Hosted email is part of the mail chain
Virtual mailbox systems often use email for arrival notices, scan links, support, invoices, and account recovery. A compromised hosted email account can expose sensitive correspondence or authorize physical actions. Protect the domain, administrators, users, devices, and recovery process as one connected system.
Domain and DNS control
Keep the registrar and DNS host documented, renewed, and protected with strong multi-factor authentication. Limit who can modify nameservers, MX records, and sender-authentication records. Use recovery methods that do not depend only on the hosted email system they are meant to recover.
Configure SPF, DKIM, and DMARC for the services that legitimately send mail. Review reports and changes rather than copying a strict record without understanding the senders. Marketing, billing, support, and mailbox platforms can all affect authentication.
Administrator and user access
- Use the fewest global administrators and lower-privilege accounts for routine work.
- Require multi-factor authentication for every user and prefer phishing-resistant methods where supported.
- Disable legacy sign-in paths that bypass modern controls unless a documented dependency remains.
- Alert on administrator changes, unusual sign-ins, forwarding rules, and new app permissions.
- Use delegated or shared mailboxes for role addresses instead of sharing passwords.
- Remove sessions, app tokens, rules, and access promptly during offboarding.
Keep scanned documents out of uncontrolled email
Prefer generic arrival alerts and authenticated links back to the mailbox platform. Attachments create copies in user inboxes, mobile caches, backups, forwarding chains, and integrated tools. If a scan must leave the provider, route it to an approved document repository with named access and retention.
Inspect automatic forwarding and inbox rules. An attacker can create a rule that quietly sends financial or legal messages outside the company while hiding security alerts.
Protect devices and third-party apps
Phones and laptops holding mail should use supported software, encryption, screen locks, and prompt loss reporting. Review third-party apps that can read mail, files, contacts, or calendars. Remove integrations that are no longer used and avoid broad app consent when a narrower scope is available.
Retention, backup, and provider exit
Clarify the difference among retention, recoverable deletion, backup, and a compliance archive. Document how former-employee mail is preserved or transferred. Test export of messages, contacts, calendars, aliases, groups, and audit records before an urgent migration is necessary.
Maintain an emergency access method and provider support path outside the hosted mailboxes. A service is more dependable when the company can recover or migrate without relying on the unavailable system.