the free Email Health Check to see your MX, SPF, DKIM and DMARC status in one place.
3. This month: publish DMARC with reporting (the DMARC Record Generator builds the record), write your one-page incident plan, and test a mailbox restore.
4. If you want filtering and monitoring priced per domain rather than per user, see our small business page.

To see how the filtering, monitoring and account security items on this list look in practice, try the iBlockSpam portal demo, or compare plans on our pricing page.

Browse more guides on running email day to day.