# Email security: protect the recovery inbox and control who can send as your domain

Source: https://www.web3sec.news/blog/email-account-security-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Identify mailboxes that recover critical accounts.
- [ ] Inventory delegates, rules and application access.
- [ ] Test SPF, DKIM and DMARC on real sending paths.
- [ ] Exercise forwarding-rule detection with a test mailbox.
- [ ] Confirm downstream account review after mailbox compromise.

## References
- [UK government: set up email services securely](https://www.gov.uk/guidance/set-up-government-email-services-securely)
- [NCSC: email security and anti-spoofing](https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing)
- [Google: secure a compromised account](https://support.google.com/accounts/answer/6294825)