Good email security for a business has four layers: authentication records (SPF, DKIM and DMARC) so nobody can easily send email as you, filtering that blocks malicious links and attachments, MFA and monitoring on every mailbox, and staff trained to spot phishing. Most Irish SMEs already pay for some of this in Microsoft 365 without using it fully. ERS IT Solutions, in Blanchardstown, Dublin 15 since 1983, monitors Microsoft 365 accounts around the clock and trains staff to spot phishing.
Why does email security matter for Irish businesses?
Email is where most fraud and many cyber attacks start. In a FraudSMART and ISME survey, 88.4% of attempted scams against SMEs came through email, and Irish SMEs lost €18.9 million to email-related scams over two years. Ireland's NCSC notes that most business email compromise attacks involve no malware at all, so antivirus will not catch them.
Email security therefore has to cover three different problems: malicious content (links and attachments), impersonation (people pretending to be you or your suppliers) and account takeover (someone logging in to a real mailbox with a stolen password).
What are SPF, DKIM and DMARC?
They are three DNS records that let receiving mail servers check whether an email claiming to be from your domain really is. The NCSC tells organisations to "implement and monitor SPF, DKIM, and DMARC on your domains".
| Record | What it does | In plain terms |
|---|---|---|
| SPF (Sender Policy Framework) | Lists the servers allowed to send email for your domain | "Only these servers send our email" |
| DKIM (DomainKeys Identified Mail) | Adds a digital signature to each email | "This email really came from us and was not changed" |
| DMARC | Tells receivers what to do when SPF or DKIM fail, and sends you reports | "If it fails, quarantine or reject it, and tell us" |
DMARC has three policy levels: none (monitor only), quarantine (send to junk) and reject (block). Start at none, read the reports to find every service that sends email for you (your website, invoicing software, newsletter tool), fix their SPF and DKIM, then move to quarantine and reject. Stopping at none protects nobody.
These records also affect whether your own email arrives. Google's email sender guidelines require all senders to Gmail accounts to set up SPF or DKIM, and since 1 February 2024 anyone sending more than 5,000 messages a day must have SPF, DKIM and DMARC.
Email security requirements: the baseline
For a typical Irish SME on Microsoft 365, the baseline is:
- SPF, DKIM and DMARC on every domain you own, including ones you do not send from.
- Email filtering for spam, malicious links and attachments, switched on for every mailbox.
- MFA on every account, including shared mailboxes and admin accounts.
- Legacy authentication protocols switched off.
- Admin accounts separate from day-to-day accounts.
- Alerts for suspicious sign-ins and new inbox rules.
- External email tagged so staff can see it came from outside.
- A call-back process for payment or bank detail changes.
- Regular phishing awareness training.
The NCSC's Microsoft 365 secure configuration framework puts several of these in its foundational controls: dedicated admin accounts, MFA for all global admins and all users, audit and mailbox logging, no legacy authentication and Conditional Access. Its guidance for small business adds that most email providers now include spam and phishing blocking, and enabling it across all devices helps prevent attacks.
How to improve email security in 10 steps
- Check your domain's SPF, DKIM and DMARC records with a free online checker.
- Publish DMARC at "none" and start reading the reports.
- Turn on MFA for every user. Use an authenticator app rather than SMS where possible.
- Block legacy authentication in Microsoft 365.
- Review who has admin rights and remove anyone who does not need them.
- Turn on the anti-phishing, safe links and safe attachments features your licence includes.
- Move DMARC to quarantine, then reject, once legitimate senders pass.
- Set up alerts for impossible travel, new forwarding and unusual sign-ins.
- Start monthly phishing simulations and short training.
- Write a one-page email security policy and get staff to read it.
Email security solutions: gateways, built-in tools and managed services
People searching for "best email security", "top 10 email security solutions" or "email security gateway comparison" will find many vendor rankings. We do not rank email security companies or vendors here, because the right choice depends on what you already pay for. These are the main types of email security tools:
| Type | How it works | Good for |
|---|---|---|
| Built-in Microsoft 365 protection | Filtering and anti-phishing inside Exchange Online, with more in higher licences | Most SMEs, as a starting point |
| Secure email gateway | Mail is routed through a third-party filter before it reaches you, changing your MX records | Organisations wanting a separate filtering layer |
| API-based email security | Connects to Microsoft 365 directly and scans mail inside the mailbox, including internal email | Catching threats that get past the first filter |
| Managed email security service | A provider runs and monitors the tools for you | Businesses without in-house security staff |
How to compare email security software:
- Does it catch impersonation as well as malware? Ask how it detects BEC with no link or attachment.
- Does it scan internal email? A compromised internal account is a common attack path.
- Can you remove an email from every inbox after delivery?
- What does it cost on top of what Microsoft 365 already includes?
- Who watches the alerts? A tool nobody monitors is not much use.
What is managed email security, or email security as a service?
It means a provider configures, monitors and responds on your behalf, rather than you buying a tool and running it yourself. For most SMEs, the more important half is account monitoring: spotting when a real mailbox has been taken over, which no filter can prevent once the attacker has the password.
ERS provides this through Microsoft 365 monitoring, a 24/7 identity threat detection and response service covering Exchange, SharePoint, OneDrive and Teams. It alerts on impossible travel, unusual login times, privilege escalation and rogue OAuth apps, and enforces MFA, Conditional Access and data loss prevention. As a Microsoft Cloud Solution Provider, ERS can also advise which Microsoft 365 licence includes the email protection you need.
Phishing awareness training
Filters miss some phishing, so staff are the last check. The NCSC's small business guidance says to ensure all employees undergo at least basic cyber security training, and to use another way, such as a phone call, to confirm unusual requests.
Effective phishing email training is short and regular, not a yearly slideshow. ERS's user awareness training runs continuous monthly modules and simulated phishing using links, attachments and fake login pages. It includes CEO fraud and internal email impersonation tests, "burst mode" campaigns so staff cannot warn each other, and reports that show repeat clickers and higher-risk departments.
Email security policy template
A good email security policy fits on one or two pages. Here is a sample structure you can adapt:
- Purpose and scope. Covers all staff, contractors and devices that access company email.
- Accounts. Every user has their own account. No shared passwords. MFA is required on all accounts.
- Passwords. Follow the company password policy: long passphrases, a password manager, no reuse.
- Suspicious email. Do not click links or open attachments you were not expecting. Report suspicious email using the report button or to IT.
- Payments and bank details. Never act on an email request to change bank details or make an urgent payment without a call-back on a known number and a second approval.
- Sensitive data. Do not send personal or confidential data unencrypted. Use the company's secure sharing tools.
- Personal use and auto-forwarding. No automatic forwarding of company email to personal accounts.
- Lost devices. Report a lost phone or laptop with email on it immediately so it can be locked or wiped.
- Training. All staff complete phishing awareness training when they join and at regular intervals.
- Breaches. Report any suspected compromise at once, as personal data breaches may need to go to the Data Protection Commission within 72 hours.
For more email security policy examples, the NCSC's business email compromise guidance sets out the payment controls in detail.
Email security best practices for staff
- Hover over links before clicking, and check the real address.
- Be suspicious of urgency, secrecy and requests to bypass normal steps.
- Check the sender's full email address, not just the display name.
- Never enter your Microsoft 365 password on a page you reached from an email link.
- Report mistakes quickly. A fast report limits the damage far more than a quiet one.
How ERS helps with email security
- 24/7 Microsoft 365 monitoring for account takeover.
- User awareness training with phishing simulations.
- Dark web monitoring for leaked staff passwords.
- Managed detection and response if a phishing click leads further.
Read our guide to invoice fraud and business email compromise for the payment side. ERS quotes per business after a short call. Contact us or call 01 885 9500.