Email security and anti-spoofing

• Government Minimum Cyber Security Standard 
• Securing government email; apply the government secure email policy (Updated 24 January 2019) 
• Email security standards 
• TLS - Using Transport Layer Security (TLS) in your organisation
• Local government: naming and registering websites

• Protecting parked domains for the UK public sector 

Common Cloud email providers, including Microsoft O365 and Google G Suite, publish online guidance on how to configure your Cloud email settings to help protect your organisations against cyber threats. For example, the following are links to Microsoft and Google’s online guidance on how to configure SPF and DKIM:

• Microsoft Technical Guidance.  Office 365 Secure Configuration Alignment – UK OFFICIAL.  09/04/2021 Version 2 Final  
• Microsoft - set up SPF in Office 365 to help prevent spoofing
• Microsoft - Use DKIM to validate outbound email sent from your custom domain in Office 365
• Google G Suite - Authorise email senders with SPF
• Google G Suite - Enhance security for outgoing email with DKIM

Mass mailing / email marketing services allow bulk-sending of emails to targeted mailing lists. If your communications, sales and/or marketing staff make use of this kind of service, you need to ensure they are sending authenticated mails, as this will make it less likely your legitimate marketing emails will end up as spam.  There are many such services, including MailChimp and SendInBlue. Their guidance on how to authenticate mass mailings can be found here:

• SendInBlue - Understand SPF, DKIM and DMARC protocols  
• MailChimp - Email Delivery