Email Security Best Practices for NZ Businesses

Take this email security best practices checklist to whoever manages your email. Your existing licences may already include protection, so first establish what is active and where the gaps are.

This guide explains the email security best practices that matter for a New Zealand business: the questions to ask, how account access and message protection fit together, what SPF, DKIM and DMARC can and cannot prove, how to handle changed bank details, and how to keep the setup working. It is written for business owners and managers, whether email is run by an internal team or an IT provider.

What should an email security checklist cover?

A useful checklist covers more than a list of product features. Email security best practices span who can sign in, how messages are checked, whether your domain is protected from misuse, how staff report suspicious mail, how payments are approved and who keeps everything current. Use the questions below with the person managing your email.

These are questions for the person managing email, not a request for screenshots or reports. The answers show where your email security best practices are already in place and where work is needed.

How do email security best practices protect account access?

Account access is the first area of email security best practices to check, because filtering cannot help once an attacker can sign in as one of your staff. A compromised mailbox can be used to read invoices, set up hidden forwarding rules and send convincing requests to customers and suppliers.

Require MFA for users and administrators

Email security best practices require multi-factor authentication for every user and administrator who accesses email. MFA reduces the risk from a stolen password, but not every method offers the same protection. Codes and approval prompts can be phished or manipulated, for example through a fake sign-in page that relays the code to the attacker in real time.

Where your platform supports them, prefer phishing-resistant methods such as passkeys. Microsoft’s guidance on protecting identities recommends phishing-resistant methods and warns that SMS codes can be intercepted and voice calls manipulated. Plan enrolment and account recovery carefully, because a weak recovery process can undo a strong sign-in method. Protect sessions and devices too, since an attacker who steals a signed-in session may not need the password or the second factor.

Handle shared mailboxes correctly

Microsoft 365 shared mailboxes work differently. Microsoft’s guidance on shared mailboxes says to block sign-in for the shared mailbox account and keep it blocked. Authorised people reach the mailbox through their own protected accounts, so MFA on those accounts covers access to the shared mailbox as well.

Limit and review access

These access habits are email security best practices in their own right.

• Least privilege. Give each person access only to the mailboxes and data their role needs.
• Administrators. Keep administrator access to a small, named group with separate admin accounts where practical.
• Departing staff. Disable accounts and remove mailbox permissions promptly when people leave.
• Forwarding rules. Check for rules that forward mail to outside addresses, particularly on accounts that handle invoices and payments.

How do email security best practices protect incoming messages?

Message protection is the part of email security best practices that checks mail as it arrives and, for some features, again when a person opens a link or file. The controls below work together, but no single control detects every threat.

Filtering and impersonation protection

Filtering removes or quarantines spam, malware and known scams based on sender reputation, content and behaviour. Impersonation protection looks for messages pretending to be a trusted person, supplier or domain, such as a display name that matches your director or a lookalike domain that swaps one letter. Check which policy applies to each mailbox, and whether the people and suppliers that matter to your business are covered.

A lookalike domain is a different domain that the attacker owns, so it can pass its own authentication checks. That is why impersonation protection, staff awareness and payment processes sit alongside domain authentication in email security best practices. Our guide covers the warning signs of phishing scams in more detail.

Link and attachment checks

Link scanning checks where a link leads, and can check again when it is clicked, because some malicious pages are activated after a message is delivered. Attachment sandboxing opens a file in an isolated environment to watch its behaviour before it reaches the recipient. Both features vary by platform and plan, so confirm which checks are licensed and active, what happens when a threat is found, and which senders or users are excluded.

Neither scanning nor sandboxing catches everything. A link to a newly created page or a document with no malicious code can still get through, which is why staff need a simple way to report what looks wrong.

Quarantine and reporting

A reporting route is one of the simplest email security best practices to set up. Decide who reviews quarantined mail and releases legitimate messages safely. Give staff one clear way to report a suspicious message, such as a report button in Outlook, and make sure someone acts on those reports promptly. Reporting works best when staff are thanked for it, even when the message turns out to be safe. Security awareness training helps staff recognise what to report.

How do you protect against changed bank-detail scams?

Before changing a supplier’s bank details, confirm the request using a phone number or contact route you already trust. Do not rely on a reply to the email or a number supplied in it. Follow the approval process even when the message comes from a familiar address, because a real account can be compromised.

Payment verification belongs beside the technical email security best practices, not behind them. A fraudulent request sent from a supplier’s real mailbox can pass every email check, so staff should not be the final filter expected to spot every convincing message. A written process gives them a clear reason to pause and verify.

• Verify independently. Call the supplier on a number from your records or their published website, not one in the message.
• Use a second approver. Require a second person to approve new or changed payment details.
• Report suspicious requests. Use the same reporting route as other suspicious mail, so IT can check for a compromised account.

Own Your Online’s guide to protecting your business against email compromise recommends checking auto-forwarding rules, particularly on accounts receivable mailboxes, and telling your IT provider if an account is compromised.

What if money has already been paid?

Contact your bank immediately, because they may be able to stop or recover the payment. Then involve whoever manages your IT so they can secure the affected accounts. Own Your Online’s invoice scam guidance also recommends reporting the scam to the NCSC. Our incident response plan guide covers the wider steps.

Is built-in email protection enough?

It can be, depending on your licences, active policies and business risks. Check mailbox coverage, impersonation controls, links, attachments, quarantine and exceptions before buying more. Address remaining gaps and assign responsibility for ongoing management.

In Microsoft 365, the Built-in protection preset policy gives basic Safe Links and Safe Attachments protection where Defender for Office 365 is licensed. It applies to users who are not excluded and are not covered by the Standard or Strict presets or custom policies, which take precedence. That means the protection a mailbox receives depends on which policy applies to it.

• Licences. Confirm which mailboxes are covered by the licences that provide each feature. A feature being applied by the platform does not replace correct licence coverage.
• Policies. Check the actual scope of Standard, Strict and custom policies, rather than assuming either that nothing advanced is active or that everything is.
• Exclusions. Review users, groups and domains excluded from protection, and why.
• Mail flow. Confirm that mail routes through the protection you expect, including mail from third-party services.

Optional features and sandboxing vary by platform and plan, so email security best practices start with what you already have. If gaps remain after that check, our email security service page explains how Exodesk configures and manages the controls.

How do you put email security best practices in place?

Putting email security best practices in place starts with checking what is active, then prioritising gaps by risk. You do not need to wait for DNS work to be finished before using link or attachment protection that is already available.

How do you avoid blocking legitimate mail?

Overly strict rules can hold legitimate client and supplier mail, which frustrates staff and creates pressure to switch protection off. Review quarantined mail during setup, adjust policies carefully and keep a record of why each exception exists. Good configuration balances protection with reliable delivery, which is part of applying email security best practices well.

What does it cost to improve email security?

The cost of email security best practices depends on what you already have. The factors are your existing licences, the number of mailboxes, any extra features you add, the configuration effort and who provides ongoing management. Some controls, such as MFA and domain authentication records, can be configured with what you already pay for, while others need additional licences. The email security service page covers how Exodesk scopes this work.

How do you keep email security best practices working over time?

Email security best practices need ongoing attention, because staff, senders and platforms change. A scheduled review, for example each quarter, confirms that MFA coverage, policies, domain records and exceptions are still correct. That review does not replace day-to-day monitoring.

• Alerts and reports. Act on security alerts and reported messages promptly, not at the next scheduled review.
• Changes. Review the setup after staff join or leave, a new sending service is added, or a domain or policy changes.
• Configuration. Look for missing, incorrect or outdated settings, including domain records that no longer list every legitimate sender.
• Mailbox activity. Check for new forwarding rules and unexpected permission changes.

Email is one route into the business, so email security best practices work best alongside other protection. Pairing these controls with endpoint security reduces the chance that a compromised mailbox becomes a route into the rest of your network. For sensitive messages, our guide to email encryption explains the options.

Should you manage email security in-house or outsource it?

Businesses with skilled internal IT can maintain email security best practices themselves. Others prefer a provider to configure, monitor and review them. Either approach works when responsibility is clear and every item on the checklist has an owner.

Email security support from Exodesk

Exodesk helps businesses across New Zealand check their current email protection, apply email security best practices and keep the setup reviewed. For businesses whose IT we support, we also review suspicious messages that staff report. See our email security service for what that work covers.

Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.

Contact us or call 0800 396 337 to talk through your email setup.