Why email security matters so much
Many cyber incidents begin with email because it’s one of the easiest entry points for phishing, impersonation, credential theft and malware. Once an attacker gains access to a mailbox, they can reset passwords, impersonate staff, access sensitive information or target customers and suppliers using a trusted identity.
Attackers don’t even need access to cause harm. Without email authentication, anyone can send messages that appear to come from your domain. That’s why email security needs to be a core cyber priority, not just a mail configuration issue.
“Email is identity. Protect it like the critical system it is.”
What stronger email security involves
A secure business email environment combines several layers of protection:
- Microsoft 365 or Google Workspace security review and hardening.
- MFA and stronger identity controls.
- Protection against phishing, malicious links and attachments.
- Domain authentication: SPF, DKIM and DMARC at enforcement.
- Encrypted delivery with MTA-STS.
- Ongoing monitoring of who sends email as your domain.
- Staff awareness through ongoing training and phishing simulations.
Domain protection with SPF, DKIM, DMARC and MTA-STS
Domain authentication stops attackers sending email as you and helps your genuine email reach the inbox. We use Suped to see every service that sends email as your domain, configure each one correctly and move safely to enforcement.
- SPF & DKIM
- Every legitimate sender identified, authorised and aligned, with SPF kept within its 10-lookup limit.
- DMARC
- Staged rollout from monitoring to quarantine and reject, so spoofed email is blocked without disrupting genuine mail.
- MTA-STS
- Requires other mail servers to use encrypted, verified connections when delivering to your domain, with TLS reporting.
- Monitoring
- Alerts for new or unknown senders, authentication failures and blocklist issues, reviewed by our team.
How we move to DMARC enforcement
- Step 1 · Monitor
- Publish DMARC in monitoring mode and collect reports in Suped.
- Step 2 · Identify
- Find every legitimate and illegitimate sender.
- Step 3 · Fix
- Correct SPF and DKIM for legitimate services.
- Step 4 · Quarantine
- Send failing email to junk.
- Step 5 · Reject
- Block spoofed email entirely, and keep monitoring.
Email security as part of a wider environment
Email security doesn’t sit in isolation. It connects directly to identity, device security, business continuity, onboarding and broader cyber maturity. Improving it has flow-on benefits across the business — and weak email security can undermine other controls if left unattended.
Compromised Microsoft 365 accounts are covered by identity protection, and staff awareness through Security Awareness Training.
How EduCom IT helps with email security
- Review
- Mailbox, tenant, domain and rule-level review for current exposure.
- Configure
- Safe Links, Safe Attachments and anti-phishing policies in Microsoft 365.
- Authenticate
- SPF, DKIM and DMARC through to enforcement, plus MTA-STS, managed in Suped.
- Monitor
- Ongoing domain monitoring for new senders, failures and blocklists.
- Identity
- MFA rollout, account hardening and removal of legacy authentication.
- Respond
- Support after suspicious email activity, compromise or attempted fraud.
- Awareness
- Huntress Security Awareness Training and phishing simulations for your staff.
Frameworks it supports
Email security contributes to several frameworks. Coverage depends on your environment, so we confirm it during a gap review.
- ASD Essentials
- Content filtering, identity and access management, cryptographic protection of data in transit, and awareness training. ASD also recommends SPF, DKIM and DMARC to combat fake emails.
- CIS v8.1
- Control 9 (email and web browser protections), including Safeguard 9.5 (implement DMARC).
- ISO 27001
- Annex A 5.14 (information transfer) and 8.24 (use of cryptography).
- SMB1001
- Technology management email security controls.
Frequently asked questions
What is business email compromise (BEC)?
BEC is when an attacker gains access to or impersonates a business mailbox to redirect payments, harvest information or trick suppliers and customers. It’s one of the most financially damaging attack patterns Australian businesses face.
What are SPF, DKIM and DMARC?
They’re domain-level email authentication records. SPF says which servers can send for your domain, DKIM cryptographically signs messages, and DMARC tells receivers what to do when checks fail. Together they reduce spoofing and improve deliverability.
Will DMARC block our real email?
Not when it’s rolled out in stages. We start in monitoring mode, use Suped to find every service sending as your domain, fix SPF and DKIM for each one, and only then move to quarantine and reject.
What is MTA-STS?
MTA-STS tells other mail servers they must use an encrypted, verified connection when delivering email to your domain, helping prevent interception and downgrade attacks. TLS reporting alerts you to delivery problems.
Why does domain authentication matter now?
Major providers including Google and Yahoo now require SPF, DKIM and DMARC for bulk senders, and ASD recommends email authentication to combat fake emails. Without it, your domain is easier to spoof and your email is more likely to land in junk.
Do we still need extra protection if we’re on Microsoft 365?
Microsoft 365 includes good baseline protection, but it isn’t enabled to full effect by default. We configure Safe Links, Safe Attachments, anti-phishing policies and tenant-level hardening to lift the protection floor.
How do you handle phishing reports from staff?
We enable a one-click report button, route reports through Microsoft 365 or Google Workspace tooling, and tune policies based on what’s getting through. Reporting is a useful signal — we don’t want staff to ignore it.
What happens if a mailbox is compromised?
We help with the immediate response: forced password reset, MFA re-enrolment, review of mailbox rules and forwarders, audit log review for data exposure, and notifying affected parties where required. We then strengthen the controls that allowed it.
How can we train staff to spot phishing?
We deploy Huntress Security Awareness Training: short lessons staff complete at their own pace, plus regular phishing simulations and completion reporting. It works better than one-off training and isn’t punitive.