The invoice email arrived at 4:47 on a Friday. Perfect sender name, correct logo, the client's usual tone — and new bank details.
Reception paid it. The real client found out three weeks later, at reconciliation, when the second invoice went unpaid and the first one had already left the account. Total loss: five figures. Total technical sophistication involved: a lookalike domain and a spare afternoon.
I keep a running file of small-team incidents like this, and email is still the front door on most of them. Not because email is uniquely broken — because everyone treats it as plumbing. Here's the checklist we'd hand a five-person team. The technical half is one afternoon of work. The human half is forever, and it's the half that would have stopped the Friday invoice.
The afternoon: three DNS records
SPF, ending in -all. A TXT record listing every service allowed to send as your domain. Most small-team domains are blank or end in +all — the DNS equivalent of a door with a "please spoof us" sign. Audit every SaaS that sends for you first, or your own marketing tool becomes the bounce that teaches everyone to ignore the hard fail.
DKIM, one selector per sending service. Signatures survive forwarding; SPF doesn't. That fact alone justifies the extra fifteen minutes.
DMARC, staged: none → quarantine → reject. DMARC is the only record that tells receivers what to do with failures. Without it, the other two are decoration. Start at p=none for two weeks, read the aggregate reports, evict the forgotten senders, then move to p=reject. A DMARC policy stuck at none forever is a security survey, not a control.
Two identity settings while you're in the admin console: MFA on every mailbox (email is the recovery path for everything else — the strongest lock belongs here), and an alert on new auto-forwarding rules. Hidden forwarding is the persistence trick of choice in business email compromise; both Google Workspace and Microsoft 365 can page you the moment one appears.
The forever half: four shapes, one phone call
Skip the fear seminar. Train on the four patterns that actually beat filters:
- Urgency + authority — "the CEO needs this paid before 5."
- The unexpected MFA prompt — if a prompt appears, the password is already burned. Deny, rotate, check forwarding rules. Never tap approve to make it stop.
- Payment-detail change on an existing relationship — the most profitable phish in the world.
- A document that demands a sign-in to view.
Then one rule with zero exceptions: any payment-change request gets a phone call to a number already on file. Not the number in the email. That single call is what the five-figure Friday invoice needed.
And give people a one-click report button. If report counts go up after training, that's not failure — that's sensors coming online.
When it happens anyway: revoke → audit → rotate → recover
Confirmed mailbox compromise: revoke all sessions and app passwords, audit sent items and rules (especially delete-after-read), rotate the password and every credential that mailbox could reset, then recover whatever is still in flight. Never reply to the attacker — even to stall. It only tells them you're live.
The whole technical half of this is written up as a one-page checklist — including the scorecard table with effort estimates — over on the ops notes:
📄 Email Security Checklist for Small Teams (SPF, DKIM, DMARC, and the Human Layer) — free, no signup.
If you want the incident side of this drilled properly, the Ops Starter Kit ($14) covers the first 30 minutes of any incident, and the advanced pack — DR plan, evidence log, comms templates, tabletop scenarios — is Ops Starter Kit Vol. 2 ($27). Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.
A free companion to both: The First 30 Minutes — the one-page incident quick-start checklist.
More free checklists — on-call handoffs, server hardening, ransomware recovery, backup tests — live at hive80-lab.github.io/ops-notes.
Top comments (0)