A comprehensive email security checklist with real DNS record examples for SPF, DKIM, DMARC, MTA-STS, BIMI, and DANE configuration. Covers anti-phishing, anti-spoofing, and email authentication hardening for organizations of all sizes.
- Why Email Security Matters
- SPF (Sender Policy Framework)
- DKIM (DomainKeys Identified Mail)
- DMARC (Domain-based Message Authentication)
- MTA-STS (Mail Transfer Agent Strict Transport Security)
- BIMI (Brand Indicators for Message Identification)
- DANE (DNS-based Authentication of Named Entities)
- Anti-Phishing Controls
- Anti-Spoofing Controls
- Microsoft 365 Email Security
- Google Workspace Email Security
- Email Security Audit Checklist
- About Petronella Technology Group
Email remains the primary attack vector for phishing, business email compromise (BEC), and malware delivery. Over 90% of cyberattacks start with a phishing email. BEC attacks alone caused over $2.7 billion in losses in a single year according to FBI IC3 reports.
Proper email authentication prevents domain spoofing, improves deliverability, and protects your organization's reputation. This guide walks through each layer of email security with real configuration examples.
SPF tells receiving mail servers which IP addresses and hosts are authorized to send email on behalf of your domain.
- You publish a TXT record in DNS listing authorized senders
- Receiving servers check the sending IP against your SPF record
- Messages from unauthorized IPs fail SPF validation
Basic SPF for Microsoft 365:
example.com. TXT "v=spf1 include:spf.protection.outlook.com -all"
SPF for Google Workspace:
example.com. TXT "v=spf1 include:_spf.google.com -all"
SPF with multiple senders (M365 + Mailchimp + custom server):
example.com. TXT "v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ip4:203.0.113.25 -all"
- Use
-all(hard fail) instead of~all(soft fail) once you have confirmed all legitimate senders - Keep DNS lookups under 10 (SPF has a 10-lookup limit)
- Use
include:for third-party services rather than listing individual IPs - Do not use the
ptrmechanism (deprecated and slow) - Audit SPF records quarterly to remove decommissioned services
- Use an SPF flattening tool if you approach the 10-lookup limit
# Query SPF record
dig +short TXT example.com | grep spf
# Test SPF lookup count
nslookup -type=txt example.comDKIM adds a cryptographic signature to outgoing emails, allowing receivers to verify the message was not altered in transit and was sent from an authorized system.
- Your mail server signs outgoing messages with a private key
- The public key is published as a DNS TXT record
- Receiving servers verify the signature against the public key
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2K..."
- Use 2048-bit RSA keys minimum (1024-bit keys can be cracked)
- Rotate DKIM keys annually
- Sign with a domain-specific selector (e.g.,
selector1._domainkey.example.com) - Enable DKIM for all sending sources (primary mail, marketing platforms, transactional email)
- Test DKIM signatures using mail-tester.com or
dkimvalidator.com
# Check DKIM record for Microsoft 365
dig +short TXT selector1._domainkey.example.com
# Check DKIM record for Google Workspace
dig +short TXT google._domainkey.example.comDMARC builds on SPF and DKIM by telling receiving servers what to do when authentication fails and where to send reports.
- Receiving server checks SPF and DKIM alignment
- If both fail, the DMARC policy determines the action (none, quarantine, reject)
- Aggregate and forensic reports are sent to specified addresses
Monitoring mode (start here):
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensics@example.com; pct=100"
Quarantine mode (after monitoring shows clean results):
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; pct=100"
Reject mode (full enforcement):
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100; adkim=s; aspf=s"
| Phase | Policy | Duration | Purpose |
|---|---|---|---|
| 1 | p=none |
2-4 weeks | Monitor and identify all legitimate senders |
| 2 | p=quarantine; pct=25 |
2 weeks | Quarantine 25% of failing messages |
| 3 | p=quarantine; pct=100 |
2 weeks | Quarantine all failing messages |
| 4 | p=reject |
Ongoing | Reject all unauthenticated messages |
- Start with
p=noneand analyze reports before enforcing - Use a DMARC report analyzer (e.g., Postmark, Valimail, dmarcian) to parse XML reports
- Set
adkim=sandaspf=sfor strict alignment once all senders are compliant - Configure
ruafor aggregate reports andruffor forensic reports - Apply DMARC to all domains you own, including parked domains
- Parked domains should use
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
MTA-STS forces sending servers to use TLS when delivering mail to your domain, preventing TLS downgrade attacks and man-in-the-middle interception.
Step 1: Create the policy file at https://mta-sts.example.com/.well-known/mta-sts.txt:
version: STSv1
mode: enforce
mx: mail.example.com
mx: *.example.com
max_age: 604800
Step 2: Publish the DNS record:
_mta-sts.example.com. TXT "v=STSv1; id=20260401T000000"
Step 3: Enable TLS reporting (TLS-RPT):
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"
- Start with
mode: testingbefore switching tomode: enforce - Update the
idvalue in the DNS record whenever you change the policy file - Ensure all MX hosts have valid TLS certificates
- Configure TLS-RPT to receive delivery failure notifications
BIMI displays your brand logo next to authenticated emails in supported mail clients (Gmail, Apple Mail, Yahoo).
- DMARC policy must be
p=quarantineorp=reject - Logo must be in SVG Tiny PS format
- A Verified Mark Certificate (VMC) is recommended for Gmail display
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"
DANE uses DNSSEC to associate TLS certificates with your mail server, providing an alternative to traditional certificate authorities.
_25._tcp.mail.example.com. TLSA 3 1 1 abc123def456...
- DNSSEC must be enabled for your domain
- TLSA records must match the certificate on your mail server
- Monitor TLSA records for expiration alongside certificate renewal
- Enable Safe Links -- URL rewriting and time-of-click verification (M365 Defender)
- Enable Safe Attachments -- Sandbox detonation for email attachments
- External sender tagging -- Add [EXTERNAL] tags or banners to emails from outside the organization
- Display name spoofing protection -- Alert on emails where the display name matches an executive but the address does not
- Homoglyph detection -- Block or flag emails from domains using lookalike characters
- QR code phishing detection -- Scan QR codes in email bodies and attachments
- Link preview disabled -- Prevent automatic URL fetching that may trigger malicious payloads
- Report phishing button -- Deploy a one-click phishing report button in all email clients
- SPF, DKIM, and DMARC fully deployed -- All three must be in place for effective anti-spoofing
- Reject policy on all domains -- Including parked and inactive domains
- Inbound DMARC enforcement -- Configure your mail gateway to honor DMARC reject policies from other senders
- Lookalike domain monitoring -- Use a domain monitoring service to detect typosquatting
- Mail flow rules for impersonation -- Block or quarantine emails impersonating executives or partners
- Null MX for non-mail domains -- Publish
example.com. MX 0 .for domains that should never receive email
- Enable Microsoft Defender for Office 365 (Plan 2 recommended)
- Configure anti-phishing policies with mailbox intelligence
- Enable Safe Links for email, Teams, and Office apps
- Enable Safe Attachments with dynamic delivery
- Configure outbound spam policies with sending limits
- Enable audit logging for all mailbox activities
- Restrict mail forwarding rules (block auto-forwarding to external addresses)
- Configure connection filtering with IP allow/block lists
- Enable advanced phishing and malware protection in Admin Console
- Configure enhanced pre-delivery message scanning
- Enable security sandbox for attachments
- Restrict external email forwarding
- Enable Gmail confidential mode for sensitive communications
- Configure compliance rules for DLP (credit card numbers, SSNs)
- Enable email delegation audit logging
| Control | Status | Priority |
|---|---|---|
SPF record with -all |
Critical | |
| DKIM enabled for all senders | Critical | |
DMARC at p=reject |
Critical | |
| MTA-STS enforced | High | |
| TLS-RPT configured | Medium | |
| BIMI with VMC | Low | |
| External sender tagging | High | |
| Safe Links / URL protection | High | |
| Safe Attachments / sandbox | High | |
| Phishing report button deployed | High | |
| Auto-forwarding restricted | Critical | |
| Lookalike domain monitoring | Medium | |
| Parked domains with reject policy | High |
Contributions are welcome. Please open an issue or submit a pull request with improvements, additional configurations, or corrections.
This project is licensed under the MIT License. See LICENSE for details.
Need expert help hardening your email security? Petronella Technology Group provides:
- Managed IT Services - 24/7 monitoring and management
- Cybersecurity Assessments - Comprehensive security audits
- Network Security - Firewall, IDS/IPS, segmentation
- AI-Powered Security - Next-gen threat detection
Petronella Technology Group is a CMMC-RP certified cybersecurity firm in Raleigh, NC. Contact us or call (919) 348-4912.
This guide is maintained by Petronella Technology Group, Inc. -- a cybersecurity and IT services firm specializing in email security, compliance (CMMC, HIPAA, SOC 2, NIST), and managed IT for businesses across the United States.
- Website: https://www.petronellatech.com
- Book a consultation: https://book.petronella.ai
- Phone: (919) 348-4912
- LinkedIn: Petronella Technology Group