Email Security for Microsoft 365 & Google Workspace 2026

Last month a client in Pune forwarded me an email that nearly cost his company ₹6.8 lakh. It looked like it came from his regular steel supplier. Same logo, same signature block, even the same slightly broken English the supplier's accounts guy always used. The only difference: one line in the email asking that the next payment go to a "new bank account due to GST audit." His finance executive almost processed it. What saved them was a habit, not a filter. She called the supplier to confirm, and the supplier had no idea what she was talking about.

That is business email compromise, and it is the single most expensive cyber threat facing Indian SMBs right now. The FBI's IC3 has tracked BEC losses in the tens of billions of dollars globally, and Indian companies increasingly show up in those chains, either as targets or as mule accounts. Here is the uncomfortable truth: the native filters in Microsoft 365 and Google Workspace are good at catching spam and obvious malware, but they were never designed to stop a well-crafted impersonation email with no attachment and no malicious link. That is exactly the kind of attack that empties a bank account.

This post is about closing that gap. I'll walk through what email security in Microsoft 365 and Google Workspace actually covers, where it falls short, and the specific add-on layers, DNS records, and policies you should put in place. Real steps, real rupee costs, and a worked example from a company I helped in Gurgaon.

Key Takeaways

• Native M365 and Workspace filters catch spam and malware well but miss most business email compromise (BEC) and internal impersonation attacks.
• Configure SPF, DKIM, and DMARC first. They are free, they take an afternoon, and they stop attackers from spoofing your domain outright.
• Set DMARC to p=reject only after monitoring in p=none for 4 to 6 weeks, or you'll block your own legitimate mail.
• Add a third-party layer (Avanan/Check Point, Proofpoint Essentials, or Mimecast) for ₹150 to ₹450 per user per month if you handle high-value transactions.
• Technical controls stop maybe 80% of attacks. A payment verification process stops the rest. Both are non-negotiable.
• Train staff on the specific tricks used in Indian BEC: fake "new bank account" requests, GST audit urgency, and CEO gift-card scams.

Why do native Microsoft 365 and Google Workspace filters miss phishing?

Both platforms ship with genuinely capable spam and malware engines. Microsoft's Exchange Online Protection (EOP) and Google's built-in Gmail security block the vast majority of junk. But there are structural blind spots you need to understand.

First, these filters rely heavily on reputation and known-bad signals. A brand-new lookalike domain with no history, sending one carefully written email, has no bad reputation yet. It sails through. Second, BEC emails usually contain no malicious payload at all. There's nothing to scan. It's just text asking someone to change a bank account or approve a wire. Third, the more dangerous attacks come from compromised legitimate accounts. When a real supplier's mailbox is hijacked, the email passes every authentication check because it genuinely came from them.

The gap widens for Indian SMBs specifically. Attackers watch for the patterns we use: the flurry of invoices near a GST filing deadline, the reliance on WhatsApp and email for payment approvals, and the tendency for a small finance team to trust a familiar sender. If you've licensed either platform through us on our Microsoft 365 licensing or Google Workspace licensing plans, the base security is decent. The point is that "decent base" and "protected against a targeted BEC attack" are two different things.

The three attack types you actually need to worry about

• Domain spoofing: Attacker forges your exact domain ([email protected]). SPF/DKIM/DMARC stops this cold.
• Lookalike domains: Attacker registers yourcompany-in.com or yourcompany.co and impersonates you or your vendor. Needs filtering plus human awareness.
• Account takeover: A real mailbox is compromised. Needs MFA, anomaly detection, and out-of-band payment verification.

How do I set up SPF, DKIM, and DMARC for my domain?

This is the foundation, and it is free. If you do nothing else after reading this, do this. These three DNS records tell the world which servers are allowed to send email as your domain and what to do with mail that fails the checks.

1. Publish an SPF record. This is a TXT record on your domain listing authorised senders. For Microsoft 365 it's typically v=spf1 include:spf.protection.outlook.com -all. For Google Workspace it's v=spf1 include:_spf.google.com ~all. If you also send from a bulk mail tool or your CRM, add those includes too. Keep it under 10 DNS lookups or SPF breaks silently.
2. Enable DKIM. In M365, go to the Defender portal, Email & collaboration, Policies, DKIM, and enable signing for your domain, then publish the two CNAME records it generates. In Workspace, go to Admin console, Apps, Google Workspace, Gmail, Authenticate email, generate the key, publish the TXT record, then click Start Authentication. Give DNS 24 to 48 hours.
3. Start DMARC in monitoring mode. Add a TXT record at _dmarc.yourcompany.in with v=DMARC1; p=none; rua=mailto:[email protected]. This tells receivers to send you aggregate reports but not to block anything yet.
4. Read the reports for 4 to 6 weeks. You'll discover every legitimate service sending on your behalf that you forgot about: your accounting software, your e-invoice vendor, that old marketing tool. Fix their SPF/DKIM alignment first.
5. Move to enforcement. Once your reports are clean, change the policy to p=quarantine for a couple of weeks, then p=reject. Now nobody can spoof your exact domain, full stop.

Common Mistake: Jumping straight to p=reject without the monitoring phase. I've seen a Nagpur trading firm block their own GST e-invoice notifications and payment reminders for three days because their invoicing platform sent mail from their domain but wasn't in the SPF record. Always monitor first. DMARC reports are ugly XML, so use a free parser like the ones from Postmark or dmarcian to read them.

What email security add-ons work best for Indian SMBs?

SPF/DKIM/DMARC stops spoofing of your own domain. It does nothing about lookalike domains or compromised vendor accounts. For that you layer a third-party gateway or an API-based security tool on top of your existing setup. Here's how the practical options compare for a typical 25 to 100 seat Indian business.

Solution	Approx. price (per user/month)	Best for	BEC / impersonation detection	Deployment effort
M365 Defender for Office 365 P1	₹170 to ₹200	Existing M365 shops wanting native add-on	Good (anti-phishing policies, spoof intelligence)	Low, it's a licence upgrade
Google Workspace + Security add-on	Included in Business Plus / Enterprise tiers	Workspace shops on higher tiers	Moderate	Low
Avanan (Check Point) Harmony Email	₹250 to ₹400	Both platforms, API-based, fast to deploy	Excellent, AI impersonation detection	Low, connects via API in under an hour
Proofpoint Essentials	₹200 to ₹350	SMBs wanting a mature gateway	Very good	Moderate, MX record change
Mimecast	₹300 to ₹450	Compliance-heavy firms, email archiving needs	Very good, strong archiving	Moderate to high

Prices are indicative and move with the rupee and volume discounts; treat them as a planning range, not a quote. For most SMBs I recommend starting with either Defender for Office 365 P1 if you're already on M365, or an API-based tool like Avanan because it deploys in under an hour without touching your MX records. If you want help sizing this against your actual mail volume and risk, our IT consulting team does exactly this kind of assessment.

Do I need a full gateway or is the native upgrade enough?

Honest answer: if you're a 10-person design studio that never handles supplier payments over email, the native upgrade plus MFA plus good DMARC is genuinely enough. If you're a trading, manufacturing, logistics, or import-export business where invoices and bank details fly around daily, spend the extra ₹100 to ₹200 per user for the dedicated tool. The math is simple. One prevented BEC incident pays for years of licensing.

Worked example: how a Gurgaon logistics firm stopped a ₹6 lakh scare

A freight forwarding company in Gurgaon, 42 employees, came to us after a near-miss. Their finance head received an email that appeared to be from their managing director, sent while he was travelling, asking to "urgently release payment to the new vendor account, will explain later." The email address was [email protected] instead of the real .in domain. A junior accountant caught the domain difference by luck.

Here's what we implemented over two weeks:

1. Week 1, DNS foundation. Configured SPF, enabled DKIM, and published DMARC in p=none. We found three legitimate senders they'd forgotten: their TMS software, a Zoho invoicing tool, and an old MailChimp account. Fixed alignment for all three.
2. Week 1, MFA everywhere. Enforced multi-factor authentication on all 42 mailboxes. Two accounts already had suspicious sign-in attempts from outside India in the logs, which told us a password had likely leaked.
3. Week 2, added Avanan via API. Connected in about 40 minutes. Enabled impersonation protection so any external email using the MD's or finance head's display name gets flagged with a warning banner. Enabled lookalike-domain detection.
4. Week 2, external sender banners. Every email from outside the organisation now shows a clear [EXTERNAL] tag at the top. Sounds trivial, works surprisingly well.
5. Week 2, payment verification policy. Any change to vendor bank details or any payment above ₹50,000 requires a callback to a previously known phone number. Not the number in the email. This is the control that actually matters.

Cost breakdown: Avanan at roughly ₹300 per user for 42 users came to about ₹12,600 per month. The DNS and MFA work was part of a ₹35,000 one-time hardening engagement. Against a single attempted ₹6 lakh transfer, the ROI conversation was over in one sentence. Four weeks later, DMARC went to p=reject and the impersonation attempts against their domain simply stopped landing.

What internal policies stop BEC that technology can't?

Technology catches the spoofs and the lookalikes. It does not catch a genuinely compromised supplier mailbox sending a real email with fraudulent bank details. Only process does. These are the human controls I install at every client, and they cost nothing but discipline.

• Out-of-band verification for money. Any bank detail change or payment above a threshold you set gets confirmed by a phone call to a known number. Never a number or WhatsApp contact from the email itself.
• Dual approval for large transfers. Two people sign off on anything above, say, ₹2 lakh. Attackers rely on a single stressed employee acting alone.
• No urgency exceptions. The scam always includes urgency: "the MD is in a meeting," "supplier will cancel the order." Make it a rule that urgency never overrides verification. Real bosses understand.
• Report-and-reward culture. People should feel safe reporting a suspicious email or even a mistake. Punishing the accountant who almost fell for it guarantees the next one hides it.

Pro Tip: Register the obvious lookalike domains yourself before an attacker does. If your domain is company.in, spend a few thousand rupees to grab company.co, company-in.com, and the common misspellings. It's cheaper than one incident, and it takes those weapons off the table permanently.

How does email security fit into broader compliance and data rules?

Email is where a huge amount of your sensitive data actually lives: invoices, PAN and GST numbers, HR records, customer details. Under the Digital Personal Data Protection framework, if a compromised mailbox leaks customer personal data, you're on the hook for breach obligations. That's not theoretical anymore.

Two things follow from this. First, know where your mail data is stored and archived, which ties directly into the questions we covered in our guide on data localization rules for Indian SMBs in 2026. Second, if you're evaluating where to host related workloads, our post on sovereign cloud in India for SMBs and the practical cloud region choice guide are worth a read. Email security is one piece of a broader posture, and treating it in isolation is a mistake I see constantly.

For businesses that also communicate with customers over other channels, remember that the same verification discipline applies. If you rely on messaging for order confirmations or OTPs, our WhatsApp Business API and bulk SMS services setups can be configured with proper sender verification so your customers can trust messages that genuinely come from you.

A practical 30-day rollout checklist

If you want to brief your IT vendor or do this yourself, here's the sequence I use. It maps cleanly to what a vendor should quote you for.

1. Days 1 to 3: Audit current setup. List every service that sends mail as your domain. Enforce MFA on all accounts. Review sign-in logs for anomalies.
2. Days 3 to 5: Publish SPF, enable DKIM, publish DMARC at p=none with a reporting mailbox.
3. Days 5 to 7: Turn on external sender banners in M365 or Workspace.
4. Week 2: Deploy your chosen add-on (Defender P1, Avanan, or Proofpoint). Enable impersonation and lookalike detection.
5. Week 2: Write and circulate the payment verification and dual-approval policy. Get sign-off from finance and leadership.
6. Weeks 2 to 6: Monitor DMARC reports. Fix any legitimate senders failing alignment.
7. Week 4: Run a short phishing awareness session with your staff. Use real examples, including the Indian bank-account and GST-urgency tricks.
8. Week 6: Move DMARC to p=quarantine, then p=reject once reports are clean.

None of this requires a large team. A focused two-person effort or a single competent partner gets it done. If you'd rather hand it off, our cloud migration and managed services team runs this exact playbook, and you can see the full range on our services overview.

Frequently asked questions

Is Microsoft 365 or Google Workspace more secure for email out of the box?

They're roughly comparable for baseline spam and malware protection. Microsoft 365 tends to offer more granular security controls at the Business Premium tier, while Google Workspace's advanced protections sit in Business Plus and Enterprise. For BEC specifically, neither is sufficient alone without proper DMARC configuration and, ideally, a dedicated add-on.

How much does email security cost for a small business in India?

The DNS foundation (SPF, DKIM, DMARC) and MFA are free apart from setup effort. A one-time hardening engagement typically runs ₹25,000 to ₹50,000. Add-on tools like Avanan, Proofpoint Essentials, or Defender P1 range from roughly ₹170 to ₹450 per user per month depending on the product and your seat count.

Can DMARC alone stop business email compromise?

No. DMARC stops attackers from spoofing your exact domain, which shuts down one attack vector completely. It does nothing against lookalike domains or compromised legitimate accounts. You need DMARC plus impersonation filtering plus a payment verification process to cover the full range of BEC tactics.

What is the difference between spam filtering and phishing protection?

Spam filtering blocks unwanted bulk mail and known malware, largely based on reputation and content patterns. Phishing and BEC protection targets carefully crafted individual emails designed to deceive a specific person, often with no malicious link or attachment. The second is much harder to detect and is where native filters struggle most.

How do I know if my company email has already been compromised?

Check sign-in logs for logins from unexpected countries or at odd hours, look for mailbox forwarding rules you didn't create (a classic attacker trick), and watch for colleagues receiving replies to conversations they never started. If you find any of these, force a password reset, enforce MFA, and review sent items immediately.

Do I need email security if I use MFA on all accounts?

MFA is essential and stops most account takeovers, but it doesn't stop spoofed emails or lookalike-domain impersonation, since those never touch your accounts. Think of MFA, DMARC, and filtering as three separate locks. You want all three, not one.

How long does it take to fully secure email for a 50-person company?

About 30 days end to end, mostly because DMARC needs a monitoring window before you can safely enforce it. The technical deployment itself takes a week or less. The remaining time is monitoring, policy rollout, and staff training.

The bottom line

Strong email security for Microsoft 365 and Google Workspace isn't about buying the most expensive product. It's about layering the right controls in the right order: fix your DNS records for free, enforce MFA, add a targeted filtering tool if your business handles money over email, and back it all with a payment verification process that no urgent email can override. The Gurgaon example proves the point. A ₹35,000 hardening job plus modest monthly licensing prevented what could easily have been a ₹6 lakh loss, and the attacks against their domain now simply fail.

The businesses that get burned are almost always the ones who assumed the built-in filters had it covered. They didn't, and they never claimed to. If you want a straightforward assessment of your current exposure and a fixed-scope plan to close the gaps, get in touch with our team. We'll look at your actual setup, not a template, and tell you honestly whether you need the full stack or just the free foundation done properly.

Whether you run a trading firm in Surat, a design studio in Bengaluru, or a logistics operation in Delhi NCR, the threat is the same and so is the fix. Do the boring foundational work first. It stops the majority of attacks and costs almost nothing but attention.

Image credit: Innovate Maryland Emerging Technology Center by MDGovpics via flickr (BY 2.0), sourced through Openverse.