A new business usually gets email on day one and email security on the day something goes wrong. The gap between those two days is where the first invoice fraud attempt, the first forged message in the company's name, and the first shared password tend to land. This checklist closes the gap in order: ten settings and habits, from the ones that take five minutes in the admin console to the two that need a person's name next to them. It is written for Microsoft 365 and Google Workspace, since one of the two runs the mail at the small and medium businesses we meet, with few exceptions, and each item says where the switch lives. Items one through seven, nine and ten require no purchase. The one item that involves a product, number eight, is about how to turn one on without breaking mail flow.
In short: turn on MFA for the whole company and start with the admins; keep admin accounts few, separate and known; publish SPF, DKIM and DMARC; switch off automatic forwarding to outside addresses; lock the shared mailboxes; when you add a dedicated filter, run it in Monitor only first; give the quarantine an owner; and put a monthly review on the calendar. Items one through seven are settings. Item eight is a product, introduced carefully. Items nine and ten are habits, and the habits are the part that slips.
1. Multi-factor authentication for the whole company, admins first
A password alone is the weakest control on the list, and it is the one attackers test first. Both suites can require a second factor for the whole company. In Microsoft 365, the simplest route is security defaults, which Microsoft describes as "Requiring all users to register for multifactor authentication" and "Requiring administrators to do multifactor authentication," along with "Blocking legacy authentication protocols." Microsoft also notes that "Microsoft 365 tenants created after October 2019 have security defaults turned on by default," so a new tenant may already have this; check rather than assume. Under security defaults, Microsoft decides when non-admin users are prompted; if you want to control when the second factor is required, Conditional Access (included with Business Premium) is the route. In Google Workspace, the Admin console path is Security, then Authentication, then 2-step verification, where an admin can "Allow users to turn on 2-Step Verification" and then set enforcement to "On" or "Turn on enforcement from date." Google adds a plain warning: "Important: Google is enforcing 2SV for administrator accounts." Use an authenticator app or a hardware key rather than text messages where you can; the point is that a stolen password alone no longer opens a mailbox.
2. Admin accounts: few, separate, and two in reserve
An admin account that is also someone's daily mailbox is a phishing target with the keys attached. Microsoft's guidance for Entra roles is direct: "As a best practice, Microsoft recommends that you assign the Global Administrator role to fewer than five people in your organization." Microsoft also recommends "two cloud-only emergency access accounts permanently assigned the Global Administrator role," accounts that "aren't assigned to specific individuals," kept for the day the usual admin is locked out. Google says the same for its side: "Super administrators should use a separate, non-admin account for day-to-day activities," and "Your organization should have more than one super administrator account, each managed by a separate individual." For a ten-person company that means two or three named admin accounts used only for admin work, plus the break-glass accounts with their credentials stored offline.
3. SPF: list who may send as you
SPF is a DNS TXT record naming the servers allowed to send mail for your domain. Your suite publishes the value to paste; add any third-party tool that sends in your name (invoicing, payroll, a CRM, a newsletter platform) with its own include, and stay under the ten-DNS-lookup limit the specification sets. End the record with -all or ~all, not +all. Our plain-words guide covers what breaks when SPF is missing or over budget.
4. DKIM: sign what you send
DKIM adds a signature to each outgoing message, checked by the receiver against a public key in your DNS. Google Workspace signs your domain once you generate the key and click "Start authentication" in the Admin console. Microsoft 365 does not sign a custom domain until an admin publishes two CNAME records and enables signing in the Defender portal; only the onmicrosoft.com address is signed automatically. Send yourself a test to a Gmail account and check "Show original" for dkim=pass on your own domain before moving to the next item.
5. DMARC: tell receivers what to do with forgeries
DMARC ties SPF and DKIM to the From address people see and publishes a policy: none, quarantine or reject. Start at p=none with a rua= address so the aggregate reports come to a mailbox someone reads, confirm your legitimate senders pass, then move up. This is also where the mailbox providers now have requirements. Google's sender guidelines state that "Starting February 1, 2024, all email senders who send email to Gmail accounts must meet the requirements in this section," and for each sender that means "Set up SPF or DKIM email authentication for your sending domains." Senders of more than 5,000 messages a day must "Set up SPF and DKIM email authentication for your domain" and "Set up DMARC email authentication for your sending domain."
6. Automatic forwarding to outside addresses: off
An attacker who gets into a mailbox for an hour may leave a forwarding rule behind so the mail keeps flowing after the password changes. Both suites let an admin close that door for the whole company. In Microsoft 365 the control sits in the outbound spam filter policy; Microsoft's own page explains that the default setting, "Automatic - System-controlled," changed in 2021 to behave as "Off - Forwarding is disabled" for new organizations, but that "Because the behavior can differ by organization," admins should "configure On - Forwarding is enabled or Off - Forwarding is disabled instead of Automatic - System-controlled." Set it to Off explicitly. When it is off, "Automatic external forwarding is disabled and results in a non-delivery report" to the sender. In Google Workspace, the Admin console path is Gmail, then End User Access, then Automatic forwarding: "To turn off automatic forwarding, clear the Allow users to automatically forward incoming email box." If one role truly needs an external forward, grant it to that organizational unit only.
7. Shared mailboxes: no direct sign-in
The info@, billing@ and support@ mailboxes are the ones attackers like to live in, because several people watch them and no single person owns them. In Microsoft 365, Microsoft's guidance is unambiguous: "A shared mailbox isn't intended for direct sign-in by using its associated user account. Always block sign-in for the shared mailbox account and keep it blocked." Give people delegated access from their own accounts, so MFA from item one still applies and the audit trail shows a person's name. In Google Workspace, use a Google Group set up as a collaborative inbox, or a delegated account, for the same reason rather than a password several people share.
8. A dedicated filter, in Monitor only first
Items one through seven are free and live in the suite you already pay for. Before adding a filter, turn on what you already own: Microsoft's Standard preset security policy, or in Google Workspace the spoofing and authentication settings under Gmail, then Safety, and enhanced pre-delivery message scanning under Gmail, then Spam, Phishing and Malware. A dedicated email security layer is a product decision, and the only setup advice that belongs on a checklist is how to introduce one without disrupting mail. Modern API-based filters connect to Microsoft 365 or Google Workspace without changing the MX records; Check Point describes its Harmony Email & Collaboration product as deploying "through API with flexible enforcement from monitor mode to inline prevention without changing MX records or disrupting Microsoft 365 or Google Workspace," and its admin guide describes Monitor only mode as providing "visibility into the cloud-hosted email leveraging publicly available API's and a journal entry from the SaaS email provider," with Protect (Inline) mode as the step that "scans emails prior to delivery to the end user's mailbox." The order matters: run in Monitor only for two weeks, read what it flagged, and move to inline enforcement on a day you choose. No mail should be quarantined during the first two weeks of a new filter.
9. A quarantine owner, by name
A quarantine with no owner is a folder where legitimate mail goes to be forgotten and where a real threat sits unreviewed. Decide who looks at it, how often, and what counts as a release request. On a normal week at a small company this is minutes a day, not hours, but it has to be someone's job. Write the name down next to this item. If that person is the one admin who also runs payroll and the website, that is the signal the task needs a second person, inside or outside the company.
10. A monthly review, on the calendar
Settings drift. Someone adds a marketing tool that sends as your domain and SPF goes over budget. A new hire is created without MFA because the enforcement date was set and then forgotten. An admin leaves and the emergency account password is still in a drawer that cannot be found. Once a month, in thirty minutes: check the MFA report for unenrolled accounts, count admins, read the DMARC aggregate report for new sources, confirm the forwarding setting is still Off, check the shared mailbox sign-in blocks, and skim the quarantine summary. Put it on the calendar now, for the first business day of next month, with a name on the invitation.
Where to start if you only have an hour today
Do items one and six first. MFA for the admins and forwarding off take under an hour together and close two of the doors attackers try often. SPF, DKIM and DMARC are the afternoon after that. The dedicated filter can wait until the first seven are done; it works better on a tenant whose basics are in place.
How to start
If you would rather have the quarantine owner and the monthly review handled for you, that is what Managed Email Security is: the Check Point license plus business-day quarantine review, release requests, investigation, a monthly summary and 24/7 support, with a one-time SaaS security posture report of your Microsoft 365 or Google Workspace tenant within the first 90 days at no charge, covering MFA and conditional access, admin and emergency accounts, external forwarding and sharing, allow lists, third-party app permissions, and SPF, DKIM and DMARC. It is $6.40 per user per month on the year-end offer ($5.60 for registered 501(c)(3) nonprofits; $8 list). The offer is 20% off (30% for registered 501(c)(3) nonprofits) on a 12-month Managed Email Security agreement signed by December 31, 2026, new customers only, no onboarding fee. If you already have an IT provider and only want the license, the license-only route explains how we beat a written quote, like for like. Either way, the free two-week email security assessment runs in Monitor only, exactly as item eight describes. We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. Book a free 15-minute call or see the services page.
Sources: Microsoft Learn, Security defaults in Microsoft Entra ID (ms.date 2025-07-21) and Set up multifactor authentication for Microsoft 365 (updated 2025-12-11); Microsoft Learn, Best practices for Microsoft Entra roles (updated 2026-06-01) and Manage emergency access accounts (updated 2026-06-05); Google Workspace Admin Help, Deploy 2-Step Verification and Security best practices for administrator accounts (updated 2026-10-13); Microsoft Learn, Control automatic external email forwarding in Microsoft 365 (updated 2026-08-18); Google Workspace Admin Help, Let users automatically forward their own Gmail emails (updated 2026-10-13); Microsoft Learn, About shared mailboxes (updated 2026-03-13); Microsoft Learn, Set up DKIM to sign mail from your Microsoft 365 domain; Microsoft Learn, Preset security policies; Google Workspace Admin Help, Set up DKIM, Make a group a Collaborative Inbox, and Advanced phishing and malware protection; Check Point, Harmony Email & Collaboration administration guide, Email Protection modes, and the Harmony Email & Collaboration product page; Google, Email sender guidelines (requirements effective February 1, 2024); RFC 7208, RFC 6376 and RFC 7489. Quotes are verbatim from those pages as read on October 19, 2026.
