How to run an email security audit for your company
2 min read · Updated October 15, 2026
Inventory your mailboxes and domains, check which addresses appear in breaches, verify MFA and password practices, review forwarding rules and connected apps, test SPF, DKIM and DMARC and assess staff training and incident response. Prioritise fixes by risk and repeat regularly.
Step 1: build an inventory
List every domain, mailbox, shared inbox and service that sends email on your behalf. Include admins and former employees. You cannot secure what you have not listed.
Step 2: measure exposure
Check your addresses and domain against known breach data to see who is exposed, in which incidents and what data was involved. Leakill’s corporate email security audit is designed for this step.
See how exposed your team’s email is
Leaked work emails fuel phishing and account takeover. Review your company’s exposure with a corporate audit.
Step 3: test the controls
- ✓MFA coverage across mailboxes and admin roles.
- ✓Password policy and use of a password manager.
- ✓Forwarding rules, connected apps and delegated access.
- ✓SPF, DKIM and DMARC configuration.
- ✓Logging and alerts for suspicious sign-ins.
Step 4: check people and process
Ask whether staff know how to report phishing, whether payment changes require verification and whether there is a clear incident plan. Test with a simulated exercise if you can.
Step 5: fix and repeat
Create an action list with owners and dates, then repeat the audit on a schedule, such as every quarter or after major changes.
Frequently asked questions
How long does an email audit take?+
For a small business, a basic audit can be done in a few days. Larger organisations take longer.
Can we do it ourselves?+
Yes, for the basics. Consider outside help for complex environments or compliance needs.
What should we do first?+
Measure exposure and enforce MFA. Both are fast and high-impact.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.