Email security checklist: 30 minutes for IT and finance teams

This email security checklist is for two people in one room: the IT manager who controls your domains, mailboxes and sign-in rules, and the finance lead who controls the payments a fake email is trying to trigger. It takes about 30 minutes. Each item gets a yes, a no or a "not sure", and every no leaves the room with an owner and a date.

It is written for companies with many mailboxes, several domains, more than one entity or location, and an approval chain for payments. For the email records and a safe path to p=reject, see our guide to DMARC policy not enabled.

Why do IT and finance need to run it together?

Because the loss lands in finance, and most of the controls sit in IT. The FBI's Internet Crime Complaint Center counted just over 3 billion dollars in reported losses to business email compromise in 2025, second only to investment fraud, in its 2025 annual report. It describes criminals compromising email accounts "and other forms of communication such as phone numbers and virtual meeting applications" to move money without permission.

A fake payment request arrives in one of two ways: from outside, in mail forged in your domain's name, or from inside, from a real mailbox someone has entered with a stolen password. Domain records stop the first. Sign-in and mailbox controls stop the second. Finance's payment rules catch what gets past both.

What is on the 30-minute checklist?

Bring a list of every domain the company owns, someone who can open the email admin settings, and the written payment approval policy.

#	Check	Owner	A yes looks like
1	Main domain authenticated	IT	SPF and DKIM pass; DMARC at quarantine or reject
2	Every sending domain and subdomain	IT	Listed with its sending services, all authenticated
3	Domains that never send mail	IT	A no-mail SPF record and DMARC at reject
4	Multi-factor sign-in	IT	On every mailbox; the strongest kind for finance, executives and admins
5	Admin accounts for email and DNS	IT	Few, separate from daily accounts, reviewed when anyone leaves
6	Forwarding to outside addresses	IT	Blocked by default; rule changes logged
7	Bank-detail changes	Finance	Confirmed by calling a number already on file
8	Payments above a set limit	Finance	Approved by a second person
9	Reporting a suspicious email	IT and finance	One way to report, and a named responder
10	Ownership	Both	Every open item has one owner and a date

Is sender authentication set up on your main domain?

Three DNS records do the work. SPF lists the servers allowed to send as your domain. DKIM signs each message so receivers can tell it came from you, unchanged. DMARC checks that those results match the address the reader sees, and tells receivers what to do with mail that fails: nothing (p=none), the spam folder (p=quarantine) or refuse it (p=reject).

The item is a yes only at quarantine or reject. CISA's directive for federal email, BOD 18-01, notes that only p=reject blocks unauthenticated mail completely; quarantine usually still delivers it to a junk folder. Its joint phishing guidance says to set DMARC to "reject" for sent emails. To see where your main domain stands today, check your domain with our free tool.

Which domains and subdomains send mail, and which never should?

List every domain you own: the main one, each entity's or region's, brands from acquisitions, campaign domains and domains bought only to protect the name. Mark each one as sending or not.

For each sending domain, name every service that sends as it: the main email system, billing, payroll, HR, marketing and e-signature tools. NIST's guide to trustworthy email, SP 800-177 Rev. 1, says each outside sender should get its own DKIM key pair, and that when a contract ends, its keys and SPF entries come out of your DNS. Check subdomains as well: under BOD 18-01 they follow the main domain's policy unless set otherwise, and a weaker policy on any of them undoes the protection.

Lock the domains that never send mail. NIST recommends a no-mail SPF record, v=spf1 -all, on each one, so phishers can't use domains "that they believe may not be monitored as closely." CISA adds DMARC at p=reject, after a p=none period confirms from the reports that nothing legitimate sends from them.

Is multi-factor sign-in on every mailbox, starting with finance and executives?

A spoofing fix does nothing against someone signed in to a real mailbox. The FBI's alert on email compromise through cloud email services is direct: "Enable multi-factor authentication for all email accounts." It also says to turn off older email protocols that "can be used to circumvent multi-factor authentication."

"All" includes the accounts people forget: shared mailboxes such as the payables inbox, service accounts and the mailboxes of people on leave. CISA's guidance puts phishing-resistant sign-in first on administrator and privileged accounts, "such as those with access to e-discovery tools or broad access to customer or financial data." In practice: admins, finance, payroll, executives and their assistants.

Who holds admin rights to email and DNS?

Ask for two lists: everyone who can change email settings, and everyone who can sign in to the account that holds your DNS records. Whoever holds that login can rewrite your SPF and DMARC records.

CISA's advice is to "only allow designated administrator accounts to be used for administrative purposes," so admin work happens from a separate account, not an everyday mailbox. NIST adds that when an email administrator leaves, every credential they had access to should be revoked. A yes means both lists are short and current.

Can mail be forwarded outside the company without anyone noticing?

Forwarding rules are how an intruder stays in a mailbox. The FBI describes criminals who "configure mailbox rules of a compromised account to delete key messages" and "enable automatic forwarding to an outside email account," then read the payment threads and step in at the right moment.

Its advice to administrators: block automatic forwarding to outside addresses, log mailbox sign-in and settings changes for at least 90 days, alert on suspicious activity such as sign-ins from abroad, and add a banner to mail from outside. If a team truly needs to forward, allow it address by address, with a reason on file.

What does finance check before bank details change or money moves?

Two rules, written into the payment policy and applied the same way in every entity and location.

A call-back on a known number. Confirm any request to change a supplier's or employee's bank details by calling a number you had before the request arrived, from the supplier file or the contract, never from the email or the invoice. The FBI: "Verify all payment changes and transactions in person or via a known telephone number." Its 2024 update on business email compromise repeats the point. Requests by phone or video call get the same call-back, because a familiar voice is no longer proof. We covered why in how generative AI changed business security.

Two-person approval above a limit. Above a limit finance sets, a payment needs a second person who did not enter it. NIST's definition of separation of duty states the principle: "no user should be given enough privileges to misuse the system on their own," with the two-person rule as one way to enforce it. Urgent requests from executives get no exception. Our guide to accounts payable automation shows where both checks sit in an invoice workflow.

How do staff report a suspicious email, and what happens next?

Every employee should know one way to report: a button or one address, the same in every office. CISA asks organizations to teach staff "the importance of reporting instances of opening suspicious emails, links, attachments, or other potential lures." Say plainly that reporting a click is welcome.

Name who reads the reports and what they do the same day, and keep the bank's fraud contact on file. If money has gone, the FBI says "time is of the essence": ask your bank for a recall, then file a complaint at ic3.gov. If fakes go out in your company's name, the FTC's guidance on business email imposters says to report it, tell your customers, and leave links out of any warning email.

Who owns each item after the 30 minutes?

The owner column is the point. A no with no name next to it is still a no next quarter. Give each open item one owner, a date and someone who confirms it is done. Then run the list again on a schedule, and whenever a domain, sending service, admin, entity or payment rule changes.

How can Raileon help?

Our free email security check reads a domain's SPF, DKIM and DMARC records from public DNS and gives a plain answer: protected, partly protected or at risk. For a walkthrough, join our free live session on fake invoices and email spoofing on Thursday, November 5, at 12 PM ET, online on raileon.com: how inboxes decide whether to trust your email, a private check of your own domain, a one-page sheet for your IT team and a card with three payment checks. The security and email section of our Business Audit checks the same records from the outside, with no logins or passwords. And when we automate work that moves money, nothing moves until someone on your team says yes.

FAQ

What should an email security checklist include?

It should cover sender authentication on every domain, multi-factor sign-in on every mailbox, admin accounts, forwarding rules, payment checks and how staff report suspicious email. Each item needs a named owner in IT or finance and a review date.

How often should we run the checklist?

Run it at least once a quarter, and again whenever something changes. New domains, acquisitions, sending services, admins or payment rules are all reasons to run it again.

Do domains that never send email need DMARC?

Yes, because anyone can still send fake mail in their name. CISA's guidance is to confirm from reports that nothing legitimate sends from them, then set DMARC to p=reject and publish an SPF record of v=spf1 -all.

Who should own email security, IT or finance?

Both, split by item. IT owns the domains, records, sign-in, admin rights and forwarding rules, and finance owns the call-back and approval rules that stop a fake request from turning into a payment.

Want a second opinion on your list?

Bring your checklist results to a free 20-minute call. We'll go through the open items with you and suggest what to fix first.

Book a free 20-minute call