Small business checklist
Email Spam Protection Checklist for Small Businesses
Use this checklist to find why spam is reaching your business email, what you can clean up, and when domain-level inbound filtering makes sense.
TLDR
Start by finding whether spam affects one mailbox or the whole domain. Clean up public addresses, old aliases, catch-all routing, and authentication records. If spam still affects multiple inboxes, add MX-based inbound filtering before mail reaches your provider.
1. Identify the Scope
- List which mailboxes receive the most spam.
- Check whether spam targets one person or several users.
- Note whether public addresses like
info@,sales@, orsupport@are affected. - Check whether shared inboxes or aliases receive the same junk.
- Look for patterns: repeated sender domains, repeated subjects, fake invoices, form spam, or phishing attempts.
Decision point: one mailbox is a mailbox-level issue. Multiple addresses usually point to a domain-level issue.
2. Review Public Exposure
- Search your website for visible email addresses.
- Check footer, contact, team, support, and legal pages.
- Review old PDFs, directories, social profiles, and business listings.
- Use contact forms where appropriate, but protect them from automated abuse.
- Avoid publishing personal staff addresses when a role-based address will do.
3. Clean Up Mailboxes and Aliases
- Disable old staff accounts that should no longer receive mail.
- Remove unused aliases and forwarding addresses.
- Turn off catch-all routing unless the business truly needs it.
- Review shared inbox ownership so someone is responsible for spam decisions.
- Document who can manage sender allow lists and sender block lists.
4. Check DNS and Authentication
DNS and authentication records do not stop every inbound spam message, but they are still important for email hygiene.
- Confirm your current MX records and where inbound mail is delivered.
- Check SPF, DKIM, and DMARC records.
- Remove old MX records that should not receive mail anymore.
- Document your clean-mail destination before making filtering changes.
These records have different jobs. Read SPF, DKIM and DMARC vs spam filtering before treating authentication as an inbound spam fix.
5. Review Filtering and Admin Controls
- Check what your current provider blocks, quarantines, or delivers.
- Confirm whether admins can review quarantine.
- Confirm whether logs are searchable when a message is missing.
- Check whether trusted senders can be added to sender allow lists.
- Check whether repeat unwanted senders can be added to sender block lists.
- Decide whether advanced regex-based filters are needed for recurring patterns.
For the review workflow, see how quarantine differs from a mailbox spam folder.
6. Decide the Next Step
| What you found | Best next step |
|---|---|
| One mailbox gets occasional junk | Use mailbox rules and review account exposure |
| Forms are being abused | Improve form protection and moderation |
| Old aliases receive spam | Remove unused aliases and review forwarding |
| Multiple users or public addresses get spam | Add domain-level inbound filtering before mail reaches users |
Frequently Asked Questions
How often should we review this?
Review it when spam increases, when staff changes, when new addresses are published, or at least a few times a year.
Will this stop all spam?
No checklist or filter can honestly promise that. The goal is to reduce unwanted mail, keep legitimate messages moving, and give admins review tools.
Does this mean we need to migrate?
Not necessarily. If your provider works and spam is the main issue, inbound filtering may be enough.
When should we add filtering?
Add filtering when spam affects the domain, not just one mailbox, and when you want quarantine, logs, sender allow lists, and sender block lists before mail reaches users.
Add Filtering Before Mail Reaches Users
If the checklist points to a domain-wide spam problem, SpamVest can filter inbound mail before it reaches your existing provider.
Protect your domain with SpamVest