What is email security?

Email security is a broad term, and vendors stretch it to cover whatever they sell. This guide gives you a plain definition, the threats email security has to handle, the seven layers that make it up with the standard behind each one, and a sensible order to put them in place. Each section links to a deeper guide when you're ready for detail.

What is email security?

Email security is the set of technical controls and working habits that keep email accounts, email domains and the messages themselves from being abused. It covers three things: who can get into your mailboxes, who can send mail as your domain, and what mail is allowed to reach your people. It also covers keeping messages private in transit and recoverable after an incident.

NIST's guide SP 800-177 Rev. 1, Trustworthy Email, frames it in a similar way: sender authentication built on DNS, transport encryption with TLS, and end-to-end protection of message content with S/MIME. The joint CISA-led phishing guidance adds the human side: training and reporting.

Why is email such a common target?

Email is a common target because it reaches every employee, accepts messages from anyone, and was never designed to prove who sent a message. The SPF standard, RFC 7208, opens by noting that "any host injecting mail into the system can use any DNS domain name it wants" in the sender fields. Every authentication standard since has been a retrofit.

The results show up in crime reports. The FBI's 2025 IC3 Annual Report recorded 191,561 phishing/spoofing complaints, more than any other crime type, and $3,046,598,558 in reported business email compromise losses. Our phishing statistics page has the trend over three years.

What threats does email security protect against?

Email security protects against threats that arrive in mail, threats that abuse your domain, and threats against the accounts themselves. Each one needs a different control.

What are the layers of email security?

Email security has seven layers. Think of them as independent checks: each one catches what the others miss.

1. Account security

Account security stops criminals from signing in to your mailboxes. The core control is multifactor authentication (MFA), which requires a second proof, such as an authenticator app or a security key, as well as a password. The joint CISA, NSA, FBI and MS-ISAC guidance recommends phishing-resistant MFA (FIDO or PKI-based), prioritized for "administrator and privileged user accounts." Also remove old protocols that skip MFA, and keep admin roles to a minimum.

2. Domain authentication: SPF, DKIM and DMARC

Domain authentication lets receivers check that mail claiming to be from your domain really is. The FTC's small business guidance sums up the three standards:

• SPF "lets you choose specific IP addresses that are authorized to send emails using your domain."
• DKIM "puts a digital signature on your outgoing mail."
• DMARC checks that the visible From address matches an authenticated domain and tells receivers what to do when it doesn't. The current specification is RFC 9989.

Example records, for a domain that sends through Microsoft 365:

example.com.         TXT  "v=spf1 include:spf.protection.outlook.com -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

The CISA-led guidance tells organizations to "ensure DMARC is set to 'reject' for sent emails." US federal agencies were required to reach p=reject within a year under BOD 18-01, issued in October 2017. Our SPF vs DKIM vs DMARC guide explains how they fit together. In our scan of the Tranco top 1,000 domains in October 2026, 38.3% didn't enforce DMARC.

3. Inbound filtering

Inbound filtering checks every incoming message before it reaches a mailbox. A filter judges the sending server's reputation, checks SPF, DKIM and DMARC, scores the content, follows links and scans attachments. Mail is then delivered, sent to junk, held in quarantine or rejected. Filtering can be built into your mail platform, added as a gateway in front of it (your MX records point to the gateway), or added through an API connection. See how spam filters work and secure email gateway vs API email security.

4. Encryption in transit

Encryption in transit stops mail from being read as it moves between servers. Servers use STARTTLS to upgrade an SMTP connection to TLS. On its own that's opportunistic: RFC 8461 notes that an attacker who can delete the "250 STARTTLS" response "can perform downgrade or interception attacks." MTA-STS and DANE let a receiving domain require valid TLS. Few domains use them yet: our top 1,000 scan found MTA-STS on 5.1%. See MTA-STS and TLS-RPT explained.

5. Message encryption

Message encryption, such as S/MIME or a provider's encrypted-message feature, protects the content itself, so only the intended recipient can read it. It matters for regulated data. It doesn't stop phishing or malware. Our guide to email encryption types compares the options.

6. Data protection

Data protection keeps mail recoverable and retained for as long as you need it. That means tested backups, a retention policy and, where required, an archive. Backup and archiving solve different problems; see email archiving vs backup. It also covers continuity: what happens to inbound mail while your server is down. See what happens to email when the server is down.

7. People and process

People and process controls catch what technology misses. The CISA-led guidance recommends regular training on suspicious emails and on "the importance of reporting." Two processes matter most: an easy report button, and a rule that any new or changed bank details are confirmed by phone on a number you already hold.

Is built-in email security enough?

Built-in email security is a solid base, but whether it's enough depends on how much junk and phishing still reaches your users and how much control you need. Microsoft 365 and Google Workspace both filter spam, malware and phishing, and both support SPF, DKIM, DMARC, TLS and MFA. What differs is the depth of filtering, the quarantine experience, and what happens when the platform itself is the target.

If you're deciding, start with evidence: count the phishing emails users report each month and review your quarantine. Then compare options with Microsoft 365 built-in filtering vs a gateway and how to choose a spam filter.

How do you get started with email security?

Start with the controls that block the most damage for the least effort, then work down the list. This order suits most small businesses:

1. Turn on MFA for every mailbox, starting with admins, finance and executives.
2. Publish SPF and turn on DKIM for every service that sends as your domain.
3. Publish DMARC at p=none, read the reports for a few weeks, then move to quarantine and reject. Our DMARC none to reject guide has the timeline.
4. Lock down parked domains that never send mail with v=spf1 -all and p=reject.
5. Review inbound filtering: quarantine settings, attachment-type blocking and macro blocking.
6. Write a payment verification rule and tell everyone who handles money.
7. Set up reporting with a report button, and run short training twice a year.
8. Back up mailboxes and test a restore.
9. Write it down. An email security policy template gives staff one place to find the rules.
10. Write a one-page incident plan. Our email security incident response plan is a template.

For the full version with explanations, use the small business email security checklist.

How do you know if your email security is working?

You know your email security is working when you can measure it: DMARC reports show every legitimate sender passing, reported phishing goes down over time, and nothing important sits in quarantine unnoticed. Check your DNS records every quarter, read DMARC aggregate reports, and track user reports and false positives. Our guide to email security metrics for admins lists the numbers worth tracking.

Next steps

• Run the free Email Health Check to see your MX, SPF, DKIM, DMARC and MTA-STS status in one place.
• Check MFA coverage in your admin console today.
• Pick the first three items from the procedure above and give each one an owner and a date.
• If inbound filtering is your weak spot, iBlockSpam filters spam, phishing and malware at the MX level, with personal quarantine and outage spooling. See how it works and pricing.