099 Digital Life Security #3: Email Security — Your Inbox Is a Key to Your Digital Life

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

Email has been with us for so long that it can feel almost ordinary.

We open our inbox, read messages, click links, receive bills, reset passwords, communicate with businesses, and exchange documents without giving much thought to the system behind it.

But your email account may be one of the most important accounts you have.

In many cases, it is a key that can help unlock the rest of your digital life.

Why Email Deserves Special Protection

Suppose you forget the password to an online account.

You click Forgot Password.

Where does the reset link usually go?

Your email.

That means someone who gains control of your email may be able to attempt password resets for other services you use.

Your inbox can also reveal an enormous amount about you: which banks and businesses you use, where you shop, services you subscribe to, people you communicate with, travel plans, receipts, invoices, and sometimes sensitive documents.

Protecting email is therefore about much more than protecting messages.

It is about protecting one of the central hubs of your digital identity.

Start With the Email Account Itself

Your primary email account deserves a strong, unique password that is not reused anywhere else.

Whenever available, enable multifactor authentication or another strong modern authentication method such as a passkey.

Also review your account recovery options.

Is the recovery email address still yours?

Is the recovery phone number current?

Are there old devices still authorized to access the account?

Security is not only about keeping someone out. It is also about making sure you can safely regain access if something goes wrong.

The Biggest Email Attack May Not Attack Email at All

One of the most effective ways to steal an email account is surprisingly simple.

Ask the owner for the password.

Of course, an attacker does not usually send a message saying:

Please send me your password.

Instead, they create a situation designed to make you give it to them voluntarily.

You receive a message saying your mailbox is full.

Your password is about to expire.

Someone attempted to sign into your account.

Your account will be disabled.

You need to verify your identity.

A button takes you to a login page that looks completely legitimate.

You enter your email address and password.

The problem is that the page belongs to the attacker.

This is phishing.

Phishing Attacks Our Judgment

Phishing is interesting because the attacker may not need to defeat encryption, break through a firewall, or discover a software vulnerability.

The attacker tries to influence a person instead.

Fear works.

Curiosity works.

Urgency works.

Authority works.

So does familiarity.

A message appearing to come from your bank, employer, friend, customer, delivery company, or technology provider has a much better chance of getting your attention than a message from a complete stranger.

This broader technique of manipulating people into taking an action is known as social engineering.

Urgency Should Slow You Down

This sounds backward, but it is one of the most useful security habits we can develop.

The more urgently a message tells you to act, the more deliberately you should respond.

Your account will be closed today.

A large purchase has just been made.

Your package cannot be delivered.

Your boss needs gift cards immediately.

A family member is in trouble.

You have only a few minutes to respond.

These situations are designed to move you from thinking to reacting.

Do the opposite.

Do Not Let the Message Choose Your Route

Suppose an email says there is suspicious activity in your bank account.

Instead of clicking the button in the email, open the bank's app or use the website address you normally use.

If the warning is legitimate, you should usually be able to find the issue through the trusted route.

The same principle works for shopping sites, email providers, social networks, cloud services, and many other accounts.

You do not have to follow the road the message gives you.

What Is Email Spoofing?

Email introduces another problem.

The name and address that appear prominently in your inbox do not always tell the entire story about where a message came from.

Attackers may attempt to make messages appear to originate from someone or somewhere they did not.

This is commonly called email spoofing.

There are different ways to create deceptive email, ranging from simply choosing a misleading display name to attempting to impersonate a domain.

This is why seeing a familiar name at the top of a message is not, by itself, proof of who sent it.

Look Beyond the Display Name

Imagine seeing:

Brad Zehr

at the top of an email.

That may look reassuring.

But a display name can be surprisingly easy for a sender to choose.

The actual email address deserves attention too.

Even then, there is more happening behind the scenes.

Email systems exchange technical information that can help receiving servers determine where a message actually traveled and whether the sending system was authorized to send mail for a particular domain.

That brings us to three important technologies:

SPF, DKIM, and DMARC.

SPF: Who Is Allowed to Send?

SPF stands for Sender Policy Framework.

A domain owner can publish information in DNS identifying systems that are authorized to send email on behalf of that domain.

When another mail server receives a message, it can check whether the server delivering that message is authorized under the domain's SPF policy.

A simple way to think about SPF is:

“Is this server allowed to send mail for this domain?”

SPF is useful, but it is not a complete solution by itself. Email forwarding and the different addresses involved in mail delivery can make SPF more complicated than that simple description suggests.

That is one reason we have additional layers.

DKIM: Was the Message Properly Signed?

DKIM stands for DomainKeys Identified Mail.

DKIM uses cryptographic signatures.

The sending mail system can add a digital signature to a message using a private key.

The domain publishes the corresponding public-key information through DNS.

The receiving mail server can then use that information to check the signature.

This can help establish that the message was signed by a system associated with the domain and that signed portions of the message were not altered after signing.

A useful simplified question for DKIM is:

“Does this message carry a valid cryptographic signature associated with this domain?”

DMARC: What Should We Do With the Results?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance.

DMARC builds upon SPF and DKIM and adds another important concept called alignment.

In simplified terms, DMARC asks whether an authenticated domain from SPF or DKIM aligns appropriately with the domain visible to the recipient in the From address.

The domain owner can also publish a policy indicating how receiving systems should handle messages that fail DMARC checks.

Depending upon the policy, the domain may request monitoring, quarantine, or rejection of failing mail.

DMARC can also provide reports that help domain administrators understand who is sending mail using their domain and where authentication problems are occurring.

Three Layers Working Together

We can simplify the relationship this way:

SPF: Is the sending system authorized?

DKIM: Does the message have a valid domain-associated signature?

DMARC: Does the authentication align with the visible sender domain, and what should happen if it does not?

That is an intentionally simplified explanation, but it gives us a useful mental model.

These technologies do not make fraudulent email disappear, but they make certain forms of domain impersonation considerably harder and give receiving mail systems more information for evaluating messages.

DNS Is Becoming Part of Our Security Story

You may have noticed something interesting.

SPF uses DNS.

DKIM publishes key information through DNS.

DMARC policies are published through DNS.

DNS is often described as something like the internet's phone book because it helps connect names with internet resources.

But as we go deeper into digital security, we will discover that DNS is involved in much more than simply finding websites.

We will return to it.

Can You See These Checks Yourself?

Yes.

Most email applications provide some method of viewing the original message, raw source, or full headers.

At first glance, email headers can look intimidating.

There may be many lines containing server names, IP addresses, timestamps, message identifiers, authentication results, and routing information.

But once you learn what to look for, those headers begin telling a story.

You may find results similar to:

spf=pass

dkim=pass

dmarc=pass

Those results can provide useful information about how the receiving mail system evaluated the message.

Later in this series, we can take an actual email header and learn how to read that story from top to bottom.

Attachments Need Their Own Moment of Thought

Attachments are another common way to deliver something dangerous.

A familiar sender does not automatically make an unexpected attachment safe.

The sender's account could have been compromised.

The message could be impersonating someone.

Or the sender may have unknowingly forwarded something unsafe.

Before opening an unexpected attachment, ask whether you were expecting the file and whether it makes sense in the context of the conversation.

If necessary, verify with the sender through another trusted method.

Be Careful With Unexpected Verification Codes

Suppose you suddenly receive a login or verification code that you did not request.

Do not give that code to someone who contacts you asking for it.

A verification code may be the final piece someone needs to complete an attempted login or account recovery.

An unexpected code can also be a useful warning that someone may be trying to access an account.

Instead of responding to the person requesting the code, go directly to the service and investigate your account.

What If Your Email Account Is Compromised?

If you believe someone has gained access to your email, act promptly.

Using a trusted device, change the account password and make sure the new password is unique.

Review recent login activity and remove devices or sessions you do not recognize.

Check multifactor authentication and recovery information.

Also look for something less obvious:

Email forwarding rules and filters.

An attacker who gains access to an account may attempt to create a rule that forwards copies of messages elsewhere or hides certain messages from the account owner.

Changing the password without finding such a rule could leave part of the compromise in place.

Your Sent Folder Can Tell You Something Too

If an account has been compromised, check the Sent folder for messages you did not send.

But do not assume an empty Sent folder proves nothing happened.

Messages can potentially be deleted, and spoofed mail may never have originated from your account at all.

This distinction is important.

Receiving a fraudulent message that appears to come from you does not automatically mean your email account was hacked.

Sometimes the sender information was impersonated.

Security Is About Evidence

This introduces an idea that will become increasingly important as we go deeper into security.

Do not jump immediately from something unusual to a conclusion.

A strange email does not necessarily mean an account was compromised.

A failed login does not necessarily mean someone knows your password.

A certificate warning does not necessarily mean someone is attacking you.

Instead, gather evidence.

Check login history.

Examine the sender address.

Look at the headers.

Review authentication results.

Check forwarding rules.

Look at timestamps and devices.

Security work is often detective work.

A Simple Email Security Checkup

Take a few minutes and review your primary email account.

• Does it have a strong, unique password?
• Is multifactor authentication or a passkey available?
• Are the recovery email address and phone number current?
• Are there devices or active sessions you no longer use?
• Are there forwarding rules you do not recognize?
• Do you know how to view the full headers of a message?
• Do you know where to check recent login activity?

You do not need to become an email administrator.

But you should understand the security controls protecting one of your most important accounts.

Now We Are Looking Under the Hood

We began this series with everyday security habits.

Now we have encountered DNS records, cryptographic signatures, domain alignment, authentication results, message headers, server identities, and mail routing.

This is where cybersecurity starts becoming especially interesting.

The more we understand what is happening underneath the technology, the better we become at distinguishing something suspicious from something merely unfamiliar.

Your Inbox Is More Than a Mailbox

Your email account connects many pieces of your digital life.

That makes it useful.

It also makes it valuable to an attacker.

Protect the account itself. Be cautious with unexpected requests. Slow down when a message creates urgency. Use trusted routes to reach important accounts. And learn to recognize the security systems working behind the scenes.

Your inbox is not merely where your messages arrive.

It is one of the keys to your digital life.