Email security basics
How business email, MX records, spam filters and quarantines actually work, in plain English.
18 guides
What is DNSSEC, and what does it do for your email?
What DNSSEC protects for email, how RRSIG, DNSKEY and DS form a chain of trust, why DANE needs it, how to enable it, and the DS mistakes that break mail.
9 min read Email security basicsEmail encryption types for business: which do you need?
TLS, S/MIME and PGP, Microsoft Purview Message Encryption, Gmail client-side encryption and encryption at rest: what each one protects and when to use it.
10 min read Email security basicsIs it safe to click unsubscribe in spam emails?
When clicking unsubscribe is safe, when it confirms your address or leads to phishing, how Gmail and Outlook unsubscribe buttons help, and what to do with real spam.
7 min read Email security basicsSMTP ports 25, 587, 465 and 2525: which one should you use?
Which SMTP port to use: 25 for server-to-server relay, 587 with STARTTLS or 465 with implicit TLS for sending from apps, and why port 25 is often blocked.
9 min read Email security basicsWhat is a mail transfer agent (MTA)?
What a mail transfer agent does, how it differs from the MUA, MSA and MDA, how MTAs queue, retry and relay mail, and where spam filtering sits in the path.
9 min read Email security basicsWhat is a smart host, and when do you need an SMTP relay?
What a smart host (SMTP relay) is, how it differs from an open relay, when apps, printers and servers need one, how to authenticate, and the SPF and DKIM impact.
9 min read Email security basicsWhat is a spam score?
What an email spam score is, how SpamAssassin scores and Microsoft SCL and BCL work, why Gmail shows none, how to find scores in headers, and checker limits.
8 min read Email security basicsWhat is DANE for SMTP, and do you need it?
DANE for SMTP explained: TLSA records, why DNSSEC is required, how it compares with MTA-STS, Exchange Online's DANE support, and how to check a domain.
9 min read Email security basicsWhat is Exchange Online Protection (EOP), and what does it include?
What Exchange Online Protection includes with every Microsoft 365 mailbox, how its filtering layers work, the on-premises add-on, and what it lacks vs Defender.
8 min read Email security basicsWhat is greylisting in email?
How email greylisting works, why it stops some spam, why it delays legitimate mail, how it looks in bounces and logs (4xx codes like 451 4.7.1), and what to do.
9 min read Email security basicsWhat is sender reputation, and how do you improve it?
What email sender reputation is, how IP and domain reputation differ, what raises or damages them, where to see yours and how to repair a damaged one.
9 min read Email security basicsWhat is SMTP and how does it deliver email?
How SMTP moves email between servers: the EHLO, MAIL FROM, RCPT TO and DATA dialogue, envelope vs header From, relays, retries and what reply codes mean.
9 min read Email security basicsWhere do spammers get my email address?
How spammers find email addresses: website scraping, data breaches, guessed role addresses, sold lists, hacked contacts and WHOIS, and how to cut exposure.
9 min read Email security basicsWhy do I get so much spam, and what actually reduces it?
Why a business inbox gets so much spam: published and old addresses, catch-alls, guessed names, no filter in front, and the steps that actually reduce it.
8 min read Email security basicsHow do spam filters work?
How inbound spam filters decide what reaches your inbox: connection checks, reputation, SPF/DKIM/DMARC, content rules, attachment scans and quarantine.
9 min read Email security basicsIs my email encrypted in transit? STARTTLS, MTA-STS and DANE explained
What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.
9 min read Email security basicsWhat is an MX record?
What an MX record is, how priority values pick the server that gets your mail, why backup MX can bypass a spam filter, and how to check your own records.
8 min read Email security basicsWhat is an email quarantine, and how should you use it?
What an email quarantine is, personal vs admin quarantine, digest emails, retention limits, and how to release messages without letting phishing back in.
8 min readAbout these guides
Business email runs on a few public building blocks. Your domain's MX records, published in DNS, tell every sending server on the internet where to deliver your mail. Whatever answers at that address, your mailbox provider or a filtering service in front of it, decides what to accept, what to hold for review and what to reject. Many problems people blame on "email" come down to a misunderstanding of one of these pieces.
These guides explain the parts in plain English, in the order a message meets them:
- Where mail goes: how MX records and priorities work, and why an MX lookup alone can't prove that mail is filtered.
- What a filter does: the checks an inbound filter runs on the connecting server, the sender's authentication and the message itself.
- Where held mail ends up: what a quarantine is, how it differs from a junk folder, and who should be allowed to release messages.
- How mail is protected in transit: what STARTTLS encrypts between servers, and what it leaves open.
If you're new to this, start with what an MX record is, then read how spam filters work. To see your own domain's setup while you read, the free Email Health Check shows your MX, SPF, DKIM and DMARC records in one scan. Unfamiliar terms are defined in the glossary.
Frequently asked questions
Does changing my MX records move my mailboxes?
No. MX records only tell other servers where to deliver incoming mail. Your mailboxes, stored messages and outgoing mail stay where they are. Pointing MX at a filtering service puts it in front of your existing mailbox provider, which then receives the mail the filter accepts.
What is the difference between an MX record and an SPF record?
An MX record says where mail for your domain should be delivered, so it is about incoming mail. An SPF record lists the servers allowed to send mail as your domain, so it is about outgoing mail. Changing one doesn't change the other.
What does an inbound spam filter check?
It looks at the connecting server's reputation, the sender's SPF, DKIM and DMARC results, and the message's content, links and attachments. From those signals it delivers the message, holds it in quarantine or rejects it. Each service weighs the signals differently, which is why a quarantine you can review matters.