Five settings to check in your business email this week

Whether your business email runs on Microsoft 365, Zoho Mail, Google Workspace or another service, the same few settings decide how easily an account can be taken over. Check them in the admin area of your mail service.

The five checks

1. Second sign-in step: is it required for every user, especially owners, finance and administrators?
2. Forwarding rules: look for rules that send copies of mail to an outside address. Attackers set these up to watch an account quietly.
3. Administrator accounts: how many are there? A person who does not need one should not have one, and every one needs the second sign-in step.
4. Sender protection (SPF, DKIM and DMARC): these records in your domain's DNS tell other mail systems which servers may send as you. They make it harder to fake your address. Ask your provider to check them.
5. Old and shared accounts: close accounts of people who left, and replace shared logins with shared mailboxes where your service offers them.

How often

Check them now, then every few months and whenever someone joins or leaves. Keep a short written record of what you found.