# Email security for startups: what to set up on day one URL: https://iblockspam.com/blog/email-security-for-startups Last updated: 2026-10-12 Published: 2026-10-12 Topic: Setup guides Author: iBlockSpam Team > Email security for startups: founder impersonation, fake remote hires, OAuth consent phishing, product email and a setup that grows from 3 to 50 people. ## Short answer A startup should secure email on day one: a separate admin account, MFA for everyone, SPF, DKIM and DMARC on the domain, and registrar lock. Send product email from a subdomain. Then guard against founder impersonation with a phone check for payment changes, restrict OAuth app consent, and verify remote hires' identities before giving them access. A startup's email is a skeleton key. The admin account for your mailbox platform often signs you in to your code host, cloud console, payroll and bank through single sign-on. Funding announcements and team pages can tell criminals who to impersonate and when money is moving. This guide covers the email risks that fit how startups actually work, and a setup you can do in an afternoon and grow into. ## What email threats do startups face? Startups face the same phishing as everyone else, plus risks that come from being small, public and fast-growing. The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise (BEC) complaints in 2025, with $3,046,598,558 in reported losses ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). **BEC** means a criminal impersonates or takes over a trusted email account to redirect money or data. | Threat | Why startups are exposed | Main control | |---|---|---| | Founder impersonation | Founders are public; new hires don't know their real address or style | Payment and gift card rules, verified by phone | | Admin account takeover | One identity unlocks every SaaS tool via single sign-on | Separate admin account, phishing-resistant MFA | | OAuth consent phishing | Staff connect many apps; approval screens look routine | Restrict user consent to apps | | Fake remote hires | Remote-first hiring at speed | Identity checks during hiring and onboarding | | Spoofing of your domain | New domains often launch with no DMARC | SPF, DKIM, DMARC from day one | | Product email problems | Receipts, resets and marketing share one domain | Separate sending subdomains | ### Fake remote hires This one is specific to remote-first tech companies. The FBI warns that North Korean IT workers get hired as remote employees, then use their access to steal code and data. After being discovered, some have extorted victims "by holding stolen proprietary data and code hostage" ([IC3 PSA I-012325-PSA](https://www.ic3.gov/PSA/2025/PSA250123)). The FBI says they have copied company code repositories to personal accounts and have used "artificial intelligence and face-swapping technology during video job interviews." Its recommendations for hiring include: - Verify identity during interviewing, onboarding and throughout employment. - Cross-check applications for the same resume content, phone numbers (particularly VoIP numbers) and email addresses. - Watch for changes in address or payment platforms during onboarding. - Complete as much of hiring and onboarding in person as possible. ### OAuth consent phishing **OAuth consent phishing** tricks a user into approving a malicious app on a real sign-in provider's permission screen. In September 2026 the FBI warned that it gives attackers persistent access because, once granted, access "can only be revoked by the victim invalidating the token", "not by changing the password." The FBI adds that it can "bypass both passwords and multi-factor authentication" ([IC3 PSA I-090126-PSA](https://www.ic3.gov/PSA/2026/PSA260901)). That warning focused on prominent individuals, but startups that try new tools weekly face the same technique. Our [OAuth consent phishing guide](https://iblockspam.com/blog/oauth-consent-phishing-microsoft-365) shows how to restrict consent in Microsoft Entra ID. ## What should a startup set up on day one? Set up email security when you register the domain, before anyone is hired. Every step is cheaper now than after the company has grown. 1. **Create a separate admin account.** Use it only for administration, not daily email, and keep a second emergency admin account in case you're locked out. Microsoft recommends two cloud-only emergency access accounts ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults)). 2. **Turn on MFA for everyone.** In Microsoft 365, security defaults require all users to register for MFA and block legacy authentication. Microsoft says tenants created on or after October 22, 2019 may have them on already, and from July 1, 2026 security defaults on new tenants also block device code flow. In Google Workspace, enforce 2-Step Verification; see [Google Workspace 2SV enforcement](https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement). 3. **Lock down the domain.** Turn on MFA at your registrar and DNS host, keep transfer lock on, and enable auto-renew. See [domain registrar security](https://iblockspam.com/blog/domain-registrar-security-registry-lock). 4. **Publish SPF, DKIM and DMARC.** Start DMARC at `p=none` with a reporting address. The [new domain email setup checklist](https://iblockspam.com/blog/new-domain-email-setup-checklist) walks through each record. 5. **Use shared mailboxes for role addresses** such as `billing@` and `security@`, accessed through personal accounts rather than a shared password. 6. **Restrict who can approve third-party apps**, and review connected apps monthly. 7. **Write two rules down:** "We never ask for gift cards," and "Bank and payroll changes are confirmed by phone." A starting set of DNS records for a domain on Google Workspace might look like this (example values; your provider gives you the exact DKIM key): ``` example.io TXT "v=spf1 include:_spf.google.com ~all" google._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..." _dmarc.example.io TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.io" ``` ## How do you send product email without hurting your domain? Send product email from subdomains, and authenticate each sending service with your domain. Google's [email sender guidelines](https://support.google.com/a/answer/81126) say that from February 1, 2024, senders of more than 5,000 messages a day to Gmail accounts must: - set up SPF, DKIM and DMARC (the DMARC policy "can be set to none") - align the From domain with the SPF or DKIM domain - support one-click unsubscribe on marketing and subscribed messages - keep the spam rate reported in Postmaster Tools below 0.3% A startup can cross 5,000 messages a day the week a product launches. Put receipts and password resets on one subdomain, such as `mail.example.io`, and marketing on another, such as `news.example.io`, so a campaign that draws complaints doesn't hurt staff mail. See [separate subdomains for transactional and marketing email](https://iblockspam.com/blog/separate-subdomains-transactional-marketing-email) and [how to authenticate third-party senders](https://iblockspam.com/blog/authenticate-third-party-senders-spf-dkim-dmarc). ## How do you stop founder and finance impersonation? Stop founder impersonation by making it impossible to move money or change payment details on email alone. The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3 PSA I-091124-PSA](https://www.ic3.gov/PSA/2024/PSA240911)). Here's an example of the kind of message new hires receive in their first week: > Example: "Hi, it's Maya (CEO). I'm between investor meetings and need a quick favor. Can you pick up some gift cards for a client thank-you? I'll reimburse you today. Don't call, I'm in back-to-back meetings." Practical rules for a small team: - Tell every new hire on day one how founders really communicate, and that nobody will ask for gift cards. Our [new employee onboarding guide](https://iblockspam.com/blog/new-employee-onboarding-email-security) has a script. - Require a second approver for any outgoing payment above a set amount, even when a founder asks. - Confirm payroll and vendor bank changes by phone on a number you already hold. See [payroll diversion scams](https://iblockspam.com/blog/payroll-diversion-scam-emails). - Around a funding round, confirm any wire instructions by phone with someone you know, using a number from your own records. ## Is built-in filtering in Microsoft 365 or Google Workspace enough for a startup? For most early-stage startups, the filtering built into Microsoft 365 or Google Workspace is a reasonable start, provided someone has actually reviewed the settings. Both platforms filter inbound mail by default. Microsoft says its built-in anti-malware, anti-spam and anti-phishing protections are "on by default" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/eop-about)), and Google says "by default, Gmail displays warnings, and moves untrustworthy emails to the spam folder" ([Google Workspace Admin Help](https://support.google.com/a/answer/9157861)). What they don't do is configure themselves for your risks. A few minutes of tuning closes the common gaps: - Turn on the platform's anti-spoofing and impersonation protection for founders' names. - Make sure external mail is clearly tagged, so a message "from the CEO" that arrived from outside stands out. - Block risky attachment types, such as executables and macro-enabled documents. - Decide who reviews quarantined mail, so a real investor or customer email isn't lost. A separate filtering gateway becomes worth comparing when you run several domains, want every user to get a quarantine digest, or need mail held while your mail platform is unreachable. Our comparisons of [Microsoft 365 built-in filtering vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) and [Google Workspace built-in filtering vs a gateway](https://iblockspam.com/compare/google-workspace-built-in-vs-gateway) set out the trade-offs plainly. ### What about when people leave? Startups change fast, and departures are where access lingers. A founder who leaves may still own the registrar account, the DNS host or the original admin login. Before anyone leaves, move domain, DNS and admin ownership to a company-controlled account, remove their app access, and convert their mailbox to a shared mailbox if customers still write to it. Our [employee offboarding guide](https://iblockspam.com/blog/employee-offboarding-email-security) has the full checklist. ## How should email security grow with the company? Email security should grow in steps as the team and the number of senders grows, not all at once. | Stage | Focus | |---|---| | Founders only | Separate admin account, MFA, registrar lock, SPF, DKIM, DMARC at `p=none` | | First hires | Onboarding briefing, payment rules, shared mailboxes, app consent restrictions | | Launch | Sending subdomains, DMARC reports reviewed, move toward `p=reject` | | 20 to 50 people | Phishing-resistant MFA for admins and finance, inbound filtering reviewed, a written incident response plan | CISA's joint phishing guidance recommends phishing-resistant MFA, such as FIDO security keys, and says to prioritize it for administrators and privileged accounts ([CISA](https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one)). For a startup, that means founders and anyone with access to the bank or the cloud console. ## Next steps - Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain, and create a DMARC record with the [DMARC Generator](https://iblockspam.com/tools/dmarc-generator) if you don't have one. - Write down your gift card and payment rules and add them to onboarding. - Review which apps have access to your company accounts, and remove any you don't recognize. - When you're ready to compare filtering options, our [buying checklist](https://iblockspam.com/blog/how-to-choose-a-spam-filter-small-business) is vendor-neutral. iBlockSpam's [per-domain pricing](https://iblockspam.com/pricing) means new hires don't change the bill. More setup guides are in our [setup topic](https://iblockspam.com/blog/topic/setup). ## Frequently asked questions ### When should a startup set up DMARC? As soon as the domain sends any mail. Publish a monitoring record (p=none) with a reporting address on day one, authenticate each tool that sends as your domain, then move to quarantine and reject once reports show every legitimate sender passing. It's far easier with five senders than after you've added twenty SaaS tools. ### Should a startup send product emails from its main domain? Usually not. Send password resets and receipts from one subdomain and marketing from another, and keep staff mail on the main domain. Receivers can then judge each stream on its own reputation, so a marketing campaign that draws complaints is less likely to drag down mail from founders and staff. ### How do scammers impersonate startup founders? Founders' names and roles are easy to find on team pages, LinkedIn and funding announcements. A scammer can then email new hires or finance staff from a free or lookalike address using the founder's name. Common requests are gift cards, an urgent wire, or a payroll bank change. A rule that money moves only after a phone or in-person check blocks the payoff. ### How can a startup spot a fake remote job applicant? The FBI recommends verifying identity during interviews, onboarding and employment, cross-checking applications for reused resumes, phone numbers and email addresses, and doing as much hiring and onboarding in person as possible. It also warns that fake workers have used AI and face-swapping in video interviews. ### Do startups need a separate email filter or is Microsoft 365 or Google enough? Many startups start with the filtering built into Microsoft 365 or Google Workspace, tuned properly. A separate gateway becomes worth a look when you want per-user quarantine digests, mail held during outages, or one policy across several domains. Get MFA, DMARC and payment checks right first; they matter more early on. ## Sources - [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) - [FBI IC3 PSA I-012325-PSA: North Korean IT Workers Conducting Data Extortion (January 2025)](https://www.ic3.gov/PSA/2025/PSA250123) - [FBI IC3 PSA I-090126-PSA: Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (September 2026)](https://www.ic3.gov/PSA/2026/PSA260901) - [FBI IC3 PSA I-091124-PSA: Business Email Compromise, The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911) - [Microsoft Learn: Configure security defaults for Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) - [Google: Email sender guidelines](https://support.google.com/a/answer/81126) - [CISA, NSA, FBI, MS-ISAC: Phishing Guidance, Stopping the Attack Cycle at Phase One](https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one) ## Free tools for this guide - [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan. - [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings. - [SPF Record Generator](https://iblockspam.com/tools/spf-generator): Build a valid SPF record from your mail providers, with a DNS lookup count. - [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict. --- Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-startups (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt