A Mail Security Checklist for Small Teams

March 23, 2026 · Guides · ITProMail team

Small teams usually inherit their mail setup rather than designing it. A domain was registered years ago, a few aliases were added for convenience, and somebody set up a forwarding rule that nobody remembers. This checklist is a way to bring that setup under control without a large project. Work through it once, then repeat the review on a fixed schedule. Each item links to the relevant guide where one exists.

Accounts and sign-in

Every mail account has a second factor enabled, either a TOTP app or a FIDO2 security key. Prefer the security key for administrator accounts. See the TOTP and FIDO2 guides.
No two people share a login. Use separate accounts and aliases for shared functions such as billing or support.
Each client device has its own app password, listed under Account > Security, so a lost device can be cut off without disrupting others. The app passwords guide covers this.
Active sessions are reviewed and unfamiliar ones are revoked.
The account recovery path is written down and tested. See the account recovery guide.

Domain records

For a custom domain, the records that govern authentication and transport should be present and consistent. The mechanics are covered in SPF, DKIM and DMARC explained.

SPF lists only the services that actually send mail for the domain. For ITProMail hosted domains the record is v=spf1 include:_spf.itpromail.com -all. Remove any other sender from the record unless it is still in use.
DKIM is published for the selector in use. For ITProMail hosted domains the selector is itpro1, with a CNAME pointing to itpro1._domainkey.itpromail.com.
A DMARC record exists with a reporting address. A simple starting point looks like this, with example values:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Once reports show that legitimate mail passes, move the policy from p=none to quarantine, and later to reject. Do not skip the reporting stage.
MTA-STS and TLS-RPT are published for hosted domains, and their status should be checked after any change to mail hosting.

Aliases, forwarding and filters

List every alias and forwarding rule, and remove any that no longer serve a purpose. Aliases are under Account > Aliases, and filters are under Account > Filters.
No mail is forwarded to a personal or external address without a documented reason.
Sieve scripts are kept in a shared record, with each rule's purpose written next to it. The Sieve guide and the Sieve filter recipes cover common patterns.
Forwarding and auto-reply behavior is checked after any change of staff. The forwarding and auto-reply guide describes the options.

Sending and abuse

Sending limits are understood. Outbound volume is limited to 300 recipients per hour and 1000 per day, so bulk campaigns need planning.
Someone is responsible for reading abuse reports and for responding to them.
Staff know where to report suspicious mail: security@itpromail.com for security concerns, and abuse@itpromail.com for abuse.

Encryption and keys

Keys used for encryption are listed in an inventory, with fingerprints, expiry dates and backup locations.
Revocation certificates are created and stored offline. See key loss and recovery planning.
Published keys are current. The PGP guide covers publication under Account > Encryption.

Backups and exports

Mail is exported on a schedule. Account > Export produces an mbox file, and any IMAP tool can copy a mailbox. The mailbox export guide describes the options.
At least one restore has been tested. A backup that has never been opened is not evidence of anything.
Trash is emptied after 14 days on ITProMail, so anything that must be kept should be moved out of Trash and into a folder that is backed up.

Offboarding

When someone leaves, the mail process must be as deliberate as the arrival process. Work through these in order:

Change the password and sign out all sessions for the account.
Revoke every app password associated with the account.
Review and remove forwarding rules, filters and aliases that send mail elsewhere.
Move any shared aliases to another account, and update the people who use them.
Export the mailbox for retention, if policy requires it.
Remove the account. ITProMail closure is read-only for 30 days, after which the account is permanently deleted, so plan the export before closing it.

Review on a schedule

Choose a fixed cadence. Monthly, review forwarding rules and sessions. Quarterly, review aliases, app passwords, sending volume and DMARC reports. Once a year, test a restore and check the key inventory. The security checklist contains the platform settings to verify during each review. Phishing deserves a regular mention in team discussions as well. The lures that most often reach small teams are covered in spotting modern phishing, and the QR code and consent variants are described in QR code phishing in email and OAuth consent phishing.