7 Microsoft 365 Email Security Settings Every Asheville NC Small Business Should Check

If you are searching for microsoft 365 tips asheville nc small business, email security is one of the highest-return places to spend thirty minutes. Business email compromise — where an attacker impersonates your domain, your boss, or a trusted vendor — is one of the most expensive and most avoidable threats facing small businesses right now.

Microsoft 365 includes the tools to close most of these gaps. The problem is that they are spread across the Microsoft 365 Defender portal, Exchange admin center, and your DNS registrar, and they do not configure themselves. Here is what to check and why each one matters.

1. Confirm your SPF record is published and accurate

SPF (Sender Policy Framework) is a DNS record that tells receiving mail servers which servers are allowed to send email on behalf of your domain. Without it, anyone can send mail that appears to come from your address. With a stale or broken SPF record, legitimate messages get flagged as spam.

For a standard Microsoft 365 setup, your SPF record should include include:spf.protection.outlook.com and end with ~all or -all. If your business also sends through a marketing tool, invoicing platform, or third-party notification service, those need to be in the record too. A missing sender is one of the most common reasons for deliverability problems and spoofing exposure.

• look up your current SPF with an online DNS lookup tool
• verify every legitimate sending source is listed
• if you have never set this up, it belongs at your DNS registrar (not inside Microsoft 365)
• avoid having more than one SPF record — they must be merged into a single TXT entry

2. Enable DKIM signing for your domain

DKIM (DomainKeys Identified Mail) cryptographically signs your outgoing messages so receiving servers can verify the email actually came from your infrastructure and was not altered in transit. Microsoft 365 has DKIM built in, but it requires two CNAME records published at your DNS registrar before it activates.

Check DKIM status in the Microsoft 365 Defender portal under Email & Collaboration → Policies & Rules → Threat Policies → Email Authentication. If your domain shows as disabled, enable it, copy the CNAME values, and add them at your registrar. It typically takes a few hours to propagate.

DKIM matters because SPF alone does not protect the "From" header that people actually see. DKIM does. Together, they are what makes DMARC work. This is a core piece of Microsoft 365 administration that is easy to overlook.

3. Publish a DMARC policy and start getting reports

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving mail servers what to do when a message fails both checks — quarantine it, reject it, or let it through. It also gives you visibility into what is sending as your domain.

A basic DMARC record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Start with p=none (monitoring mode) to see what is sending as your domain without blocking anything. Once you are confident your SPF and DKIM are correct and covering all your senders, move to p=quarantine and eventually p=reject. Many small businesses stop at p=none and forget to revisit it — that means DMARC is providing reports but no actual protection.

This is directly relevant to cybersecurity and anti-phishing defense for your business and your customers, since a domain with a strict DMARC policy is much harder to spoof convincingly.

4. Review and tighten Microsoft 365 anti-phishing policies

Microsoft 365 Defender includes anti-phishing policies that go well beyond basic spam filtering. The most useful controls for small businesses are impersonation protection settings that watch for messages claiming to come from your executives, common business domains, or specific trusted senders.

In the Defender portal under Threat Policies → Anti-phishing, check:

• whether impersonation protection is enabled for key users (owner, finance, HR, office manager)
• whether your domain is listed under protected domains
• whether mailbox intelligence is enabled — this uses historical sending patterns to flag unusual senders
• what the action is for impersonation detection (quarantine is better than just tagging)
• whether spoof intelligence is enabled for internal and external senders

The default policy provides some protection, but a custom policy where you explicitly add high-value targets is more effective.

5. Check anti-spam inbound policy settings

The built-in anti-spam filter handles most junk mail, but the default settings do not always match what a small business actually needs. A few settings worth reviewing:

• Bulk email threshold: lower is stricter — a threshold of 5 or 6 catches more bulk marketing email that could be used for social engineering; the default is often higher
• Safe senders list: review any domains or addresses that have been whitelisted; attackers sometimes use trusted vendor domains that have been compromised
• High-confidence phish action: make sure high-confidence phishing messages are going to quarantine, not just junk
• Outbound spam policy: watch for unusual outbound volume, which can indicate a compromised account is sending spam

6. Enable Safe Links and Safe Attachments if your license includes them

Microsoft Defender for Office 365 Plan 1 (included in Microsoft 365 Business Premium and available as an add-on) adds Safe Links and Safe Attachments. These are worth turning on if you have the license.

Safe Links rewrites URLs in email and Teams messages and checks them against Microsoft's threat intelligence at click time. This catches links that were safe when delivered but later became malicious — a common tactic in phishing campaigns.

Safe Attachments runs email attachments through a sandbox before delivering them. It adds a short delay (usually seconds to a few minutes) but catches malicious files that signature-based antivirus misses. For businesses handling invoices, contracts, and application documents by email, this is a meaningful control.

Both are configured under Threat Policies in the Defender portal. Neither is on by default.

7. Set up alert policies for unusual account activity

Microsoft 365 includes built-in alert policies that can notify administrators when something abnormal happens — an unusual volume of email deletion, a new inbox rule forwarding mail outside the organization, a user logging in from an unexpected location, or a high volume of failed sign-ins.

In the Defender portal under Policies & Rules → Alert Policy, review which alerts are active and who receives notifications. For small businesses, the most important ones to enable or verify include:

• email forwarding to external recipients
• unusual inbox or sweep rules
• mass file download from SharePoint or OneDrive
• user reported phishing messages
• sign-in from suspicious locations or IP addresses

These alerts do not stop an attack automatically, but they give you a window to respond before a compromised account does serious damage. Pair this with managed IT support that actually reviews alerts and acts on them — alerts going to an unmonitored inbox are no better than no alerts at all.

Putting it together

Email security in Microsoft 365 is not a single switch. It is a stack: DNS authentication to protect your domain identity, Defender policies to filter and sandbox threats before they reach staff, and alert coverage so unusual activity surfaces quickly.

Most small businesses in Asheville and Western North Carolina have at least one gap in this stack. SPF records that have not been updated since a new marketing tool was added, DKIM that was never turned on, anti-phishing policies still at default, and alerts going to an inbox nobody checks regularly are all common findings.

A quick review of all seven areas usually takes less than an hour with proper admin access. The harder part is knowing what to look for and what good looks like — which is where a free IT security consultation or dedicated Microsoft 365 administration support can make the process faster and more reliable.

If you want to see what a full Microsoft 365 tenant review and hardening project looks like, the M365 security hardening case study walks through a real engagement.

And if email security connects to a broader concern about protecting business data, it ties directly into both cybersecurity and endpoint protection and maintaining a solid cloud backup strategy — because a well-secured inbox is only useful if the data behind it is also recoverable.