Email security
Your inbox is the master key to every other account. How to lock it down, recognize spoofed senders, use aliases, and what SPF, DKIM and DMARC actually mean.
Why email deserves the most protection
Almost every online account uses your email address for password resets. Whoever controls your inbox can reset your bank login, your social media and your shopping accounts. If you secure only one account properly, make it your main email.
Lock down the account
- Use a unique, long password stored in your password manager.
- Turn on a passkey or 2FA with an authenticator app or security key. See 2FA and passkeys.
- Check recovery settings. Make sure the recovery phone number and recovery email are yours and current. Remove old ones.
- Review connected apps and devices in your Google, Microsoft or Apple account security page, and remove anything you do not use.
- Check forwarding rules and filters. Attackers who get into an inbox often create a hidden rule that forwards or deletes certain messages, such as bank notices. Gmail: Settings > Forwarding and filters. Outlook: Settings > Mail > Rules and Forwarding.
- Run the built-in security check: Google's Security Checkup or Microsoft's security dashboard.
Recognizing spoofed and look-alike senders
Email was designed in an era of trust, so the "From" name is easy to fake. Things to check:
- The real address, not just the display name. Tap or hover on the name.
- Look-alike domains:
rnicrosoft.com(r and n instead of m),paypa1.com, or extra words such asamazon-support-center.com. - Reply-to address that differs from the sender.
- Warnings from your provider like "This message might be dangerous" or "Be careful with this message". Take them seriously.
SPF, DKIM and DMARC in plain English
These three standards help receiving mail servers decide whether a message really came from the domain it claims.
| Standard | What it does | Analogy |
|---|---|---|
| SPF | Lists which servers are allowed to send email for a domain | A list of approved post offices |
| DKIM | Adds a digital signature proving the message was not altered | A wax seal on the envelope |
| DMARC | Tells receivers what to do if SPF/DKIM fail, and sends reports | Instructions: "reject anything without our seal" |
Since 2024, Google and Yahoo require bulk senders to have these set up. If you own a business domain, configuring all three (ending with a DMARC policy of quarantine or reject) makes it much harder for criminals to send email pretending to be you.
Use aliases to reduce spam and exposure
Email aliases let you give each website a different address that forwards to your real inbox. If one starts receiving spam or phishing, you know who leaked it and can switch it off. Options include Apple's Hide My Email (iCloud+), Firefox Relay, DuckDuckGo Email Protection, and plus addressing in Gmail and Outlook (you+shop@gmail.com).
Attachments and links
- Treat unexpected attachments with suspicion, even from people you know: their account may be compromised.
- Do not "enable editing" or "enable content" on documents you did not expect.
- Preview attachments in the browser-based viewer rather than downloading when possible.
Consider a separate email address used only for banking and important accounts, never shared publicly or used for newsletters. Phishers cannot target an address they do not know.
If your email is hacked
Recover it through the provider's official recovery page, change the password, sign out all sessions, remove unknown forwarding rules, recovery options and connected apps, then warn your contacts and check other accounts that use this email. See what to do if you get hacked.
