What is email security?

Email security means protecting your email account, your inbox, your messages on their way and your domain's name from misuse. In practice, it helps keep criminals from reading your email or sending email as you. It also makes it harder for fake emails to use your name to trick your customers.

Why email security matters for your business

Email isn't fully secure on its own. Passwords leak, fake emails can look real and some phishing attacks will always get past the filters. These are the main email threats and what they can do to a business:

• A criminal who gets into your account can read private information and send messages that pretend to be from you.
• A criminal can also fake email from your domain without getting in. This is called spoofing: a fake sender address on your domain makes a scam look as if it comes from you, which can hurt your reputation with customers.
• Some spam emails carry scams that try to get you to click a link, which can take you to a website that downloads a virus or steals your passwords. Malware, short for "malicious software", covers viruses, spyware, trojans and ransomware.
• If your inbox holds customers' names, addresses or orders, a leak puts their personal data at risk too. UK GDPR requires you to protect that data with security that fits the risk.

Email security best practices

Some of these practices are habits for you and your team. Others are settings you check once, such as the login alerts in our webmail and the spam filter that comes with our business email.

Use a strong, separate password

Your email password needs special care, because whoever has it can reset the passwords of your other accounts. Use it for your email only, so a leak somewhere else can't open your inbox. The National Cyber Security Centre (NCSC) suggests combining three random words for a password that's long enough and strong enough. A password manager can create strong passwords for you and remember them.

Turn on 2-step verification

2-step verification, also known as 2FA, asks for a second check after your password, such as a code on your phone. It helps keep criminals out of your account even if they know your password. The NCSC recommends it for your email and your other important accounts. With us, 2-step verification is for your control panel login, and you can use our Companion app or Google Authenticator for it. For your email login itself, a strong password and the login alerts below help protect you.

Set up login alerts

In our webmail, you can switch on login alerts. You then get a text message whenever someone logs in to your email account from another country. If you travel a lot, add the countries you trust, so they don't set off an alert.

If an alert comes in and it wasn't you, change your password straight away. Then check that nobody has added a forwarding rule or an automatic reply, and change the password of any other account that uses the same password or uses this address for resets. Our guide on what to do if your email password is leaked covers the rest.

Check that your email app uses SSL/TLS

In email, SSL/TLS encrypts the connection between your email app and the mail server, so nobody in between can read your emails on the way. To check it, open the server settings of your email account in the app. Look for the security or encryption setting of the incoming and the outgoing server, and choose the encryption your email provider gives for each server. Do this when you set up a new device, and check the devices you already use too. Between mail servers, TLS protects your emails as well, as long as both servers support it.

Keep the spam and virus filter on

Our virus and spam filter checks every email that arrives in your account. Spam goes to your Spam folder, and an email with a known virus or other harmful content is deleted. The filter is on by default when you create an account, and it's worth leaving it on. Check your Spam folder now and then, in case a real email ended up there.

Learn to spot phishing and report it

Before you open a link or an attachment, check who really sent the email. Look at the sender's full address, not just the name, and be wary of anything that asks for a password or bank details. Our guide to phishing emails shows the signs to look for.

If you don't recognise the sender or an email looks suspicious, don't click any of its links. Forward it to report@phishing.gov.uk, and the NCSC will investigate it. You can leave out the ones already in your Spam folder.

Train your team

If you have staff, train them as well, because one person who clicks the wrong link can let a criminal in. Make sure everyone can spot a phishing email, knows where to report it and understands why a separate password matters. Don't rely on training alone, though: some phishing emails will always get through, so the settings above still count.

Keep your software up to date

Updates to your computer, phone and email app include protection from viruses and other malware. Install them as soon as they're available, and turn on automatic updates where your device offers them, so you don't have to remember.

Our email plans include spam and virus filtering, alerts for logins from other countries and daily backups for every inbox.

How SPF, DKIM and DMARC protect your domain

Spoofing works because an email can show an address on your domain as the sender, even when you didn't send it. Three DNS records let receiving mail servers check whether an email really comes from your domain, each in its own way.

• SPF (Sender Policy Framework) lists the mail servers that are allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server uses it to check that the email came from your domain and wasn't changed on the way.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) uses the SPF and DKIM results and tells receiving servers what to do with an email that fails them. It can also send you reports on email sent in your domain's name.

Together, they make it more difficult to send fake email from your domain. Your own emails are also more likely to reach the inbox instead of the spam folder. They can't stop spoofing completely, because not every receiving server checks them.

What a DMARC record tells other mail servers

A DMARC record is a text (TXT) record in your domain's DNS. Its policy tells receiving mail servers what to do with an email that fails DMARC:

• p=none is monitoring only. No specific action is asked for failed emails, so you can see what happens before you tighten anything.
• p=quarantine asks for failed emails to be treated as suspicious, for example by moving them to the spam folder.
• p=reject asks for failed emails to be rejected.

If you set up your own DMARC record, start with p=none while you check that your real emails pass. Once you're confident they do, move to p=quarantine or p=reject. Your domain should only have one DMARC record.

How to switch on SPF, DKIM and DMARC with us

Name servers tell the internet where your domain's DNS settings are kept. If your domain uses ours and your email is with us, most of the work is already done:

1. Check that your domain uses our name servers. Your MX record, which tells other servers where to deliver your email, then points to our mail servers by default and DKIM is on, so there's nothing to set for either.
2. In your DNS settings, switch on the standard SPF record if it is off.
3. Switch on the standard DMARC record if it is off.
4. Allow up to 90 minutes before the change is active. It can take longer to reach everyone: often a few hours, and up to 72 hours.

If you want a different policy or DMARC reports, add a custom DMARC record instead, and the standard one is switched off automatically. If a different company manages your domain's DNS and your email is with us, you set the records with that company instead. There, you note down the current MX records before you replace them with ours, and add our SPF and DKIM records. Our support gives you the DKIM values your domain needs. These changes usually take up to 240 minutes to take effect, so send a test email after that.

Start by checking that the standard SPF and DMARC records are on for your domain, then work through the practices above with your team. If you still send from a free address, professional email on your own domain gives you a domain that SPF, DKIM and DMARC help protect.