Email Security Checklist: 15 Things Every Business Should Verify
A practical email security checklist covering authentication, spoofing protection, infrastructure hardening, and monitoring. Run through this quarterly.
Authentication checklist
Verify all five authentication requirements. Missing any one leaves gaps that attackers or spam filters can exploit.
- ✓SPF record published and valid: v=spf1 record exists, syntax is correct, all sending services included, under 10 DNS lookups, ends with -all
- ✓DKIM enabled for all sending services: Each ESP/service has DKIM enabled, public key is in DNS at selector._domainkey.domain.com, using 2048-bit keys
- ✓DMARC policy at p=quarantine or p=reject (not p=none): Full enforcement, not just monitoring mode
- ✓DMARC rua= reporting configured and actively monitored: Aggregate reports reviewed at least monthly for unexpected failures
- ·BIMI record configured (if applicable): Requires p=reject DMARC + Verified Mark Certificate for brand logo display in Gmail and Yahoo
Transport security checklist
Transport security prevents email from being intercepted or downgraded to plaintext in transit between mail servers.
- ✓MTA-STS policy published: Policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with mode: enforce, listing all MX hostnames
- ✓MTA-STS DNS record published: TXT record at _mta-sts.yourdomain.com pointing to your policy
- ✓TLS-RPT configured: Receiving TLS transport failure reports at _smtp._tls.yourdomain.com (rua= tag)
- ✓Valid TLS certificate on mail server: From a trusted CA, not self-signed, not expired, covers all MX hostnames in Subject Alternative Names
- ✓PTR record (FCrDNS) configured: Sending IP resolves to mail server hostname, and hostname resolves back to same IP
Blacklist and reputation checklist
Reputation monitoring must be continuous — a new listing can appear at any time and needs to be caught within minutes, not days.
- ✓Domain clean on all major blacklists: Check against Spamhaus ZEN, Barracuda BRBL, SpamCop, UCEPROTECT, and 73+ additional lists
- ✓Sending IP(s) clean on all major blacklists: Both IP and domain checks required — they're listed separately
- ✓Automated monitoring configured: New listings detected within 15–60 minutes with alerts to an actively monitored channel
- ✓Google Postmaster Tools registered: Domain verified, domain reputation at 'High', spam rate below 0.10%
- ·Microsoft SNDS registered: Sending IPs enrolled, showing green (Good) status
Process and policy checklist
Technical controls are only effective with supporting processes. Run through all 15 items quarterly or after any DNS changes, ESP migrations, or security incidents.
- ✓One-click unsubscribe implemented: All marketing email includes List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058
- ✓Unsubscribes processed within 24 hours: Suppress immediately on receipt, not at end of batch cycle
- ·Incident response playbook documented: Who gets alerted, who investigates, who submits removal requests, customer communication plan
Audit frequency
Run through this checklist quarterly, and immediately after any DNS changes, ESP migrations, infrastructure changes, or security incidents.
Check your domain's email health
Run a free scan against 60 blacklists. Validate SPF, DKIM, DMARC, and MX records in seconds.
Related free tools