Email Security: Best Practice Guide
- Email Authentication - SPF
- Email Authentication - DKIM
- Email Authentication - DMARC
- LinkScan
- User Directory
- Executive Tracking
- Nearby Domain
- Display Name Detection
- Post Delivery Email Deletion (Retract)
- Advance File-based Sandbox (License Required)
- Email Delivery Security (MX Mode only)
- Safelisting EMS Security IP Address (MX Mode only)
- Single Sign On (SSO) with M365
- External Email Warning Banner
- Outlook plugin for M365
- MFA on Admin Account
- Admin Audit License
This guide outlines best practices for Email Security (EMS), which are based on our experiences with many customers and are in line with other industry best practices.
The following configuration recommendations will help you identify how to minimise your exposure to a range of email compromises to keep your organisation & users safe.
Our best practice advice covers a number of areas as summarised below.
Secure your Email Domains:
- SPF - DKIM - DMARC - Email Delivery Security
Protect your Users
- Active Directory Sync - Executive Tracking - Nearby Domain - Display Name Detection - External Email Warning Banner - Advanced Sandbox - Post Delivery Email Deletion (Retract)
Manage Admin Access
- MFA on Admin Account - Admin Activity Audit
User Experience
- Outlook Plugin for M365 - Report Spam/Phishing - Manage Quarantine - Manage Safe Sender Lists
Email Authentication - SPF
Feature:
The Sender Policy Framework (SPF) is a DNS record added to the domain that specifies which hosts and IP addresses are allowed to send an email on behalf of a domain. The SPF system allows recipient email systems to check if the email was sent from a verified source, and if not, to act accordingly using the policy described in the SPF record.
Why do we recommend:
To prevent spammers or hackers from sending messages on behalf of your domain, follow this KB article on how to configure this feature.
Tips:
External References:
Email Authentication - DKIM
Feature:
DomainKeys Identified Mail (DKIM) is a DNS record added to the domain that stores the public key that the receiving email server uses to verify a message's signature. A DKIM includes a name, version, key type, and the public key itself, and is often made available by the provider that is sending your email.
Why do we recommend:
Configuring DKIM on domains you send emails from is a stronger authentication mechanism than just SPF. It will help recipients validate the legitimacy of email which has passed through an email relay en route.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
External References:
Email Authentication - DMARC
Feature:
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a DNS record that is used to authenticate an email by aligning SPF and DKIM mechanisms.
Why do we recommend:
Having DMARC in place can help to prevent business email compromise, phishing and spoofing attacks against your email domain. How to configure: Follow this KB article on how to configure this feature.
How it works:
Follow this KB article on how DMARC works.
Tips:
External References:
https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing
LinkScan
Feature:
LinkScan performs further checks on a URL within a delivered email at the moment the end-user clicks the link. In-depth redirect scanning and document detection are performed to confirm that the URL is safe for users to access.
Why do we recommend:
By having Linkscan configured, you will have a greater degree of security. This is because often it can take a while for threat intelligence feeds to report that an email is spam or has a malicious URL inside it.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
User Directory
Feature:
User Directory integration.
Why do we recommend:
Enabling User Directory integration, allows you to create user-based filtering rules, either by User, Security Group or OU, which can make creating filter rule logic a straightforward task.
How to configure:
Follow this KB article on how to configure this feature for Microsoft Active Directory and Entra ID.
Follow this KB article on how to configure this feature for Google Workspace Directory.
Tips:
Executive Tracking
Feature:
The Executive Tracking feature detects Business Email Compromise (BEC) attacks. A BEC attack sometimes called a "whale phishing" attack or CEO Fraud is a specific type of phishing attack that targets high-profile employees such as the CEO or CFO.
Why do we recommend:
The attack intends to steal sensitive information from a company (since employees that hold high positions within the company will tend to request other users to complete certain tasks on their behalf). In many such attacks, the attacker's goal is to manipulate
How to configure:
Follow this KB article on how to configure this feature.
Follow this KB article on how to configure based on the subject field.
Tips:
Nearby Domain
Feature:
The Nearby Domain feature detects if an attacker sends an email with a similar domain in the email header to your domain. For example, a spam email delivered to clouduss.com may contain headers from clouduus.com.
Why do we recommend:
The attack intends to steal sensitive information from a company (since employees that hold high positions within the company will tend to request other users to complete certain tasks on their behalf). In many such attacks, the attacker's goal is to manipulate the victim into authorising high-value wire transfers to the attacker.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
Display Name Detection
Feature:
The Display Name Detection feature detects if an attacker is sending an email with unusual patterns in the display name; the area that shows who sent the email in most email clients. For example, some spammers will try and confuse filtering systems by using your real domain name inside the display name to try and convince the recipient the message is internal or genuine.
Why do we recommend:
The attack intends to steal sensitive information from a company (since employees with high positions within the company will tend to request other users to complete certain tasks on their behalf). In many such attacks, the attacker's goal is to manipulate the victim into authorising high-value wire transfers to the attacker.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
Post Delivery Email Deletion (Retract)
Feature:
Post Delivery Email Deletion is a feature of Email Security that allows an administrator to delete email that has been delivered and stored in a Microsoft 365 / Office 365 mailbox, including any replies or forwards of the message within the domain.
Why do we recommend:
This feature is particularly useful to delete and remotely wipe any messages accidentally released from quarantine or containing suspicious or confidential data.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
Advance File-based Sandbox (License Required)
Feature:
Advanced Malware Scanning of file content.
Why do we recommend:
The optional Advanced Email Sandbox protects against today’s evasive zero-day threats by providing a highly scalable and powerful environment to run in-depth, sophisticated analyses of unknown or suspicious programs and files.
How to configure:
Follow this KB article on how to configure this feature (only available if the Sandbox license has been purchased and applied).
Follow this KB article for an overview of this feature.
Follow this KB article on how to configure this feature.
Tips:
Email Delivery Security (MX Mode only)
Feature:
Restrict email servers to only receive inbound messages from our filtering towers.
Why do we recommend:
Attackers don’t necessarily have to use MX records to deliver email. If email servers allow anyone to connect to them directly, then EMS security checks can easily be bypassed.
How to configure:
Follow this KB article on how to configure this feature for M365.
Follow this KB article on how to configure this feature for Google Workspace.
Follow this KB article for information about all filtering regions.
If you use an on-premise or hosted email server/service, please ensure the Firewall is configured to only allow email delivery from EMS email servers.
Tips:
Safelisting EMS Security IP Address (MX Mode only)
Feature:
Safelisting Censornet’s IP ranges on your email service.
Why do we recommend:
To ensure smooth delivery of email from EMS to your email service, add a bypass rule that safelists Censornet IP addresses to stop your email service from causing unexpected results and behaviour for end users.
How to configure:
Follow this KB article on how to configure this feature for M365.
Follow this KB article on how to configure this feature for Google Workspace.
Follow this KB article for information about all filtering regions.
Single Sign On (SSO) with M365
Feature:
Sign on to the dashboard with an M365 account.
Why do we recommend:
This feature allows you to utilise a single identity source when accessing the dashboard.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
External Email Warning Banner
Feature:
Warning banner on external inbound email.
Why do we recommend:
This feature allows you to notify users that the received email is from an external source and to apply caution.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
Outlook plugin for M365
Feature:
Outlook plugin for M365.
Why do we recommend:
This feature allows users to report Spam and Phishing emails from their Outlook client.
How to configure:
Follow this KB article on how to configure this feature.
Tips:
MFA on Admin Account
Feature:
Enabling MFA on any admin account.
Why do we recommend:
By enabling MFA on admin accounts, the authentication process will be improved by adding an extra layer of security via a simple SMS based OTP (One Time Passcode).
How to configure:
Follow this KB article on how to configure this feature.
Tips:
Admin Audit License
Feature:
Admin Audit license
Why do we recommend:
By enabling the admin audit feature, administrators have a high-level history of activity carried out by administrator users within the dashboard.
How to configure:
Follow this KB article to confirm you have the license.
Follow this KB article on how to use the admin audit reporting.