Most businesses set up their email once, move on, and never look back. The initial configuration works well enough, so it gets ignored — sometimes for years. Then one day, an important client replies saying your messages landed in their spam folder. Or a phishing email goes out that looks exactly like it came from your domain. Or a key employee leaves and you realize no one has access to their inbox.
These are all signs that your business email hosting setup is overdue for a proper audit. The good news is you don't need to be a technical expert to do this. You just need to know what to look for.
Start With the Basics: Who Has Access to What
The first thing to check is your user list. Pull up your email admin panel and look at every active account. Ask yourself:
- Are there accounts that belong to people who no longer work here?
- Does every active account actually need a full mailbox, or could some be aliases or forwarding addresses?
- Who has admin-level access, and does each of those people still need it?
Orphaned accounts are a quiet security risk. A former employee's inbox sitting open with an old, shared password is an easy target. The fix is simple — disable or delete accounts when someone leaves — but it's surprising how often this gets skipped in the rush of daily business.
While you're in there, check which accounts are using shared mailboxes versus individual ones. Shared mailboxes can be incredibly useful for things like info@ or support@ addresses, but they need proper permission structures. If everyone on the team knows the password to a shared account, that's not a permission structure — that's a gap waiting to happen. We covered the mechanics of this in more detail in How Shared Mailboxes Work in Business Email Hosting and When to Use Them.
Check Your Email Authentication Records
This is where most audits uncover something broken. Email authentication is a set of DNS records that tell receiving mail servers whether messages from your domain are legitimate. Without them, your emails are more likely to land in spam — and your domain is more vulnerable to spoofing.
There are three records to check:
SPF (Sender Policy Framework)
An SPF record lists the servers that are authorised to send email on behalf of your domain. If you're using a third-party business email hosting provider, their sending servers need to be in your SPF record. If you've switched providers at any point, the old record might be pointing to servers that no longer handle your email — or missing the new ones entirely.
You can check your SPF record using any free SPF lookup tool online. Enter your domain and look at what comes back. The record should include every service you use to send email: your main mail provider, your CRM if it sends on your behalf, your newsletter platform, and so on. Missing entries mean those emails are more likely to be flagged as suspicious.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to outgoing messages. The recipient's mail server uses a public key stored in your DNS to verify the signature, confirming the message wasn't tampered with in transit. Without DKIM, you're sending emails without any real proof they're from you.
Most business email hosting providers set up DKIM automatically when you add your domain. But if you've added new sending services — like a marketing platform or a helpdesk tool — they may have their own DKIM keys that need to be added to your DNS. Check your DNS records for entries that look like selector._domainkey.yourdomain.com. If you're unsure whether they're correct, your email provider's documentation will tell you exactly what the record should look like.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails authentication: deliver it, quarantine it, or reject it outright. It also generates reports you can use to spot unauthorised senders using your domain.
A surprising number of businesses have no DMARC record at all. Check yours with a free DMARC lookup tool. If there's nothing there, or if your policy is set to p=none (monitor only), you're not actively blocking anyone from spoofing your domain. Moving to p=quarantine or p=reject is one of the most effective things you can do to protect your domain's reputation.
Test Your Deliverability
Authentication records help, but they're not the whole story. Your domain can be correctly configured and still have deliverability problems if your sending reputation has taken a hit.
Run a free deliverability test using a tool like Mail-Tester or MXToolbox. Send a test email to the address they provide, then check your score. These tools tell you whether your messages pass authentication checks, whether your sending server's IP is on any blocklists, and whether your email headers look suspicious.
If your IP is on a blocklist, that's a serious problem. It usually means someone — either from your organisation or from a compromised account — has been sending spam. If you're on shared hosting with a shared IP address, another customer on the same server could be the culprit. This is one of the reasons good business email hosting uses dedicated or reputation-managed IP addresses rather than pooling everyone together.
Review Storage and Quotas
Storage problems rarely announce themselves. They just quietly build until someone gets a bounce message saying their inbox is full — usually at the worst possible moment.
Check the storage usage for each mailbox on your account. Most email admin panels show this clearly. Flag any accounts that are sitting above 80% capacity and make a plan: either increase the quota, archive old messages, or move to a plan with more storage.
Also check whether your plan includes any kind of archiving. Long-term email archiving matters for businesses in regulated industries — legal, financial, healthcare — where you may be required to retain correspondence for a number of years. If you're not archiving, and your email provider doesn't include it, that's a compliance gap worth addressing sooner rather than later.
Look at Security Settings
Email is one of the most common entry points for security incidents, so it deserves a dedicated look during any audit.
- Multi-factor authentication (MFA): Is it enabled for all accounts, or just some? If any account — especially admin accounts — can be accessed with just a password, that's a risk worth closing immediately.
- Password policies: Are users required to use strong passwords? Are old passwords still in use on accounts that haven't been changed in years?
- Suspicious login activity: Most business email platforms log authentication events. Look for logins from unexpected countries or devices. A single unfamiliar IP can be a sign of a compromised account.
- Forwarding rules: This one is easy to miss. Attackers who gain access to an inbox sometimes set up silent forwarding rules so they continue to receive emails even after losing access. Check all accounts for any forwarding rules that shouldn't be there.
If you want a broader look at how security works at the infrastructure level, How Website Security Protection Works at the Hosting Level is a useful read — the same principles around layered protection apply to email environments too.
Check Your Business Email Hosting Plan Against Your Actual Needs
Plans that made sense when you had three employees may not make sense now. During your audit, step back and compare what you're paying for against what you actually use and need.
- Are you paying for seats you no longer use?
- Have you outgrown the storage limits on your current plan?
- Does your plan include spam filtering, virus scanning, and encryption — or are those gaps?
- Is support available when you need it, or are you on a self-service plan that leaves you stranded during an outage?
The goal isn't necessarily to spend more — it's to make sure what you're paying for actually fits how your team works. We went deep on this topic in How to Pick a Business Email Hosting Plan That Actually Fits Your Team Size, which is worth bookmarking if you're thinking about switching providers after your audit.
Build a Simple Checklist and Repeat Annually
An email audit doesn't need to take a full day. Once you've done it the first time, future audits are much faster because you know what you're looking for. Here's a condensed version to save:
- Review all active accounts and disable any that belong to former team members
- Check SPF, DKIM, and DMARC records using a free lookup tool
- Run a deliverability test and check for blocklist entries
- Review storage usage per mailbox
- Confirm MFA is enabled on all accounts
- Scan all accounts for unexpected forwarding rules
- Compare your current plan against your actual team size and usage
Do this once a year — or any time there's a significant change in your team or your email setup. The issues that cause the biggest headaches are almost always ones that were small and fixable long before they became expensive and urgent.
Good business email hosting should run quietly in the background. When it does, it means your deliverability is solid, your security is tight, and your team can communicate without thinking about the infrastructure behind it. A quick audit is the easiest way to make sure it stays that way.
For more on how the right email setup fits into your broader hosting picture, see our email hosting overview.
