Introduction
Email remains the top channel for attackers targeting businesses, yet many people still misunderstand its role in IT security. Most vendors explain email security using:
- Buzzwords
- Product names
- Complex diagrams
However, few people explain what really happens in simple terms.
This post breaks down email security in clear language, focusing on how it works rather than which product to choose.
The Email System (Abstracted View)
In simple terms, email has four main layers:
- Sender
- Transport
- Receiver
- User interaction
Most security problems happen when people trust one or more of these layers too easily.
Let's go through each layer.
1️ Sender Layer – Identity Is Easy to Fake
Put simply, email alone does not prove who someone is. Anyone can:
- Spoof a sender address
- Impersonate a domain
- Look legitimate at first glance
This is why technologies like:
- SPF
- DKIM
- DMARC
exist not to make email completely secure, but to make it harder for people to fake identities. (DMARC, 2015) Key idea: An email’s identity is just a claim, not a guarantee.
2 Transport Layer – Email Is Just Data in Motion
Email passes through several servers before it arrives in your mailbox. Abstractly:
- Messages are copied
- Relayed
- Temporarily stored
- Logged
Security here is about:
- Encryption in transit (TLS)
- Reputation of relay servers
- Filtering during transport
Key idea: Email transport tries to be secure when it can, but there are no guarantees.
3 Receiver Layer – Filtering Is Probabilistic
Spam filters, malware detection, and phishing protection do not work perfectly every time. They rely on:
- Heuristics
- Reputation scores
- Pattern recognition
- Machine learning (Beaman & Isah, 2022)
This means:
- Some bad emails get through
- Some good emails get blocked
Key idea: Email filtering helps reduce risk, but it can never eliminate it completely.
4 User Layer – The most trusted but least predictable part
No matter how strong your technical controls are:
- Users can still click
- Credentials can still be entered
- MFA fatigue attacks still work (MFA Fatigue Attack Statistics (2022-2025), 2025)
From an abstract view:
- The user is part of the system
- Not an external factor
Key idea: Email security often fails when people trust something that ends up being a trick.
Why “Perfect Email Security” Does Not Exist
If you set aside specific vendors and tools, email security is really about managing risk, not stopping every single threat. You are balancing:
- Usability vs protection
- False positives vs false negatives
- Automation vs user awareness
Anyone who says they offer 'complete email protection' is not being realistic.
Practical Takeaways for IT Teams & MSPs
Rather than chasing after tools, focus on the main principles:
✔ Reduce identity ambiguity
- Proper SPF, DKIM, DMARC
- Monitor domain impersonation
✔ Reduce attack surface
- Disable legacy authentication (Block legacy authentication with Conditional Access - Microsoft Entra ID, 2023)
- Enforce MFA everywhere (A HOW-TO-GUIDE FOR MULTI-FACTOR AUTHENTICATION, 2020)
✔ Reduce blast radius
- Conditional access (Best Practices for Conditional Access Policy in Microsoft Tools, 2025)
- Limited session lifetimes (Session Management Cheat Sheet, 2023)
✔ Educate users with context
- Explain why attacks work
- Not just what to avoid
Why Technical Abstraction Matters
Abstraction allows you to:
- Understand systems independent of vendors
- Make better architectural decisions
- Avoid tool-driven thinking
Once you understand how email works overall, it’s much easier to compare different products.
Final Thoughts
Email isn’t broken. It’s just been around for a long time. Security comes from:
- Understanding its limitations
- Designing controls around human behavior
- Accepting that no single layer is enough
If you understand email from a big-picture view, you can move beyond just reacting to threats and start building stronger systems.
Author Note
Written by Jaspreet Singh Real-world IT insights from MSP and enterprise environments.
References
(2015). DMARC. IETF RFC 7489. https://en.wikipedia.org/wiki/DMARC
Beaman, C. & Isah, H. (2022). Anomaly Detection in Emails using Machine Learning and Header Information. arXiv preprint arXiv:2203.10408. https://doi.org/10.48550/arXiv.2203.10408
(2025). MFA Fatigue Attack Statistics (2022-2025). ICCK Transactions on Cybersecurity. https://www.icck.org/article/epdf/tc/611
(2023). Block legacy authentication with Conditional Access - Microsoft Entra ID. Microsoft Learn. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication
(2020). A HOW-TO-GUIDE FOR MULTI-FACTOR AUTHENTICATION. CISA. https://www.cisa.gov/sites/default/files/publications/NCSAM_MFAGuide_2020.pdf
(2025). Best Practices for Conditional Access Policy in Microsoft Tools. Reco.ai. https://www.reco.ai/hub/best-practices-for-conditional-access-policy-in-microsoft-tools
(2023). Session Management Cheat Sheet. OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html