Annual Email Security Audit Checklist for a Small Business

Email security decays quietly. A staff member leaves and keeps a signed-in phone; a marketing tool is cancelled but stays in SPF; a DKIM key is four years old; a rule forwarding invoices to an outside address was set by an attacker eighteen months ago. None of it announces itself. One afternoon a year, working through the checklist below, finds and fixes all of it. Block three hours, bring the domain and mail-provider logins, and go in order.

Quick answer

Audit six areas: DNS records, signing keys and authentication policy, user accounts and access, devices and app passwords, mailbox rules and forwards, and the domain registrar. For each, compare what exists against what should exist, remove what is stale, and write the date on the record. Repeat annually and after any security incident.

1. DNS records (30 minutes)

1. Export the full zone and go through every record, writing its purpose next to it. Delete records for cancelled services, especially CNAMEs and old DKIM selectors.
2. Confirm MX points to your current mail host only. For OquMail that is a single record to mail.oqumail.com at priority 10, and no leftover MX from a previous host.
3. Check SPF: exactly one TXT records (short text lines in DNS used for email security) starting v=spf1, under ten DNS lookups, and no includes for services you no longer use. The OquMail base record is v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com ~all.
4. Check DMARC at _dmarc: the policy is at least quarantine, ideally reject; the rua address is a mailbox someone reads; sp= covers subdomains.
5. Run the live verification in your mail provider's dashboard. OquMail shows each record's status so mismatches are obvious.

2. Keys and authentication (20 minutes)

1. List every DKIM selector under _domainkey. Identify which service each belongs to; delete unknowns.
2. Rotate DKIM keys older than a year using the two-selector method: publish the new one, switch signing, wait a week, remove the old.
3. Read the last month of DMARC aggregate reports. Any legitimate source failing alignment gets fixed; any unknown source is evidence for tightening the policy.
4. Rotate API keys for your send API and any integrations, revoke keys you cannot attribute to a running system, and confirm each remaining key is stored in an environment variable or secret store rather than in code.

3. Users and access (30 minutes)

1. List every mailbox and alias. For each, confirm a current owner. Disable or delete mailboxes of people who have left after applying the retention policy.
2. Confirm two-factor authentication is enabled on every account, starting with the owner, finance, and admin accounts.
3. Review who holds admin at the mail provider, the DNS host, and the registrar. Two named people; remove everyone else.
4. Check role mailboxes (info@, support@, billing@) for shared passwords and convert them to alias delivery or managed credentials.
5. Run the team's addresses through a breach-notification service and force a password change for any hit.

4. Devices and app passwords (20 minutes)

1. For each user, list the devices and app passwords connected to their mailbox. Revoke anything unnamed, unknown, or belonging to a device that has been replaced.
2. Confirm each device with work mail has a screen lock and current operating-system updates.
3. Confirm mail apps use the correct encrypted settings: IMAP mail.oqumail.com port 993 SSL/TLS, SMTP mail.oqumail.com port 587 STARTTLS.
4. Remove work mail from any personal device belonging to someone who has left.

5. Rules, forwards, and recovery settings (30 minutes)

1. Open every mailbox, including role mailboxes, and read its rules and filters. Delete any forward to an external address that the owner did not create, and any rule that deletes or hides mail from banks, customers, or the team.
2. Check automatic-forwarding settings separately from rules.
3. Check the recovery email and phone on each account belong to that person or the company.
4. Check signatures and Reply-To settings for changes.
5. Sample the sent folder and the provider's delivery logs for the past month for messages nobody recognises.

6. Domain registrar (15 minutes)

1. Transfer lock on, two-factor authentication on, auto-renew on with a card that outlives the renewal date, WHOIS privacy on.
2. registrar (the company where you bought your domain, e.g. Namecheap or GoDaddy) account email is not on the domain it controls.
3. Run a lookalike-domain check and note any new registrations that imitate you.
4. Confirm security.txt has not expired and postmaster@, abuse@, and security@ still deliver to a person.

Close out

• Write down what you changed, what you removed, and the date, in the same document as last year's audit.
• Schedule next year's audit now, plus the DKIM rotation and security.txt expiry reminders.
• Run the fifteen-minute phishing session with the team while security is on everyone's mind.
• Test one backup restore while you are at it.

Common questions

Three hours is a lot. Can we split it?

Yes. DNS and keys one week, users and devices the next, rules and registrar the week after. What matters is that all six areas are covered within a short window so nothing is missed between them.

What is the single most important item if we only do one?

Rules and forwards. A hidden forward is the most common way a compromised mailbox keeps leaking after everything else has been fixed.

Should we hire someone to do this?

A small business can do this list itself. Bring in outside help if the audit finds signs of an active compromise, or if you handle data that a regulator requires to be independently assessed.