Yesterday's post was the setup checklist for a new business. This one is for the business that set email up years ago and has not looked since. The mistakes below are the ones that turn up on Microsoft 365 and Google Workspace tenants at small and medium companies, and none of them is exotic. Each one is a sensible-looking decision that was not revisited: an allow list added to stop a complaint, a text-message code chosen because it was easy, an admin account that became someone's daily mailbox. For each mistake, this post gives the vendor's own position in its own words, and the fix, which in nearly each case is a setting rather than a purchase.
In short: stop allow-listing whole domains; audit the Safe Senders lists; move the second factor off text messages; treat an unexpected sign-in prompt as an attack, not a glitch; stop sharing admin accounts and create the two emergency ones; close automatic forwarding to outside addresses; move DMARC off p=none and make the filter act on failures; add each third-party sender to the records; give the quarantine an owner before the fifteen-day clock deletes the evidence on a default Microsoft tenant; and turn on the protection already included in the suite.
1. Allow-listing a whole domain, or your own
The classic sequence: a supplier's invoice lands in junk, someone complains, an admin adds the supplier's entire domain to the allowed list, and from then on anyone who can spoof that domain reaches the inbox. Microsoft's safe sender guidance carries a caution box for this: "This method creates a high risk of attackers successfully delivering email that would otherwise be filtered." It also says "Don't use popular domains (for example, microsoft.com) in allowed domain lists," and for mail flow rules, "Don't use domains you own (also known as accepted domains) or popular domains (for example, microsoft.com) as conditions in mail flow rules. Doing so creates opportunities for attackers to send email that would otherwise be filtered."
Two things soften the damage but do not remove it: since September 2022 an allowed entry for one of your own domains "must pass email authentication checks to skip spam filtering," and "Messages that are identified as malware or high confidence phishing are always quarantined, regardless of the allowlist option you use." For an outside domain, Microsoft says the senders bypass spam, spoof and phishing protection and sender authentication, high confidence phishing excepted. On Google Workspace the approved senders list does the same job: messages from those addresses "bypass Gmail's spam filters." The fix is to allow a specific sending address when you must, with a review date, and to ask the supplier to fix its own SPF and DKIM instead, which is usually why its mail was failing.
2. Safe Senders lists left unaudited
The per-mailbox version of the same mistake. Outlook lets each person maintain a Safe Senders list, and entries there bypass filtering for that mailbox. Microsoft's own description: "This method isn't desirable in most situations since senders bypass parts of the filtering stack," and "Although you trust the sender, the sender can still be compromised and send malicious content." A message that passes this way carries the header value SFV:SFE, which Microsoft explains "indicates that filtering for spam, spoof, and phishing (not high confidence phishing) was bypassed." At a company that has been on Microsoft 365 for five years, the finance mailbox can have dozens of entries added years ago by people who have since left. The fix is a one-time export and purge, announced to staff first, with any entry still needed moved to the Tenant Allow/Block List, which Microsoft calls its recommended option; after that, allow-listing happens at the tenant level with a reason recorded.
3. Text-message codes treated as "MFA done"
Turning on MFA was the right call; leaving it on SMS or voice is the mistake that has aged worst. Microsoft now states that "SMS and voice are no longer positioned as secure authentication methods and will no longer be provided natively in Entra ID," that "Starting September 1, 2026, passkeys become the default authentication experience and will be automatically enabled for users enabled for SMS or voice," and that "From February 1, 2027, Microsoft-provided telephony delivery for SMS and voice will be retired for all users except Global Administrators and external users." Its FAQ is blunter: "SMS and voice are among the most vulnerable authentication methods available today and provide significantly weaker protection against phishing and account compromise than passkeys." Google says the same for its side: "verification codes sent by texts or calls can be vulnerable to phone number-based hacks," and recommends Google prompts or a passkey instead. CISA's fact sheet on phishing-resistant MFA says this form of MFA "should only be used as a last resort MFA option." The fix is an authenticator app or a passkey for the whole company, starting with the admins and the finance team. While you are there, confirm legacy authentication (IMAP, POP and basic authentication) is blocked, since those paths skip the second factor entirely; Microsoft's page on the subject says basic authentication "is now disabled in all tenants" (the switch-off date was October 1, 2022), and security defaults block the older protocols.
4. Approving the prompt you did not start
The attacker already has the password; the second factor is the only thing in the way, so they send sign-in prompts until someone taps approve to make the phone stop.
Microsoft's name for this is MFA fatigue, and its page on protecting authentication methods says "As MFA fatigue attacks rise, number matching is critical to sign-in security," which is why "default behavior for number matching is explicitly Enabled for all Microsoft Authenticator users." Number matching helps only if people know what it is for. The fix is a one-line rule told to the whole company: a sign-in prompt you did not just cause is an attack, deny it and tell the admin, and the admin resets the password the same hour. Microsoft Entra's "Report suspicious activity" setting lets the person report the prompt from the Authenticator app; Microsoft then marks the account high risk and records the report in the sign-in and risk logs for the admin to act on.
5. One admin account, shared, used for daily mail
Three mistakes in one: the Global Administrator or super admin account is also someone's everyday mailbox, its password is known to two or three people, and there is no emergency account for the day that person leaves or is locked out. Microsoft: "As a best practice, Microsoft recommends that you assign the Global Administrator role to fewer than five people in your organization," and "Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the Global Administrator role." Google: "Don't share administrator accounts among users," "Require 2-Step Verification for admin accounts," and "Your organization should have more than one super administrator account, each managed by a separate individual." The fix is a named admin account per person, used only for admin work, plus two break-glass accounts with credentials stored offline.
Yesterday's checklist has the detail.
6. Automatic forwarding to personal mail still possible
A compromised mailbox is often quiet; the attacker adds a rule that forwards copies to an outside address and waits for an invoice thread worth hijacking. A tenant may still allow this because the setting was not touched after setup. Microsoft's page on the outbound spam policy explains that the "Automatic - System-controlled" default changed: "In 2021, the value changed to Off - Forwarding is disabled for new organizations and for existing organizations that weren't actively using the Automatic - System-controlled value," and then advises, "Because the behavior can differ by organization, configure On - Forwarding is enabled or Off - Forwarding is disabled instead of Automatic - System-controlled." An older tenant may still be on the permissive behavior. The fix is to set it to Off explicitly, and on Google Workspace to clear "Allow users to automatically forward incoming email" under Gmail, End User Access.
7. DMARC parked at p=none, and a filter that ignores failures
Publishing DMARC at p=none was the right first step, two years ago. Google's rollout guidance is to "Start with a policy set to none (no enforcement for 100% of messages)," and then: "After monitoring DMARC reports for at least a week and seeing no issues with your outgoing email, move to a quarantine policy for a small percentage of messages," increasing "over time to cover 100% of messages." A domain that stays at none has told the world's mailbox providers that forged mail in its name may be delivered. The second half of the mistake sits on the receiving side: a filter that sees a DMARC failure on incoming mail and takes no action on it. Check Point's documentation notes that "By default, No extra action is selected for DMARC failed emails in the Anti-Phishing security engine." The same page says an administrator can have those messages trigger the Suspected Phishing or Phishing workflow instead; the default leaves that choice to the administrator, and the page's own context is that organizations usually rely on Microsoft or Google to enforce rejection, so the default does not double up on them. The fix is on both sides: move your own policy up once the reports are clean, and decide on purpose what your filter does with other people's failures.
8. A third-party tool sending as your domain, missing from the records
The invoicing platform, the payroll provider, the CRM and the newsletter tool each send mail with your name on it. If one of them is not in SPF or signing with DKIM for your domain, its mail fails DMARC alignment, and as your policy tightens, your own invoices start landing in quarantine at your customers. Google's sender guidelines require, for each sender to Gmail, "Set up SPF or DKIM email authentication for your sending domains," and for those sending more than 5,000 messages a day, SPF, DKIM and DMARC together with the From domain aligned. The fix is a list of each tool that sends as you, checked against the SPF record and the DKIM selectors, and re-checked whenever a new tool is signed up. Our plain-words guide has the ten-minute check.
9. The quarantine goes unread, and it empties itself
The quarantine is where the evidence goes, and it does not keep it long. Microsoft's quarantine documentation gives the retention: for the anti-spam verdicts (spam, high confidence spam, phishing, high confidence phishing, bulk) it is "15 days" in the default policy and 30 days under the Standard and Strict presets; malware is held 30 days. Then: "When messages expire from quarantine after the retention period, the messages are permanently deleted and can't be recovered." Google Workspace: "Quarantined messages are stored in quarantine up to 30 days after sending," "If no action is taken on a quarantined message, the message is permanently deleted after 30 days," and "Recipients are never notified when a message is quarantined." So a legitimate contract that was quarantined on the first of the month is gone by the sixteenth on a default Microsoft tenant, and the targeted phishing attempt that should have triggered a password reset was not seen. The fix is an owner, a cadence, and quarantine notifications turned on for the mailboxes that matter.
10. The protection you already own is still switched off
Microsoft ships stronger filtering than the default and leaves it for the admin to enable; on Google Workspace, confirm the equivalent box is checked. Microsoft's preset security policies page: "Until you turn on the profiles and assign users to them, the Standard and Strict preset security policies are assigned to no one," and "During your first visit to the Preset security policies page, it's likely that Standard protection and Strict protection are turned off." Google Workspace has "Enhanced pre-delivery message scanning" under Gmail, then Spam, Phishing and Malware, which Google describes this way: "message delivery is slightly delayed so that Gmail can do additional security checks on the message." Turning these on costs a few minutes and no money; check existing custom policies first, since the Standard preset takes precedence over them.
Which ones to fix this week
If the list is long, take them in this order: mistakes three and four (the second factor and the prompt rule), then six (forwarding), then five (admin accounts), then nine (the quarantine owner). The allow lists, DMARC and the presets can be a planned project next month; the first five are an afternoon and close the doors that get used.
How to start
If you would rather have mistakes seven, nine and ten handled, and the rest checked, that is what Managed Email Security is: the Check Point license plus business-day quarantine review, release requests, investigation, a monthly summary and 24/7 support, with a one-time SaaS security posture report of your Microsoft 365 or Google Workspace tenant within the first 90 days at no charge, covering MFA and conditional access, admin and emergency accounts, external forwarding and sharing, allow lists, third-party app permissions, and SPF, DKIM and DMARC. It is $6.40 per user per month on the year-end offer ($5.60 for registered 501(c)(3) nonprofits; $8 list). The offer is 20% off (30% for registered 501(c)(3) nonprofits) on a 12-month Managed Email Security agreement signed by December 31, 2026, new customers only, no onboarding fee. If you already have an IT provider and only want the license, the license-only route explains how we beat a written quote, like for like. Either way, the free two-week email security assessment runs in Monitor only and shows you which of the ten are open on your tenant. We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. Book a free 15-minute call or see the services page.
Sources: Microsoft Learn, Create safe sender lists in EOP (updated 2026-07-24); Microsoft Learn, Passkeys by default and retirement of Microsoft-provided SMS and voice, and its FAQ (updated 2026-09-23); Microsoft Learn, Protecting authentication methods in Microsoft Entra ID (updated 2026-05-13) and How number matching works (updated 2025-11-06); Microsoft Learn, Best practices for Microsoft Entra roles (updated 2026-06-01); Microsoft Learn, Control automatic external email forwarding in Microsoft 365 (updated 2026-08-18); Microsoft Learn, Quarantined email messages in EOP and Defender for Office 365 (updated 2026-07-17); Microsoft Learn, Preset security policies (updated 2026-07-03); Google Workspace Admin Help, Allowlists, denylists, and approved senders; Security best practices for administrator accounts; Recommended DMARC rollout; Set up email quarantine; Help prevent phishing with pre-delivery message scanning (updated 2026-10-13); Google Account Help, Turn on 2-Step Verification; Google, Email sender guidelines; CISA, Implementing Phishing-Resistant MFA fact sheet (October 2022); Check Point, Harmony Email & Collaboration knowledge content, Blocking emails that fail DMARC; Microsoft Learn, Deprecation of Basic authentication in Exchange Online (updated 2026-07-16) and Security defaults in Microsoft Entra ID. Quotes are verbatim from those pages as read on October 20, 2026.
