Guide
Outbound email security checklist for small teams
Most email security advice is about what arrives: phishing, malware, spam. This checklist covers the other direction: making sure the email your organization sends is really from you, sent by the right people, checked when it matters, and on record.
- For
- Founders, operations leads and IT generalists at teams without a dedicated security team
- By
- The SecureThread team at ArcByte Studios
- Updated
- Reading time
- 10 min read
The short answer
- Publish SPF, DKIM and DMARC for every domain you send from, and read your DMARC reports.
- Give everyone their own sign-in with two-step verification; never share a mailbox password.
- List everything that sends as you: people, apps, scripts and AI agents. Remove what you do not use.
- Hold the riskiest messages for a second person, and stop sensitive data before it is queued.
- Set sending limits below your provider’s, and know how you would stop all sending at once.
- Keep a record of who sent what and who allowed it.
1. Prove the mail is from you#
Mailbox providers judge a message by the DNS records of the domain in its From address. Since February 2024 Gmail requires every sender to authenticate with SPF or DKIM, and senders of more than 5,000 messages a day to Gmail addresses need SPF, DKIM and DMARC, aligned From domains, and one-click unsubscribe on marketing mail. Yahoo publishes similar requirements.
- Publish an SPF record that lists every service allowed to send for the domain, and nothing else.
- Turn on DKIM signing at each service that sends for you (your mailbox provider and any sending API).
- Publish a DMARC record. Start with
p=noneand a reporting address you actually read; move toquarantineorrejectonce reports show your legitimate mail passing. - Repeat for every domain and subdomain you send from, including the one your newsletter tool uses.
- Add one-click unsubscribe (RFC 8058) to bulk and marketing mail.
- Check the records again whenever you add a sending service. A new tool is the most common reason SPF breaks.
2. Control who can send#
- Give every person their own account. Shared passwords to a shared mailbox make it impossible to know who sent what, or to remove one person's access.
- Turn on two-step verification for everyone, and phishing-resistant methods such as passkeys for administrators where you can.
- Grant send-as rights only to people who need a mailbox for their job, and review them when roles change.
- Remove access on the day someone leaves, including app passwords and connected apps.
- Keep the number of administrators small, and make administrative actions need a fresh second sign-in step.
3. Know everything that sends as you#
People are not the only senders. Make a list of:
- apps and scripts with SMTP credentials or API keys;
- OAuth apps granted permission to send from a mailbox;
- automation tools (Zapier, Make, n8n, scheduled jobs);
- AI assistants and agents connected to a mailbox.
For each one: who owns it, which mailbox it uses, what it is allowed to do, and when it was last used. Revoke anything nobody can explain. Prefer credentials that can be scoped and revoked one at a time over a mailbox password. For AI agents in particular, see how to let an AI agent send email safely.
4. Check what leaves#
- Decide which messages need a second person before they go: campaigns, scheduled sends, automated runs, mail with attachments to outside recipients, and anything an AI assistant wrote. Design the approval workflow so the approval is tied to the exact message.
- Catch sensitive data before it is sent: payment card numbers, government ID numbers (in India, Aadhaar and PAN), passwords and access keys.
- Decide which attachment types may leave at all.
- Clean HTML from templates and imported designs, so no scripts, forms or remote content ride along.
5. Limit the blast radius#
- Set daily and hourly sending limits below your provider's own, so a runaway script hits your limit before it damages your reputation.
- Warm up a new sending domain gradually instead of sending a full campaign on day one.
- Keep a suppression list of addresses that bounced or unsubscribed, and honour it everywhere you send from.
- Know how to stop all sending at once, and who is allowed to.
6. Keep a record and a plan#
- Keep an audit trail of who sent what, who approved it, and who changed the rules. See what an email audit trail should record.
- Record provider responses as accepted or refused; accepted is not delivered.
- Write down what to do when the wrong email goes out: a sent message generally cannot be recalled, so the plan is about notifying the right people quickly, correcting the record, and finding out how it happened.
- Publish a security contact (a security.txt file, RFC 9116) so people can report problems with your mail.
How SecureThread helps#
SecureThread covers the sending side of this list for the mailboxes you already use: each person signs in as themselves, administrators approve every SMTP server, sending domains are checked for an ownership record, SPF, DKIM and DMARC before mail goes out, approvals are tied to the exact draft, guardrails catch card, Aadhaar and PAN numbers, passwords and access keys, quotas and an emergency switch limit sending, and an append-only audit log records it all. It does not filter inbound mail; keep your provider's protection for that. Read more about outbound email security or the sending domains guide.