Security
A ten-point email security checklist for small businesses
· 7 min read · Egreed Tech, Kigali
You do not need a security department to remove most of your risk. You need a short list, done properly, and reviewed when staff change.
Authentication and identity
Start where attackers start: your domain and your logins.
- Publish exactly one SPF record and verify DKIM signing on live mail
- Move DMARC past monitoring once reports are clean
- Give every person their own mailbox — never share one login
- Require inactivity locking so unattended devices are not open inboxes
Access and permissions
Most incidents are ordinary over-permission rather than intrusion.
- Keep at least two administrators, and no more than you need
- Confirm roles are enforced on the server, not by the browser
- Review workspace membership on shared folders every quarter
Sharing and offboarding
Two habits close the most common long-term exposure.
- Give every external share link an expiry and revoke it when done
- On the day someone leaves: suspend the mailbox, transfer its mail, convert the address to an alias, revoke their links
- Read the audit log after any suspected incident — sign-ins, lock events and link revocations are recorded
Put this into practice
Company mailboxes on your own domain, encrypted storage, priced in Rwandan francs.