Email Security, IT Atlas

Overview

Domain authentication is the foundation: SPF authorises sending sources, DKIM signs messages, and DMARC tells receivers what to do when alignment fails while providing reporting. Publishing DMARC at enforcement is one of the highest value email controls available.

Content controls add attachment sandboxing, link rewriting and detonation, impersonation protection and post delivery remediation for messages later found malicious.

Security considerations

Move DMARC to p=reject after analysing reports; monitor only policies deter nobody.
Alert on inbox rule creation, forwarding to external addresses and mass mailbox access.
Give users a one click report button and measure reporting rates, not just click rates.

Related topics

Exchange Online

Microsoft's cloud email service, including transport rules, connectors, mailbox permissions and hybrid coexistence with on premises Exchange.

DNS

The Domain Name System is the distributed, hierarchical directory that resolves names to addresses and service records for nearly every other service.

Microsoft 365

An integrated productivity, collaboration, identity, security and management suite delivered as a single tenant scoped cloud service.

Incident Response

The prepared, repeatable process for detecting, containing, eradicating and recovering from security incidents, and learning from them.

Security Awareness

Building the human capability to recognise and report social engineering, and measuring reporting rather than blame.

Microsoft Defender

Microsoft's security product family spanning endpoint, identity, email, cloud apps and cloud workloads, correlated into unified incidents.

Microsoft 365 Organisation Architecture

A reference design for a cloud first organisation running identity, collaboration, endpoint management and security in one Microsoft 365 tenant.