Every guide on this site and the assessment tool, with a line on who each is for and when to read it. The guides are independent of one another, but the order within each group is a sensible reading order.
If you are responsible for your domain and its DNS
- SPF and DKIM: for whoever edits the DNS. Read it before you publish or change an authentication record; it covers how a receiver checks a sender, the 10-lookup limit and key splitting.
- DMARC alignment and rollout: the policy layer. It covers alignment, forwarding and mailing lists, a staged none-to-reject rollout and the configuration checklist, in order, the page to keep open while you work.
- Email continuity: for owners and administrators who have never written down what happens when mail stops. Read it when you are asked whether email is “backed up”, and for the DNS and registrar protections that are easy to neglect.
If you administer Microsoft 365
- Microsoft 365 security: for the administrator of a small tenant who needs an order of work. Read it first when you have inherited a tenant and do not know what has been done.
- Conditional access: for the same administrator, once the basics are in place. Read it before you enforce any sign-in policy, and especially before you create the emergency accounts.
- Mailbox security: for anyone who suspects a mailbox has been tampered with, or wants to find out. Read it for the read-only commands that find forwarding, rules, delegates and consented apps.
If your worry is people and money
- Business email compromise: for owners and finance teams who pay invoices by transfer. Read it for the difference between impersonation and account takeover, the first-hour runbook, and the payment-verification rule that matters most.
- Phishing protection: for administrators deciding where to spend limited effort. Read it when you want to know which stage of an attack each control actually covers, and what a filter cannot catch.
The tool
- Email security readiness assessment: for anyone who wants an ordered list of what to fix. Use it before you start, to decide where to begin, and again after a round of changes. It also explains the text of an SPF, DMARC or DKIM record you paste in. It asks only for answers you select, runs in your browser, and does not look at your domain. Its output is a reading of your answers, not a check of your systems.
About the site
- About: what the site is and is not, and how the guides are written.
- Contact: what we can help with, and what must never be sent.
- Privacy: what the site does and does not do with information about you.
Suggested paths
| If you are | Start with | Then |
|---|---|---|
| New to the job and unsure where to begin | The assessment | The guide for your highest-priority item |
| Told “we need DMARC” | SPF, DKIM and DMARC | Microsoft 365 security |
| Recovering from a suspected compromise | Business email compromise | Mailbox security |
| Tightening sign-in | Conditional access | Microsoft 365 security |
| Preparing for the worst day | Email continuity | Business email compromise |