How Do I Secure My Small Business Email?

The short answer

Secure business email in four ways: turn on email authentication for your domain, use your provider’s spam and phishing filters, set recovery options you control, and require multi-factor authentication on every account. Email authentication means three records called Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). The Federal Trade Commission (FTC) says to make sure your email provider uses all three, and to ask the provider to set them up if you aren’t sure how.

What this tells Google and AI

Email security sends no direct search signal. It guards the keys. The accounts that run your Google Business Profile (GBP), website, domain, and listings all reset through email, so a hacked inbox can lead to a hijacked profile or a defaced website that Google, Bing, and artificial intelligence (AI) tools then read. Authentication also helps your quotes, invoices, and review requests land in customers’ inboxes instead of spam.

What this means

The outline asks for four things: authentication, spam controls, recovery methods, and multi-factor authentication.

Email authentication is three records you add to your domain’s settings:

• SPF: lists which servers may send email for your domain.
• DKIM: adds a digital signature so receivers can tell the message wasn’t changed.
• DMARC: tells receiving servers what to do with email that fails the checks, and can send you reports.

Spam controls are your provider’s filters for junk, phishing, and fake senders.

Recovery methods are the backup phone number and email used to get back into the account.

Multi-factor authentication asks for a second proof, like a code or security key, after the password.

Made-up example: Customers of Greenway Lawn Care say quotes land in spam. The owner’s email provider checks the domain and finds no DKIM or DMARC record, and an SPF record that leaves out the invoicing app. The provider adds DKIM, fixes SPF to include the invoicing app, and adds a DMARC record set to report only. After a few weeks of clean reports, they tighten DMARC.

Why it matters

• Scammers can fake your domain without authentication. The FTC says these tools help stop email that pretends to come from you.
• Big inbox providers check for it. Gmail’s sender guidelines say all senders must use SPF or DKIM, and senders of more than 5,000 messages a day to Gmail must use SPF, DKIM, and DMARC.
• Passwords alone get stolen. The Cybersecurity and Infrastructure Security Agency (CISA) says people who use multi-factor authentication are much less likely to get hacked, and lists email as one of the first accounts to protect.
• Weak recovery is a back door. An old phone number or a former employee’s email as the recovery option can let someone else in.

Who this applies to

Every business with email on its own domain. If you send email through other tools, like a booking app, invoicing software, or a newsletter service, those tools need to be included in your authentication setup.

How to do it

1. List every service that sends email using your domain: your mailbox provider, website forms, invoicing, booking, and marketing tools.
2. Ask your email provider to set up SPF and DKIM for your domain, or follow their setup guide. You’ll add records in your domain’s Domain Name System (DNS) settings (see 13.1.4 DNS Access).
3. Add each sending service to SPF and turn on DKIM in each tool.
4. Add a DMARC record. Many providers suggest starting with a monitoring policy and tightening it once reports show your real email passes. The FTC notes setup takes some expertise so you don’t block real mail.
5. Turn on spam and phishing protection in your provider’s settings, including warnings on outside email if available.
6. Require multi-factor authentication for every account. CISA says security keys that use the Fast IDentity Online (FIDO) standard are the most phishing-resistant option widely available (see 11.7.3 Multi-Factor Authentication).
7. Set recovery options to a phone and backup email the business controls (see 11.7.4 Account Recovery Methods).
8. Block outside forwarding and review rules (see 12.1.5 Email Forwarding Rules).
9. Recheck whenever you add a new tool that sends email.

What proof to keep

• Screenshots of SPF, DKIM, and DMARC records with the date
• The list of services allowed to send for your domain
• The admin setting that requires multi-factor authentication
• Recovery options for each admin account

Common mistakes

• Forgetting third-party senders. Invoices from your accounting app fail checks if the app isn’t in SPF and DKIM.
• Two SPF records. Your domain should have one SPF record that lists everything.
• Jumping straight to a strict DMARC policy and blocking your own real email.
• Text message codes only, with no backup. If the phone is lost, so is access.
• Recovery email on a former employee’s address.

When to get help from a pro

Your email provider or an information technology (IT) security specialist can set up and test authentication. Questions to ask:

• Are SPF, DKIM, and DMARC set up and passing for every service that sends as our domain?
• What DMARC policy should we start with, and when should we tighten it?
• Can we require multi-factor authentication for every user?

Bill’s note

[Bill: add a short note. For example, a client whose quotes or review requests went to spam until authentication was fixed, or a spoofing attempt you saw.]

If you’d rather have this done for you, SiteSmarty handles website and domain setup.

How I did this for SiteSmarty

• [Date I did this:]
• [What I actually did, step by step: SiteSmarty’s SPF, DKIM, DMARC, multi-factor authentication, and recovery settings]
• [What it cost and how long it took:]
• [What surprised me or what I’d do differently:]
• [Screenshot or photo to add, with private info blurred: the DNS records and the multi-factor setting]
• [Result so far:]

Questions people ask

What is email authentication? Three domain records, SPF, DKIM, and DMARC, that help receiving servers confirm an email really came from you.

Why are my business emails going to spam? Missing or broken authentication is a common reason. Check that every service sending as your domain is set up.

Do I need multi-factor authentication on email? Yes. CISA lists email among the first accounts to protect.

Who should set this up? Your email provider can, or an IT helper. The FTC suggests asking your email host to configure it if you’re unsure.

Audit check

• Question: Does the business domain have working SPF, DKIM, and DMARC records, with multi-factor authentication required and recovery options the business controls?
• Pass looks like: All three records in place and passing for every sending service, spam filtering on, multi-factor authentication required, recovery set to business-controlled contacts.
• Fail looks like: No DMARC, SPF missing key senders, passwords only, recovery tied to a personal or former employee’s account.
• Evidence to collect: DNS record screenshots, the sender list, the admin security settings, and the recovery options list.

Where this fits

Do this first: 12.1.1 Business Email Domain, 12.1.2 Email Accounts and Shared Inboxes, 13.1.4 DNS Access

Do this next: 12.1.7 Email Retention

Related pages: 11.7.3 Multi-Factor Authentication, 11.7.4 Account Recovery Methods, 12.1.5 Email Forwarding Rules, 11.9.2 Account Takeover, 18.3 Email Marketing Rules

Sources

• Federal Trade Commission, "Cybersecurity for small business: Email authentication" (checked October 17, 2026)
• Gmail Help, "Email sender guidelines" (checked October 17, 2026)
• Cybersecurity and Infrastructure Security Agency, "More than a Password" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.