Protecting email involves both sides of the address. The organization needs control of the domain it sends from and appropriate protection for the accounts that read and send messages.
Protect both sides of the email address
The sending domain and the mailbox account have different control and review needs.
Know every legitimate sender
Inventory the services that send using the organization’s domain: the main email platform, billing tools, newsletters, website forms, and other applications. Coordinate DNS changes with those owners. Turning on strict policy without understanding the senders can interrupt legitimate messages.
SPF identifies authorized sending sources for a domain used in delivery. DKIM adds a domain signature, and DMARC checks alignment with the visible From domain and communicates the domain’s handling policy. Microsoft’s email-authentication guidance explains how these controls work together.
Use reporting and controlled tests before tightening enforcement. Verify normal mail, forwarded mail, important applications, and exception handling. Domain authentication helps address domain spoofing; it does not establish that every authenticated message is honest or that an account has not been compromised.
Protect and review the accounts
Use appropriate MFA, individual identities, limited administrator access, and an approved shared-mailbox arrangement. Review forwarding, delegated access, application grants, recovery methods, and available audit records. Those paths can matter during an investigation even after a password has changed.
Give staff a clear way to report suspicious messages. If compromise is suspected, follow the incident procedure and preserve the information needed for investigation. Coordinate revocation, mailbox review, and business follow-up with the application owner.
Coordinate changes among the registrar or DNS administrator, email provider, sending-application owners, and staff handling reports. Keep payment verification separate from confidence in the email system: a legitimate account can still carry a fraudulent request.