Start with access and recovery.
Use a unique password and a second factor or passkeys when your provider offers them. Keep recovery options protected and current. Prefer individual accounts; use supported delegation and permissions for team inboxes.
Review sessions, rules and forwarding.
If unauthorized access is suspected, check devices, sessions and connected apps. Look for rules hiding messages, forwarding conversations or deleting alerts. Revoke unfamiliar access and check recovery details. A password change alone may not remove every access path.
SPF: which services may send.
SPF publishes the sending sources authorized for the domain checked during verification. Include legitimate services and avoid duplicate SPF records. Review the setup when changing providers or adding sending tools.
DKIM and DMARC: signatures and policy.
DKIM enables verification of a message signature. DMARC uses domain alignment and authentication results to apply a published policy and request reports. Plan adoption to avoid blocking legitimate mail. These controls neither encrypt message content nor stop every scam.
Confirm sensitive requests independently.
Bank-detail changes, urgent payments and document requests need independent confirmation. A familiar sender may have been compromised. Agree on how to verify requests and report suspicious mail without spreading malicious links or attachments.
What have you reviewed?
Check the items you reviewed. Checkmarks stay on this page: they do not access your account or perform an audit.
Common questions.
Does receiving a spoofed email prove my inbox was hacked?
No. The sender may be spoofed without access to your account. Investigate sessions, rules and unfamiliar outgoing messages to distinguish spoofing from compromise.
Does a DNS check assess all email security?
No. It checks public domain records, not passwords, sessions, mailbox content or every sending system. Use the result alongside an access review.
Further references.
Official guidance for exploring these practices further.