Top Outbound Email Security Best Practices for Your Company

No matter what we send in our emails, it’s safe to say no one wants anyone but the intended receiver to see the contents. While email remains the most common form of business communication, it’s also a means by which hackers and other individuals with malicious intent  launch attacks and exploit vulnerabilities. For example, business email compromise (BEC) is a scam that targets businesses via email fraud. Since mid-2016, it’s reported that businesses have lost over $26 billion due to BEC scams.

Numbers like this suggest keeping your business emails secure should be a priority for all companies, especially MSPs who likely handle sensitive data for multiple customers. If you experience a data breach, this could lead to financial loss, legal liability, and a damaged reputation. This guide will help you best explain the nature of email threats to your customers, and how you can implement top outbound email security best practices to help keep your customers safe.

What is inbound and outbound email?

The definitions for inbound and outbound email are simple. Inbound emails refer to messages received by users from senders outside the set of domains for your organization. Outbound emails are messages sent by users to recipients outside the set of domains for your organization. It’s important your customers understand the difference between inbound and outbound email, because the risks associated with each vary significantly.

How is outgoing email sent?

A Simple Mail Transfer Protocol (SMTP) server is an application that works to send, receive, and relay outgoing mail between email senders and receivers. This is another key term to make sure your customers are aware of.

Whenever anyone sends an email, the SMTP server (provided by the mail client you’re using to send your email) processes the email, decides which server the message is getting sent to, and relays your message accordingly. Then, the inbox service provider on the other end downloads the message and puts it in the email recipient’s inbox.

Risks associated with outbound email

The average user sends approximately 40 business emails per day. When you multiply this number across the number of users within an organization, improperly handled outbound emails can become a real risk. Although this list is not exhaustive, it does cover some of the most common risks associated with outbound email your customers should be aware of.


Cybercriminals may attempt to gain access to your SMTP server, which is the channel through which all outbound mail goes. Cybercriminals achieve this by breaking your authentication procedures. Unwanted visitors can then access your emails and use them to exploit your business. For example, they might leak your users’ data or steal sensitive information.


If a cybercriminal manages to successfully access your SMTP server, they will probably use it to send unauthorized messages and spam to your contacts and to external accounts. Because this spam is sent from a legitimate and trusted domain, it’s much more likely to be successful. If someone manages to hack one of your employees’ email accounts and sends out spam or phishing attempts to your MSP contacts, it could be disastrous for your MSP’s reputation. Your server can also be used to request confidential information, like login credentials and credit card numbers.


Cybercriminals might also endeavor to use the vulnerabilities of SMTP to spread malicious software to your email recipients or within your own infrastructure. They might spread trojan horses, viruses, and other types of worms capable of gaining access to servers, changing privileges, and obstructing key operations.


Cybercriminals can also exploit SMTP servers to perform denial-of-service (DoS) attacks. DoS attacks flood other servers with a huge amount of emails, often causing them to crash. Cybercriminals can also use these attacks to flood inboxes, disguising any warning messages about security breaches.

Outbound email security best practices 

In order to ensure users within your business and your customers’ organizations are avoiding risks associated with outbound emails, you should take measures to promote both inbound and outbound email security. We suggest starting with some form of each of the following best practices:


Although plenty of businesses have a cybersecurity plan in place, many may overlook the need to include email. With a developed and comprehensive plan, your business can prepare itself to overcome the most common and potentially damaging cyberthreats.

Your cybersecurity strategy should include policies, recommendations, guidelines, and requirements regarding the implementation and use of technology—this should include email communications. For example, your MSP might have a clear plan in place for how to react when an outbound spam filter detects infected emails are attempting to travel from within your organization to your contacts. You should review your plan regularly and customize it to suit the specific requirements of your business.


One of the most successful ways of maintaining optimal email security is to regularly update your employees’ cyberawareness training. Users can easily avoid many email-related cyberattacks if they’re able to identify warning signs. A common example of how employee training can help a company avoid cyberattacks is by ensuring employees know how to detect and respond to phishing emails. Instead of engaging with an attachment—enabling their computer or device to become infected with malware—encourage employees to flag suspicious email and perhaps send it to your company’s IT department for closer inspection.


The latest antivirus software is sophisticated and recognizes the numerous risks associated with both inbound email and outbound email. An appropriate antivirus tool is likely to include mail filtering and scanning capabilities, helping you identify malware and other threats lurking in your emails. Many antivirus tools can be configured to work with your mail proxy/relayer to scan emails and filter out those that are suspicious, preventing them from reaching your employees’ inboxes. This helps eliminate the risk of an employee making an honest mistake and opening a malicious attachment.


Many cyberattacks can exploit business email by accessing login credentials, which is why it’s important your employees and customers use complex, hard-to-guess passwords. A strong password might be subject to the following policies:

  • It must include a combination of numbers, symbols, and uppercase and lowercase letters
  • It does not include personal information, like names of family members, pet names, or other information that can be found on social media profiles
  • It will not be used across any other accounts

When creating password policies, bear in mind that password-guessing tools can submit hundreds or even thousands of words per minute in brute-force attacks. To help ensure your employees maintain strong passwords, establish an official password policy.


While many organizations tend to be more concerned about inbound spam filtering, the risks associated with outbound emails merit the use of outbound spam filtering as well. Outbound spam filtering helps ensure infected emails don’t get sent from within your MSP or your customers’ organizations to correspondents.

For example, if a hacker gains access to your system, they might go ahead and send infected messages to everyone in your address book to a range of negative effects. Not only could you lose business by compromising client or partner security with spam messages, you also might risk your outbound gateway becoming blacklisted due to a high number of spam emails originating from your IP address. Outbound spam protection helps prevent any of these issues from impacting your business by blocking spam emails on their way out from your SMTP server.


As this guide has demonstrated, email is a highly convenient form of business communication—but it also presents risks. To minimize these risks, there are tools and best practices you can implement to protect your organization and your customers. SolarWinds® Mail Assure is the ideal email security solution, providing inbound email and outbound email protection, cloud-based email archiving capabilities, Microsoft 365 email protection, and much more.

Mail Assure is an advanced, user-friendly solution that helps you achieve optimal email security. It uses collective threat intelligence and machine learning to protect email against viruses, malware, social engineering attacks, spam, ransomware, spear phishing, impersonation, business email compromise, spoofing, and a range of other email-borne threats.

Mail Assure is designed to prevent malicious links from entering or exiting your email inboxes by processing email data from over 23 million mailboxes, helping protect you from emerging threats. This solution has nearly 100% filtering accuracy. Mail Assure also includes real-time pattern threat recognition, which leverages different filtering technologies, and includes impersonation protection and anti-phishing. This is a highly versatile email security solution that offers support for DKIM, DMARC, and SPF, and can seamlessly integrate with Microsoft 365 via an add-in.

Mail Assure also provides email continuity solutions, so that even if Microsoft 365 has an outage or is down for maintenance, you will still have access to email. The 24/7 email continuity solution is delivered through a web-based console, allowing you to add value for your service. Even if your primary server goes offline, employees will still be able to send, receive, and read email as if nothing happened. To learn more, a 30-day free trial of Mail Assure is available.

Want to stay up to date?

Get the latest MSP tips, tricks, and ideas sent to your inbox each week.

Loading form....

If the form does not load in a few seconds, it is probably because your browser is using Tracking Protection. This is either an Ad Blocker plug-in or your browser is in private mode. Please allow tracking on this page to request a trial.

Note: Firefox users may see a shield icon to the left of the URL in the address bar. Click on this to disable tracking protection for this session/site