Email Security: TLS, Strong Passwords and Two-Step Sign-In
Email travels across many servers. Learn how TLS protects it in transit, why passwords are the weak point, and how to lock down business mailboxes.
Email was designed in an era when security was an afterthought, and the protocol still shows it. Messages can pass through several servers, mailboxes protect valuable information, and a single compromised account can be used to attack customers. You can do a lot to improve security without special tools. This article covers the three areas that matter most: encryption in transit, account protection and ongoing monitoring.
Encryption in transit: TLS
TLS, Transport Layer Security, is the same technology that secures websites. For email it protects two different connections:
- Between your device and your mail server, when you read and send mail. Always use IMAP on port 993 with SSL/TLS, and SMTP on port 587 with STARTTLS or 465 with SSL/TLS.
- Between mail servers, when a message is relayed from your server to the recipient's. Most large providers support TLS here, and it is normally attempted automatically. It is opportunistic, meaning that if the other side does not offer it, the message may go unencrypted.
Some domains publish a policy called MTA-STS to tell senders that TLS is required when they deliver mail to them. It is worth looking at once your basics are in place, but it is an advanced step.
What TLS does not do
TLS protects the message while it moves. It does not protect it at rest on servers, and the servers that handle it can still read it. If you need true end-to-end confidentiality, you need message-level encryption such as S/MIME or OpenPGP, which require both sides to set up keys. For most small businesses, the more practical advice is not to send highly sensitive data, such as passport scans or account details, by email at all. Use a secure file sharing method instead.
Passwords: the weak point
The most common way a mailbox is lost is a stolen or guessed password. Attackers collect passwords from earlier data breaches and try them on other services. If an employee reuses a password, one leak elsewhere can open your email.
Rules that work
- Use a long, unique password for every mailbox. Length matters more than complexity tricks.
- Store passwords in a password manager, not in a spreadsheet or on sticky notes.
- Never share a mailbox password by email or chat in plain text.
- Change a password straight away if you suspect it is known.
- Remove accounts that are no longer in use.
Two-step sign-in
Two-step sign-in, often called two-factor authentication, asks for something extra after the password, such as a code from an app or a hardware key. Even if the password is stolen, the attacker cannot get in. Many webmail systems support it, but support for it in classic mail apps over IMAP varies, and some setups use separate app-specific passwords. Ask your provider exactly what is available for your mailboxes, and use it for administrator accounts, your hosting control panel and your domain registrar first, since those protect everything else.
| Second factor | Notes |
|---|---|
| Authenticator app codes | Good balance of security and convenience |
| Hardware security key | Strongest against phishing |
| SMS codes | Better than nothing, but weaker, since numbers can be hijacked |
Lock down the domain and the DNS
Your mail is only as safe as the accounts that control your domain. Protect the registrar login and the DNS provider with strong passwords and two-step sign-in. If someone gains control of your DNS, they can redirect all of your mail. Publish SPF, DKIM and DMARC, ideally with enforcement, so others cannot easily forge messages in your name.
Watch for signs of compromise
- Sent messages you did not write.
- Unexpected forwarding rules or filters, which attackers use to quietly copy your mail.
- Logins from unfamiliar places or devices, if your provider shows login history.
- Customers reporting strange messages from you.
- A sudden surge of bounce messages for emails you did not send.
If you see any of these, change the password, review forwarding and filter rules, and check connected devices and apps.
A practical security checklist
- All clients use TLS ports.
- Every mailbox has a unique, long password stored in a manager.
- Two-step sign-in is on for admin, hosting, registrar and DNS accounts.
- SPF, DKIM and DMARC are published and tested.
- Spam and malware filtering are active.
- Staff know how to recognise and report phishing.
- Devices have screen locks and updated software.
- Leavers lose access on their last day.
Public Wi-Fi and shared devices
Encrypted connections protect you on public networks, but only if your client is set to require encryption. Check that your mail apps never fall back to plain connections. Avoid logging in to business mail on shared or public computers, and if you must, sign out completely and never tick "remember me". On your own devices, install updates promptly, since vulnerabilities in browsers and mail programs are a common route for attackers.
Email security with Zebra Hosting
Zebra Hosting email runs on Plesk with standard encrypted connections, and free SSL certificates are available on hosted sites. For a broader look at protecting your online presence, see the security page and the SSL information. Support is available in 17 languages, and the email plans are a good place to start.
