Key points
- Authenticate your domain (SPF/DKIM/DMARC)
- Enforce 2FA
- Train staff on phishing
- Use a no-ads/no-data-selling provider
- Handle sensitive data with care
How to do it
- Set up domain authentication
- Turn on 2FA for everyone
- Run a phishing-awareness session
- Choose a privacy-respecting provider
- Review who has admin access
Common mistakes
- Deferring security 'until we're bigger'
- Free consumer providers scanning mail
- One shared admin password
Security-first email — 10 mailboxes freeNo card required — free forever up to 10 mailboxes.