Secure Email and Secure Browsing

Email is where most of your business lives and where most trouble starts. Your staff send quotes, invoices, tax forms and bank details through it. Your customers trust it. Attackers know both facts. The FBI's Internet Crime Complaint Center (IC3) logged 24,768 business email compromise complaints in its 2025 report, with reported losses of $3,046,598,558. Divide the one by the other and the average complaint was about $123,000. Many began with a single email that looked like it came from someone the victim already trusted.

Secure email, defined

When a vendor says an email product is secure, ask which of these they mean. They are different tools aimed at different problems, and having one does not give you the others.

Read the table again with your own office in mind. A dental office that emails treatment plans mostly needs the portal. A plumbing company that gets spoofed invoices mostly needs authentication. Nearly everyone needs the last row.

A word on end-to-end

People often hear "encrypted email" and assume end-to-end. For most small offices it is a poor fit. Your customers will not install anything to read a quote. The portal approach, where they click a link and sign in, works better for ordinary customers. Save end-to-end for the rare relationship where both sides want it and have the skills to keep their keys.

SPF, DKIM and DMARC in plain words

Anyone can type any name into the From line of an email. That is how the internet's mail system was built. A fake invoice that says it comes from billing at your company can be sent by a stranger in one afternoon. Three short records, published in your domain's DNS (the internet's phone book), let the receiving mail server catch that.

Think of the front office. Your company has a mail room with a stamp.

• SPF is the list on the mail room wall of which delivery trucks may drop off mail under your company's name. If a truck not on the list shows up with a package labeled from you, the receiver gets suspicious.
• DKIM is the wax seal on each envelope. The seal can only be made with a private stamp you hold, and it breaks if someone opens and changes the letter. The receiver checks the seal against a public copy of the stamp pattern that you publish.
• DMARC is the written instruction you give the receiver: "If a letter claims to be from us and neither the truck list nor the seal checks out, here is what to do. Deliver it anyway, put it in the junk pile, or throw it away. And mail us a daily report of what you saw."

That last line matters. DMARC does not only ask whether SPF or DKIM passed. It asks whether the domain that passed matches the domain the reader sees in the From line. A scammer can pass SPF for his own domain, but not for yours. Microsoft and Google both describe it this way in their admin guides.

The three policies

A safe rollout

Both Microsoft and Google tell you to turn on SPF and DKIM first, and Google says to allow about 48 hours after setting them up before you enable DMARC. Then publish a DMARC record at _dmarc.yourdomain as a TXT record at the company that hosts your DNS (often your domain registrar or web host). It looks like this, using an invented domain:

v=DMARC1; p=none; rua=mailto:dmarc-reports@bluefinplumbing.example

The rua part says where daily summary reports go. Create a dedicated mailbox or group for them, because the volume can surprise you. Microsoft's guide recommends starting at p=none, reading the reports to find legitimate senders that fail, then moving to quarantine and then reject, optionally raising the percentage of mail the policy applies to in steps (10, 25, 50, 75, 100). Google gives the same sequence.

The legitimate senders that fail are usually things you forgot: the invoicing program that sends email "from" your address, the newsletter service, the website contact form, the phone system that emails voicemails. Each needs to be added to SPF or set up to sign with DKIM. That is the real work, and it is the reason to go slowly.

What DMARC does not stop

It cannot stop a criminal from registering bluefin-plumbing.example (with a hyphen) when you are bluefinplumbing.example. That domain is theirs, and it can pass its own checks. It cannot stop a real mailbox that has been taken over, because the mail then truly comes from your servers. And it cannot stop a message from a display name trick, where the name shows as "Dana Whitaker" and the address behind it is a random free mailbox. Those are why the verification habits in lesson 08 and the mailbox steps below still matter. DMARC is one layer. It closes the cheapest door, which is exact-domain spoofing of you.

The mailbox itself

Shared mailboxes

Offices love a shared address such as info@ or billing@. The risky way to do it is one account with one password that everyone knows. When someone leaves, nobody changes it. When a customer is handled badly, nobody can say who did it. When the account is breached, you cannot tell whose device did it.

Both Microsoft 365 and Google Workspace offer ways to let each person open a shared mailbox or group inbox with their own login and their own two-step sign-in. Confirm the current steps in the vendor's admin help for your plan. The rule is the same either way: never one shared password for a mailbox, and remove a person's access the day they leave.

Auto-forwarding and hidden rules

One of the quietest tricks after an account is taken over is to add a rule that forwards copies of mail to an outside address, or that moves or deletes replies so the real owner never sees them. The attacker can then watch invoices and wait for a good moment to slip in a bank change. Microsoft's own guidance says email forwarding can be useful but can also pose a security risk through the potential disclosure of information. A forward set on purpose and one planted by an intruder look the same to the outside recipient.

Two settings matter in Microsoft 365. Users can set inbox rules to forward externally, and admins can set mailbox forwarding. The outbound spam policy has a setting for automatic external forwarding, which defaults to "Automatic - System-controlled." Microsoft says that default was changed to off in 2021 for new organizations and for those not actively using it, but older organizations already using it can keep the on behavior. Microsoft recommends choosing on or off explicitly instead of relying on the default. There is also an Auto-forwarded messages report that shows who in the organization forwards mail externally. Google Workspace has its own admin controls for automatic forwarding. Check them in the admin console help.

1. Pick one person, probably the office manager, to review forwarding settings for every mailbox. Do it once now, then every quarter.
2. Look at each mailbox's inbox rules. Delete any you do not recognize, especially ones that forward outside, move mail to "RSS" or "Archive" folders nobody uses, or delete messages containing words like invoice, wire or bank.
3. Check mailbox-level forwarding in the admin console.
4. Decide as a business whether outside forwarding is allowed at all. For most small offices the answer is no, except for a named, approved exception.
5. If a mailbox was ever compromised, check these settings again after the password reset. A new password does not remove a rule.

Sending sensitive data safely

Set one plain office rule: ordinary email is for ordinary business. The FTC's small business guidance says to never share passwords by email, over the phone or by text. The same logic covers Social Security numbers, full card numbers, bank login details and scans of IDs. Mail copies itself, and that is the whole problem. A message sits on your server, the customer's server, three phones and a backup, and any one of those can be taken over later.

Secure browsing, defined

Secure browsing means using a browser that is current, over encrypted connections, with a short list of approved extensions, controlled downloads and saved passwords, so a web page has a hard time harming the computer or stealing a login. The browser is where staff reach your bank, payroll, accounting software, email and the admin console. If someone takes over the browser, they ride along with every one of those sessions.

HTTPS and the padlock

An address that starts with https:// means the connection between the browser and the site is encrypted, the same job TLS does for email. It stops a stranger on the coffee shop network from reading what you type. It does not tell you the site is honest. Criminals get certificates for their lookalike pages as easily as honest businesses do. Staff should read the domain before typing a password (lesson 08 shows how).

Updates

Verizon's 2026 Data Breach Investigations Report says exploiting software vulnerabilities now beats stolen passwords as the most common way in, at 31% of breaches. A vulnerability is a flaw in software that attackers can use. The fix is an update. Set browsers to update themselves and restart weekly. A browser that has been open for 40 days is a browser with updates waiting. Do the same for the operating system, PDF reader and office suite.

Extensions

An extension is a small add-on program inside the browser. Some read every page you visit. A coupon helper or free PDF tool can change hands to a new owner who pushes a harmful update. Rule: no extension unless the business approves it. Both Chrome and Edge let an administrator manage extensions centrally with policy, which means the office manager or IT provider can allow a short list and block the rest. In a very small office with no policy tool, make a written list and check each browser quarterly.

DNS filtering

Every time a browser goes to a name like example.com, it first asks a DNS service for the number address. A filtering DNS service refuses to answer for names it knows are used for malware and phishing. Quad9 is a free, public service run by a Swiss nonprofit that blocks known malicious domains using threat information from multiple security providers. You can point your router at it, or point individual computers. It is not perfect. It blocks only names already known to be bad, and a new phishing site gets through for a while. Treat it as one cheap extra layer, not a reason to relax.

Saved passwords

Browser-saved passwords are better than a sticky note and worse than a business password manager. The problem is that on a shared or stolen computer, or one infected with a data-stealing program, the browser store is a short target. For the business logins that matter (email, bank, payroll, domain registrar), use the business password manager from lesson 02 and turn off the browser's own prompt to save passwords on work computers.

Downloads

• Show full file extensions in Windows and on the Mac. The FBI recommends this in its business email compromise alert. A file named invoice.pdf.exe is a program, not a PDF.
• Download software only from the vendor's own site, typed in or reached from a bookmark, not from a search ad. Fake ads for popular programs are a common route for malware.
• Treat "enable content" or "enable macros" on any document as a stop sign.
• Do not let staff install software themselves. Make one person the installer.

Ad blockers and browser profiles

An ad blocker removes much of the junk where fake support numbers and fake software downloads hide. Many business browsers can have one added by policy. It is a cheap improvement and a small convenience cost. Separately, give each person one browser profile for work and another for personal browsing. The work profile signs in with the work account, carries only approved extensions and has no personal shopping logins to tangle things.

Remote support sessions

An honest outside IT provider will sometimes ask to see or control a screen. A scammer will too. The difference is who started it.

• You contacted the provider, using the phone number from your contract or their website.
• You start the session yourself, from the provider's own site or tool, and you read out the code or share the link. They never ask you to install something because they called you.
• Someone from the office watches the screen the whole time.
• When the work ends, close the session and confirm that the tool is shut down.
• Unplanned pop-ups, calls or emails saying your computer is infected and you must "connect" are the scam. Close the tab. Do not call the number on the screen.

The FBI's January 2025 alert on fake remote workers recommends limiting who can install remote desktop software and watching for unusual or unapproved remote access tools. A small office can copy that by making one named person responsible for approving any such program.

Do this this week

Who does what

Questions and answers

Do I need to buy special encrypted email?

Probably not at first. Most plans already use TLS between big providers. Spend your first hour on sender authentication, mailbox rules and two-step sign-in. Add a portal or encrypted option only if you send sensitive files regularly, and check whether your accounting, tax or medical software already includes one.

What is the difference between SPF, DKIM and DMARC?

SPF lists who may send for your domain. DKIM signs each message. DMARC says what to do when the checks fail for the domain people see in the From line, and asks for reports. You need all three working together.

Can turning on DMARC break my own email?

Yes, if you jump straight to reject. Mail from your invoicing program or website form that is not set up to pass can get blocked. That is why the standard rollout starts at p=none, reads the reports, then moves to quarantine and reject.

Who owns my DNS records?

Whoever your domain is registered or hosted with. Many small offices do not know. Start with a WHOIS lookup of your domain or look through old invoices for the registrar. Make sure the account is in the business's name with a business email and two-step sign-in, because that account controls your website and email.

How do I know if a mailbox has a hidden forwarding rule?

Open the mailbox settings and read the list of rules and any forwarding address. In Microsoft 365, admins can also read the Auto-forwarded messages report. Delete any rule you cannot explain.

Is a free DNS filter worth it?

For a small office, yes, as an extra layer. Quad9 is free and is run by a nonprofit. It blocks known-bad names only, so keep the other habits.

A caller says my computer is sending out viruses and offers to fix it. What now?

Hang up. Real security vendors and Microsoft do not cold call you. Tell your outside IT provider or office manager, and write down the number and what they said for your report (see below).

Do customers need to use the same security as me?

No. You control your side: the sender checks, the mailbox, and a portal for the sensitive items. Customers just click a link and sign in.

Hard questions

"We are ten people. Nobody is going to target our email."

Attackers do not pick you by name. They send the same message to thousands of domains and keep the ones that answer. Verizon's 2026 report puts software flaws and stolen passwords at the top of the list of ways in, and neither one cares how small you are. The cost of the basic fixes here is a few hours. The IC3 figure of about $123,000 per business email compromise complaint is the other side of that trade.

"DMARC is a technical headache and our IT person says we do not need it."

Ask a more exact question: what happens today if someone sends invoices that claim to be from our domain? Without a DMARC policy, there is nothing telling receiving servers to refuse them. Microsoft's own admin guide treats DMARC as part of the setup for a custom domain. If your provider has a reason to wait, ask for the date they will do it and the reports they will review. Starting at p=none breaks nothing.

"If we block outside forwarding, people cannot work from their personal accounts."

That is true, and it is the point. Mail forwarded to a personal account lives outside your control, with no two-step sign-in you can enforce and no way to remove it when someone leaves. Provide real remote access to the work mailbox on a phone or laptop, and allow a named exception only if there is a business reason.

"We have used a browser's saved passwords for years and never had a problem."

That is a statement about the past. A saved-password store becomes a problem the day one computer is lost, stolen or infected. A business password manager lets you remove a person's access in one place, share a login without showing the password, and spot reused passwords. It costs a few dollars per user per month at typical small business plans, and you should get a current quote before deciding.

"A VPN or a better firewall will fix all of this."

Neither one touches a forged invoice, a taken-over mailbox or a browser extension that reads every page. Network tools matter and lesson 06 covers them. They are another layer, not a substitute.