The best practices below cover prevention, but also identity hardening, incident response, and the sensitive data that is already sitting in your mailboxes, since a checklist that only blocks inbound threats leaves the rest of the attack lifecycle uncovered. Material secures email, identity, and data for teams at Figma, Gusto, Lyft, and PagerDuty across Google Workspace and Microsoft 365. Use this list to measure your own program against what a modern email security posture actually requires.
Key Takeaways
- A complete email security program covers prevention, identity hardening, incident response, and protection of sensitive data already sitting in mailboxes, not just inbound filtering.
- Phishing remains the leading way attackers get in, and compromised credentials are the second most common entry point, which is why authentication and detection have to work together.
- Phishing-resistant MFA (authenticator apps or hardware keys) is more effective than SMS-based codes, which can be bypassed by SIM-swapping and AiTM phishing kits.
- SPF, DKIM, and DMARC only work when correctly configured and set to enforce, not just monitor.
- Third-party OAuth app connections should be reviewed regularly, since they can hold standing access that outlives a password reset.
- A documented incident response plan matters as much as prevention, since it determines how fast a team can act in the first hour after a confirmed compromise.
Email Security Best Practices
1. Enable phishing-resistant MFA everywhere, not just SMS-based codes. SMS-based one-time codes can be intercepted through SIM-swapping and are increasingly bypassed by AiTM (adversary-in-the-middle) phishing kits. Authenticator apps and hardware security keys close that gap and should be the default for any account with access to sensitive systems. See identifying and plugging MFA gaps.
2. Require unique passwords for every account, managed through a password manager. MFA does not fully compensate for a password that has already been exposed in another breach, since credential stuffing attacks reuse leaked password lists against new targets. Enforce unique, randomly generated passwords through an approved password manager rather than leaving password hygiene to individual habit.
3. Enforce SPF, DKIM, and DMARC on every sending domain. These three records are the foundation of email authentication, and they only work if they are correctly configured and set to enforce, not just monitor. A domain without DMARC enforcement is an easy target for anyone impersonating your company to send convincing spoofed mail.
4. Go beyond native or gateway-style filtering for phishing, BEC, malware, and credential-harvesting attacks. Native filters and secure email gateways catch known-bad senders and obvious spam well, but they were not built to detect socially engineered attacks that carry no malicious link or attachment, or clone phishing that passes authentication checks. Detection needs to look at behavior across the mailbox, not just the message. A 2026 Hornetsecurity report found phishing remains the leading infection vector at 46 percent of incidents, followed by compromised credentials at 25 percent, which is why filtering and identity protection need to work together rather than as separate line items. See email security and Material vs. secure email gateways.
5. Build a fast post-delivery response workflow for user-reported phishing. No detection layer catches everything, so the speed of your response after a user reports a suspicious message matters as much as prevention. One confirmed report should be enough to clear every variant of that message across the organization automatically, rather than requiring every employee to independently spot the same attack. See automated user report response.
6. Contain account takeovers, not just try to prevent them. Assume that some credentials will eventually be compromised, and plan for what happens next: limiting what an attacker can see and do inside a compromised account matters as much as stopping the initial phish. See containing account takeovers.
7. Maintain a documented incident response plan for email account compromises. The first hour needs clear steps: reset credentials, kill active sessions, remove any auto-forwarding rules the attacker added, and revoke connected OAuth apps so access doesn't survive the password reset. From there, search the mailbox for what was sent or read, since that determines whether lateral phishing went out and whether legal or compliance needs to be involved. A plan tested in advance moves faster than one improvised during a live incident.
8. Protect sensitive data that is already sitting in mailboxes. Years of contracts, credentials, and financial records typically accumulate in inboxes over time, which makes the mailbox itself a high-value target during an account takeover, independent of whatever inbound filtering is in place. Classifying that data and automatically correcting overly broad file and folder permissions limits what an attacker can actually reach even after gaining access, protection that holds even if the account itself is later compromised. See detecting and protecting sensitive data in email and file security.
9. Run regular phishing simulations with realistic, current attack examples. Simulations built around outdated tactics train employees to spot threats that are no longer common. Use scenarios that reflect what is actually landing in inboxes today, including AI-generated messages and QR code phishing.
10. Run regular security awareness training so employees recognize and report suspicious messages, and make reporting effortless. A one-click reporting button that feeds directly into your response workflow turns every employee into a detection layer instead of leaving reported messages stuck in a slow, manual queue.
11. Review and update email retention and access policies on a set cadence. Data that no longer needs to be retained is data that does not need to be protected. Regularly reviewing retention policies limits how much sensitive information accumulates in mailboxes in the first place.
12. Audit the entire program regularly instead of treating it as a one-time setup. Threats, tools, and your own organization all change. A quarterly review of what is actually being caught, what is getting reported, and where gaps remain keeps the program current rather than static. See modernizing your approach to email security.
Turn Best Practices Into an Operating Program
A checklist only works if it becomes a recurring operating model rather than a document reviewed once a year. That starts with visibility: understanding what email, identity, and data controls you already have in place before adding anything new. From there, the highest-leverage steps are usually strengthening authentication and detection first, then closing the identity and data gaps that matter once a message does get through, backed by an incident response plan for when something does slip past. Material is built for that broader approach, unifying detection, automated response, identity hardening, and sensitive data protection into one platform rather than a list of separate manual tasks. See modernizing your approach to email security.
To see where your own program stands against this list, run the free Workspace Security Scorecard, or get a demo to see how Material can help operationalize it.
Email Security Best Practices FAQs
What are the most important email security best practices?
The most important practices are phishing-resistant MFA, unique passwords managed through a password manager, correctly enforced SPF, DKIM, and DMARC, detection that goes beyond native filtering to catch malware and socially engineered attacks, and identity hardening that includes reviewing third-party OAuth app connections. Post-delivery response, a documented incident response plan, and sensitive data protection in mailboxes round out a complete program.
Is MFA alone enough to secure business email?
No. SMS-based MFA can be bypassed through SIM-swapping and AiTM (adversary-in-the-middle) phishing kits that intercept one-time codes in real time. Phishing-resistant MFA, such as authenticator apps or hardware security keys, closes that gap, and organizations should still plan for account takeover containment in case a compromise happens anyway.
What's the difference between a secure email gateway and API-based email security?
A secure email gateway sits in front of the mailbox and inspects messages before delivery, which means it has no visibility into internal email or the ability to act on messages already delivered. API-based email security connects directly to the mailbox, so it can detect threats after delivery and remediate across the organization without rerouting mail. See Material vs. secure email gateways.
What should we do immediately after a confirmed email account compromise?
The first hour should follow a documented plan rather than improvisation: lock down the compromised account and its connected apps, notify the security team and affected users, and determine whether legal or compliance needs to be looped in based on what data the account had access to. Testing this plan periodically, before it is needed, is what makes it fast enough to matter during an actual incident.
How often should email security policies be reviewed?
Email security policies should be reviewed at least quarterly, with authentication records like DMARC checked more frequently since misconfigurations there can silently break enforcement. Retention and access policies should be reviewed on a set cadence rather than left in place indefinitely, since data that no longer needs to be retained does not need ongoing protection.
What tools help enforce email security best practices at scale?
Automation is what makes a best-practices checklist enforceable at scale rather than dependent on manual review. That includes automated post-delivery response for user-reported phishing, ongoing OAuth app governance, and continuous account behavior monitoring, rather than periodic manual audits.
Does Material use AI as part of its email security best practices?
Yes. Material uses AI for behavioral detection across email, identity, and files, agentic triage of user-reported phishing, and continuous auditing of app connections as AI agents proliferate, so previously trusted access is re-checked rather than assumed safe. AI is included at every tier of the platform.
