Cybersecurity · Email
The six layers of email security a 25 to 100 person business needs, what each one stops, and how to decide what to buy versus what you already own.
Six layers, each stops something different
DMARC protects your domain’s name
Verify every payment change by phone
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Email security for a small business is not one product. It is six layers that work together: filtering that blocks malicious messages before they arrive, domain authentication (SPF, DKIM and DMARC) so criminals cannot easily send mail as you, multi-factor authentication so stolen passwords do not unlock mailboxes, warning banners on outside mail, a payment verification rule, and short regular training.
The stakes are real. The FBI’s 2025 Internet Crime Report recorded about $3.05 billion in reported losses from business email compromise, where criminals impersonate executives, vendors or clients to redirect payments. Most businesses already pay for part of this in Microsoft 365 or Google Workspace. The work is turning it on, configuring it well and filling the gaps.
Filtering scans incoming mail for spam, malware, malicious links and impersonation before it reaches the inbox.
Decision rule: if you are on Microsoft 365 Business Standard or Google Workspace Starter and handle payments or sensitive data, budget for stronger filtering, either by upgrading your plan or adding a product.
These three DNS records prove which servers may send mail for your domain and tell receivers what to do with mail that fails the check.
Since 2024, Google requires bulk senders to its users to have SPF, DKIM and DMARC in place, and in 2025 Microsoft announced similar requirements for high-volume senders to Outlook.com. Even if you do not send in bulk, these records help your invoices reach inboxes and make spoofing your domain harder.
Many email attacks do not break in through a message; they log in with a stolen password. Multi-factor authentication stops most of those. Turn it on for every user, including the owner, shared admin accounts and anyone with access to finance. Block older sign-in methods that skip MFA. Our guide to Microsoft 365 security settings walks through the tenant settings.
Also watch for signs a mailbox is already compromised: new forwarding rules to outside addresses, inbox rules that hide replies, and sign-ins from unexpected countries.
Want to know how well your email is protected today? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
A short banner on mail from outside your organization, such as “This message came from outside the company,” helps people pause when a message pretends to come from the owner. Both Microsoft 365 and Google Workspace can add external tags. Keep the wording short so people keep reading it, and consider extra warnings for first-time senders and lookalike domains.
Technology will not catch every convincing request. A simple written rule closes the gap:
This one rule targets the payment-redirection fraud behind many of the most expensive email losses.
Annual hour-long training is quickly forgotten. Short sessions work better: ten minutes each quarter on current examples, plus simulated phishing if your team will engage with it. Make reporting easy with a report button, thank people who report, and never punish someone for clicking and then speaking up. The faster you hear about a click, the less damage it does.
Basic spam and malware filtering, MFA, external sender tags, SPF and DKIM setup in Microsoft 365 or Google Workspace.
Advanced link and attachment protection, impersonation detection and better quarantine controls, through a higher plan or add-on.
DMARC reporting tools, security awareness training platforms and email backup.
Email also needs backing up. Deleted mail is only recoverable for a limited time in most platforms, so include mailboxes in your backup and recovery plan.
Write these steps down before you need them, so nobody has to improvise.
DMARC stops criminals sending as your exact domain. It does not stop them registering a lookalike, such as one letter changed or a different ending, and emailing your clients or staff from it. Reduce the risk:
JLB USA’s cybersecurity services include email security, multi-factor authentication, access reviews, same-day removal of leavers, endpoint protection, monitored backups with tested restores and help with cyber-insurance questionnaires. We administer Microsoft 365 and Google Workspace for businesses with roughly 25 to 100 employees and reply within 5 minutes by email or phone.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Six layers: filtering and threat protection, SPF, DKIM and DMARC, multi-factor authentication on every mailbox, external sender banners, a phone-verification rule for payment changes, and short regular training.
Baseline filtering is included, but plans such as Business Basic and Standard lack some advanced protections. Many small businesses upgrade to Business Premium or add a third-party filtering product, then configure DMARC and MFA.
DMARC tells receiving mail servers what to do with messages that fail SPF and DKIM checks for your domain and sends you reports. It makes spoofing your domain harder and helps legitimate mail get delivered.
The FBI’s 2025 Internet Crime Report recorded about $3.05 billion in reported business email compromise losses in the United States.
Look for forwarding or inbox rules you did not create, sent messages you did not write, password reset emails you did not request and sign-ins from unfamiliar locations.
