This guide assumes email account takeover is already deployed and passing. It covers what breaks at scale and how mature teams operate it.
Edge cases that break a working setup#
- SMS-based MFA for high-value accounts.
- Not checking forwarding rules after remediation.
- Mail forwarded through mailing lists or personal forwarders, which alters headers and content.
- Acquisitions and rebrands that introduce domains nobody audited.
- Vendors silently changing their sending infrastructure.
Operating it as infrastructure#
- Assign an owner for each sending domain and each vendor relationship.
- Put DNS records under version control or a change-review process.
- Alert on authentication pass rate drops and reputation changes, not just outages.
- Run a quarterly audit against the setup steps below.
- Document runbooks for the three most common failures.
Reference: the baseline setup#
- Enforce phishing-resistant MFA (FIDO2 keys or passkeys) for admins and finance.
- Review third-party OAuth grants monthly and restrict user consent.
- Alert on impossible-travel logins and mass downloads.
- Have a documented response: revoke sessions, reset, audit rules and forwards, notify affected parties.
Frequently asked questions#
What are signs of a compromised email account?
Unknown sent items, new forwarding rules, missing mail, login alerts from unfamiliar locations, and contacts reporting odd messages.