Secure Business Email is an independent reference on protecting business email. It explains how email authentication works, how business email compromise unfolds, and what to configure, in what order, in a small organisation that runs on Microsoft 365 or a similar platform.
What this site is
A set of long-form guides, an index of them, and one tool. The guides are written for the person who has to make the settings change and live with the result: an IT administrator, a managed service engineer, or an owner who has been given the job. They explain the mechanism first, then the configuration, then how it goes wrong.
The tool is a self-assessment questionnaire. It turns your answers into a prioritised list of things to look at, with plain-language fixes and links to the relevant guide. It is described in full on its own page.
What this site is not
- It is not a scanner or monitor. Nothing here looks at your domain, your DNS or your mailboxes. Anything the tool tells you comes from the answers you typed in.
- It is not a certification, audit or guarantee. A result from the tool is a reading of your own answers. It cannot say that a domain is protected or that a record is correct.
- It is not affiliated with, endorsed by or a partner of Microsoft, Google or any other vendor. Product and service names are used only to describe the settings people have to find.
- It does not ask for sensitive information. It will never ask for a password, an MFA code, a token, a session cookie or the content of any message.
How the guides are written
Each guide states who it is for, explains the mechanism with worked examples, includes commands and records that are safe to run as written, and says plainly which commands change things. Where a detail depends on your licence, your plan or the current behaviour of a product, the guide says how to check it instead of asserting it, because those details change.
Examples use reserved names such as example.com and documentation address ranges. Nothing in the guides is drawn from a real customer or a real incident; where a scenario appears it is described as a composite or as hypothetical.
Corrections and independence
Technical guidance ages. If you find something that is wrong, out of date or unclear, the contact page explains whether a direct channel is open yet. The site carries no advertising and no sponsored content, and it recommends no product in return for payment.
To get started, read the resources index, or take the readiness assessment and follow the guides it points to.