What email security questions should you ask your MSP?

If a managed service provider (MSP) runs your IT, it probably also runs your email: the Microsoft 365 or Google Workspace tenant, the domain's DNS records, the spam filter and the response when someone clicks a bad link. That makes your MSP's own security part of yours.

These questions help a business owner or office manager find out what the MSP actually does for email, without needing to be a security specialist. Each comes with what a good answer sounds like.

Why ask your MSP about email security?

Because email is where most attacks start, and an MSP's admin access is a high-value target. In 2022, CISA, the NSA, the FBI and cyber agencies from four other countries published a joint advisory on threats to MSPs and their customers. It tells customers to "ensure their contractual arrangements specify that their MSP implements these measures and controls" and to "have a thorough understanding of the security services their MSP is providing" (CISA AA22-131A).

You don't need to audit your MSP. You need clear answers, in writing, to a short list of questions.

Who has admin access to our email, and how is it protected?

Start here. Admin accounts can read mailboxes, create forwarding rules and change routing.

1. Which people at your company have admin rights to our tenant, and which roles do they hold? A good answer names roles, not "everyone on the help desk has global admin".
2. Do you use GDAP for our Microsoft 365 tenant? GDAP, granular delegated admin privileges, gives partners "granular and time-bound access", and "customers must explicitly grant the least-privileged access" (Microsoft Learn).
3. Is multifactor authentication required on every account you use to access us? CISA tells customers to require MFA "on all MSP accounts used to access customer environments".
4. Do we keep our own admin account? Google recommends "more than one super administrator account, each managed by a separate individual", and separate everyday accounts for super admins (Google Workspace Admin Help).
5. How would we remove your access? In Microsoft 365 the answer is Settings > Partner relationships > select the partner > Remove roles (Microsoft Learn). You can check that page yourself today.

Who controls our domain and DNS?

Whoever controls DNS controls where your mail goes.

6. Is the registrar account in our company's name, with our recovery email? It should be. See our guide to registrar security and registry lock.
7. Who can change our MX, SPF, DKIM and DMARC records, and how would we know if they changed? A good answer includes change alerts or a regular check.
8. Where is our DMARC policy, and when do we reach enforcement? DMARC, defined in RFC 9989, tells receivers what to do with mail that fakes your domain. A policy of p=none only monitors. In our scan of the Tranco top 1,000 domains in October 2026, 38.3% didn't enforce DMARC, so don't assume yours does. Our DMARC rollout guide shows the path.

What filters our inbound mail, and can it be bypassed?

9. What filters our inbound email: the built-in Microsoft or Google filtering, or a separate service? Either can be reasonable. Vague answers aren't. Our guide to what an email filtering service is explains the options.
10. If mail goes through a filtering service first, can attackers send directly to Microsoft 365 and skip it? A good answer describes a locked-down connector. See blocking direct-to-tenant bypass.
11. Who reviews quarantine, and how quickly is legitimate mail released? Ask whether users can release their own held mail or must open a ticket.
12. Which attachment types and macros are blocked? Our guide to dangerous attachment types lists the usual candidates.

How do you detect and respond to email attacks?

13. What do you get alerted on? Look for sign-ins from unusual places, new inbox forwarding rules and users restricted from sending. Our guide to malicious inbox rules explains why forwarding rules matter.
14. How long are mail and audit logs kept, and who can search them? You'll need them after an incident.
15. What happens in the first hour if one of our mailboxes is compromised? A good answer covers resetting the password, revoking sessions, removing rules and telling contacts. Compare it with our incident response plan guide.
16. Is incident response in our contract, and what does it cost? CISA says contracts should "include incident response and recovery plans".

How do you measure and report on our email security?

17. Do you check our tenant against a published baseline? CISA's SCuBA project publishes secure configuration baselines for Microsoft 365 and Google Workspace, with free assessment tools called ScubaGear and ScubaGoggles, and says "all organizations can use SCuBA" (CISA).
18. What will you report to us each month? Ask for a sample.
19. Do you run phishing awareness training or simulations? If so, ask how results are shared. See security awareness training for small businesses.

What happens if we leave?

20. What do we keep, and how do you hand over? Admin accounts, registrar and DNS logins, filter configuration, documentation and backups should all stay with you. CISA tells customers to "disable MSP accounts that are no longer managing infrastructure".

What do good and bad answers look like?

A single red flag doesn't mean you should change provider. It means you should ask for a plan and a date.

How should you run the review with your MSP?

Treat this as a short, friendly review, not an interrogation. A good MSP will welcome it, because clear answers protect them too.

1. Send the questions in writing first. Give your MSP a week or two to answer. Written answers are easier to compare and to keep.
2. Book a 45-minute meeting to go through the answers you don't understand. Ask the MSP to show you the settings on screen where they can.
3. Record each answer as done, planned or not offered. For anything planned, agree an owner and a date.
4. Check what you can yourself using the steps in the next section.
5. Put the important items in the contract. CISA's advisory recommends that contracts specify the security measures the MSP implements, including MFA and incident response.
6. Repeat once a year, and after any security incident, staff change at the MSP, or move to a new mail platform.

If you're a regulated business, such as a medical, financial or legal practice, ask whether the MSP can provide the documentation your regulator or insurer expects. That's a question for your adviser as well as your MSP.

Which answers can you check yourself?

You don't have to take every answer on trust. A few take minutes to verify:

1. Run the free Email Health Check on your domain to see your MX, SPF, DKIM and DMARC status.
2. Use the MX Lookup to see which service actually receives your mail.
3. Check the policy with the DMARC Checker; p=none means no enforcement yet.
4. In Microsoft 365, open Settings > Partner relationships and review each partner's roles.
5. Sign up for free Domain Watch to get an email when your public MX, SPF, DMARC or MTA-STS records change.

If your answers don't match what you were told, that's a good conversation to have.

How does iBlockSpam work with MSPs?

If your MSP uses iBlockSpam for inbound filtering, access is under your control. You grant the MSP full or read-only access to your account by invitation or partner code, and you can remove it any time. Partner staff must use two-factor authentication, and their actions appear in your activity log. Partners can't change your billing, plan, payment or security settings. Each business pays for its own domains, per domain rather than per mailbox; see iBlockSpam for small businesses. MSPs can read about the partner program.

Next steps

• Send these 20 questions to your MSP and ask for written answers.
• Check your domain with the Email Health Check before the conversation.
• Review partner roles in your Microsoft 365 admin center today.
• Make sure your company owns the registrar account.
• If you're also choosing a filter, our email security RFP template covers the product questions. For a per-domain option your MSP can manage, see iBlockSpam for small businesses.

Browse more buying guides.