Your email account is the master key to the rest of your online life. Password resets for your bank, shopping accounts and social media all land there, so anyone who controls your inbox can usually take over everything else. The good news is that the steps that block most attacks are simple, and most of them take a few minutes once.
Below are the eight practices I'd prioritize, based on years of running and securing enterprise email systems. The first four protect the account itself; the rest protect you from the messages that reach it, and the last one is for anyone who owns a domain.
1. Use a unique password, stored in a password manager
Reused passwords are the most common way accounts get taken over: one site leaks, and attackers try the same email and password everywhere else. Your email password should be used nowhere else.
- Use a password manager (Bitwarden, 1Password and your browser's built-in manager are all reasonable options) to generate and store passwords.
- For the few passwords you must remember, use a long passphrase of several unrelated words rather than a short, complex string.
- If you've reused your email password anywhere, change it today, starting with the email account.
2. Turn on two-factor authentication, and choose a strong method
Two-factor authentication (2FA) means a stolen password alone isn't enough to sign in. Not all methods are equal:
- Best: passkeys or a hardware security key.
- Good: an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy.
- Better than nothing: SMS codes. These can be intercepted through SIM-swap fraud, so move off SMS if your provider offers alternatives.
Save your backup codes somewhere safe, such as your password manager, so you can't lock yourself out.
3. Keep your recovery options current
Recovery settings are a back door into your account. Check that the recovery phone number and backup email address are ones you still control. An old work address or a number you gave up years ago is an easy route for an attacker. Never use a temporary or shared address as a recovery email.
4. Review sessions, connected apps and forwarding rules
This is the step most people skip, and in my experience it's where compromises hide. After getting into a mailbox, attackers often add a forwarding rule or a filter that quietly copies or deletes certain messages, so the account owner never sees password-reset or bank emails. A few times a year:
- Review active sessions and sign out devices you don't recognize.
- Remove third-party apps that no longer need access to your mail.
- Check forwarding settings and filters for anything you didn't create.
- Read your provider's security alerts instead of dismissing them.
5. Treat links and attachments with suspicion
Phishing remains the most common way people hand over their credentials. Before acting on any message that asks you to sign in, pay or open a file:
- Check the real sender address, not just the display name.
- Hover over links to see where they actually lead, and watch for lookalike domains.
- Be wary of urgency: suspended accounts, failed payments, "unusual activity".
- Don't open unexpected attachments, especially ZIP, HTML or macro-enabled Office files.
- When in doubt, go to the website directly instead of using the link.
We go through real examples in How to Spot a Phishing Email Before It Steals Your Data.
6. Keep devices updated and be careful on public Wi-Fi
Many attacks rely on known vulnerabilities that were patched months earlier. Turn on automatic updates for your operating system, browser and email app. On public Wi-Fi, stick to HTTPS sites and your provider's official app, use a reputable VPN if you can, and always sign out on shared computers.
7. Limit where your real address goes
The fewer places your address is stored, the fewer breaches and spam lists it ends up in. Use your real address only for important accounts and people you know. For subscriptions and shopping, use forwarding aliases; for one-time sign-ups, a disposable address from Temp Mail .FYI keeps the site from ever learning your real address. Our guide How to Leverage Temp Mail Services to Protect Your Privacy explains how to combine them.
For sensitive conversations, consider an end-to-end encrypted provider such as Proton Mail or Tuta, where only you and the recipient can read the message content.
8. If you own a domain: set up SPF, DKIM and DMARC
If you send email from your own domain, whether for a business, a blog or a family domain, these three DNS records stop others from sending email that pretends to be you. They're also increasingly required by Gmail and Yahoo for reliable delivery.
- SPF lists the servers allowed to send mail for your domain. Example:
v=spf1 include:_spf.google.com ~all - DKIM adds a cryptographic signature to your messages, so receivers can verify they weren't altered and really came from your domain. Your email provider gives you the record to publish.
- DMARC tells receivers what to do when SPF or DKIM checks fail, and sends you reports. Start in monitoring mode, for example
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, review the reports for a few weeks, then move top=quarantineand eventuallyp=reject.
Rolling out DMARC gradually matters: jumping straight to p=reject before every legitimate sender (newsletter tools, invoicing systems, website forms) is covered by SPF or DKIM can block your own mail. If you send newsletters or transactional email, our article on common email sending mistakes covers related deliverability issues.
A 15-minute email security checkup
| Check | Done when |
|---|---|
| Password | Unique and saved in a password manager |
| Two-factor | On, using a passkey or authenticator app |
| Recovery | Phone number and backup email are current |
| Sessions and apps | Unknown devices signed out, unused apps removed |
| Forwarding and filters | Nothing you didn't create |
| Updates | Automatic updates on for OS, browser and mail app |
| Domain (if you own one) | SPF, DKIM and DMARC published |
Frequently asked questions
What's the single most important step?
A unique password combined with two-factor authentication. Together they stop the large majority of account takeovers.
How do I know if my email account has been compromised?
Warning signs include password-reset emails you didn't request, sent messages you didn't write, new forwarding rules, and security alerts about unfamiliar sign-ins. If you see any of these, change your password, sign out all sessions and review your rules immediately.
Do I need SPF, DKIM and DMARC for a personal Gmail or Outlook address?
No. Your provider handles those for its own domains. They only matter if you send email from a domain you own.
The bottom line
Email security doesn't require expensive tools. A unique password, strong two-factor authentication, current recovery options and a periodic look at your rules and sessions will protect you from most attacks. Add careful habits with links and attachments, share your real address sparingly, and, if you own a domain, publish SPF, DKIM and DMARC.
