E-Mail Security
E-Mail Anti-Spoofing & Trust Collection
Email security and anti-spoofing A guide for IT managers and systems administrators This guidance assumes readers have prior knowledge and experience ...
Configure DMARC, DKIM, and SPF
Configure anti-spoofing controls Configure anti-spoofing controls by implementing DMARC, creating and iterating an SPF record and creating and managin...
Protect against phishing, malware, and frauds
Phishing attacks: defending your organization provides a multi-layered set of mitigations to improve your organization ’s resilience against phish...
Choose an anti-spoofing management tool
Implementing controls to secure your domains and emails in transit can generate a lot of data. There are a number of open source and commercial tools...
Protect email in transit
Although it is possible to encrypt individual emails using protocols like PGP or S/MIME , this requires the sender and recipient to have the necess...
Configure anti-spoofing controls
Implement a DMARC policy of ‘none’ Create and iterate an SPF record including your mail email senders Create and manage a DKIM record for all of...
Reject spoof emails
At this point you should have identified and resolved any issues arising during the “quarantine phase” . As soon as you are confident DKIM and SPF ar...
Mark spoof emails as spam
During the ‘quarantine phase,’ any failed email will be sent to spam/junk (where the recipient has this enabled). This means the messages are recov...
Continuous improvement
In order to ensure that legitimate emails aren’t lost, and that old systems can’t be used to spoof email from your domains, you should put processes i...
Guidance for websites, mass e-mail campaigns, and fax
Major mail systems today, such as Exchange Online or Gmail, enforce a number of controls designed to thwart the spread of ransomware, reduce the chanc...
Only correct way to report phishing (Microsoft Outlook, M365)
The procedures in this section require the Microsoft Report Message or Report Phishing add-ins. For more information, see Enable the Microsoft Report...
Only correct way to report phishing (Google Workspace, GMail)
When we identify that an email may be phishing or suspicious, we might show a warning or move the email to Spam. If an email wasn't marked correctly, ...
Manage inbound requests, website contact forms, and the like
Guidance for websites, mass e-mail campaigns, and fax Major mail systems today, such as Exchange Online or Gmail, enforce a number of controls designe...