Email security checklist for small businesses
2 min read · Updated October 15, 2026
Make multi-factor authentication mandatory, use a company password manager, set up SPF, DKIM and DMARC, limit admin rights, check staff emails for breaches regularly, train people on phishing and payment fraud, and have a short incident plan ready.
Accounts and access
- ✓Mandatory two-factor authentication for every mailbox.
- ✓Separate admin accounts for administrators, and as few as possible.
- ✓Unique passwords through a team password manager.
- ✓Prompt removal of access when someone leaves.
Domain and mail protection
- ✓SPF, DKIM and DMARC records for your domain.
- ✓Spam and malware filtering turned on and tuned.
- ✓Alerts for new forwarding rules and unusual sign-ins.
- ✓External-sender banners to flag mail from outside the company.
See how exposed your team’s email is
Leaked work emails fuel phishing and account takeover. Review your company’s exposure with a corporate audit.
People and process
- ✓Short phishing training with realistic examples, repeated regularly.
- ✓A rule that payment and bank-detail changes are verified by phone.
- ✓An easy way to report suspicious emails.
- ✓A one-page incident plan: who to call and what to lock down first.
Monitoring and review
Check company addresses against known breaches every quarter and after supplier incidents. Review who has access, which apps are connected to mailboxes and whether forwarding rules are in place.
Start this week
- 1Turn on MFA for all mailboxes.
- 2Roll out a password manager and retire reused passwords.
- 3Check SPF, DKIM and DMARC records for your domain.
- 4Write the payment-verification rule and tell everyone.
- 5Run an exposure check on staff email addresses.
- 6Schedule a 30-minute phishing briefing.
Frequently asked questions
What is the single most effective step?+
Mandatory two-factor authentication across email and key apps.
Do we need a security team?+
Not to get started. The basics here are achievable by one person in a few days.
How do we know if staff are exposed?+
A corporate breach check shows which addresses appear in known leaks.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.