Choose a business email host by verifying it supports SPF, DKIM, and DMARC for every domain and service that sends mail on your behalf. Then compare administrator controls, retention, encryption, data-location commitments, and how well the service fits your workflows. Check the protections included in the specific plan you would buy, and validate your DNS setup before enforcing DMARC.
Start with domain authentication
Business email security begins with proving which systems are allowed to send mail for your domain. SPF, DKIM, and DMARC work together to make forged messages harder to pass off as legitimate. Google recommends these methods for senders, and the Federal Trade Commission (FTC) explains their value in reducing spoofing and impersonation risks.
As an Amazon Associate I earn from qualifying purchases.
- SPF identifies the servers authorized to send mail for your domain.
- DKIM adds a domain-linked signature that receiving systems can validate.
- DMARC tells receiving systems how to handle messages that fail aligned SPF or DKIM checks, and can provide reports about authentication results.
Google’s email sender guidelines describe sender requirements and authentication practices. Microsoft Learn also explains how SPF, DKIM, and DMARC help Microsoft 365 detect forged senders, including spoofing used in phishing and business email compromise: How email authentication works in Microsoft 365.
The FTC warns: “Without protections in place, scammers can use your domain name to send phishing emails that look like they’re from your business.” See its Cybersecurity for Small Business guidance.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Roll out SPF, DKIM, and DMARC without disrupting legitimate mail
A domain may send mail from more than its main mailbox service: newsletters, invoicing systems, customer-support platforms, website forms, and other business applications may also use it. If those senders are missing or misconfigured in authentication records, legitimate messages can fail checks. The FTC notes that configuring these protections can require expertise.
- Inventory every legitimate sender. List the email host and each third-party service that sends using your domain. Confirm which domain or subdomain each one uses.
- Set up SPF and DKIM for the relevant senders. Follow each service’s current DNS instructions, and check that records do not conflict or omit a legitimate sender.
- Publish DMARC and review reports. Use the reporting period to identify legitimate mail that is failing authentication and correct the configuration.
- Tighten DMARC enforcement only after validation. Choose a stricter policy once you understand the results and have accounted for the legitimate sources. A provider may give setup guidance, but do not assume it will configure third-party senders automatically.
Ask whether the host provides clear instructions or support for the records, but make sure someone in your organization owns the full sender inventory and ongoing changes.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C & NFC): The Thetis PRO-A features integrated USB Type C and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Compare the controls administrators can actually manage
Do not judge a service only by its mailbox interface. Find out what administrators can require, configure, monitor, and retain across the organization. Product-level security statements do not establish that every protection is included in every business plan.
- Account and administrator controls: Ask what security policies can be enforced for users, how administrators manage settings, and how security alerts are handled. Confirm details in current documentation for the exact plan.
- Retention: Check whether the service’s retention settings meet your operational and recordkeeping needs, and how stored mail is managed.
- Secure transport: If you exchange sensitive mail with particular partners, ask how secure transport requirements can be configured for those domains.
- Operational ownership: Establish who will manage user accounts, DNS authentication records, changes to third-party senders, and security alerts.
Google’s security checklist for medium and large businesses (100+ users) includes examples such as TLS settings for partner domains and mail-storage and retention configuration. It is guidance for organizations of that size, not a complete feature comparison or proof that all listed controls are available in every Workspace edition.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-A & NFC): The Thetis PRO-A features integrated USB Type A and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Ask what “encryption” means
“Encrypted” can describe different protections. Encryption in transit protects data as it moves between systems; encryption at rest protects stored data. End-to-end encryption is a distinct model, and zero-access claims concern whether the provider can access stored content. These approaches can affect which mail functions and recipient workflows are possible.
Ask the provider which message content and metadata it can access, which types of messages receive each protection, and what recipients need to do. Do not assume a message is end-to-end encrypted simply because a service advertises encryption.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
- Google’s documentation for Gmail Client-side encryption separately describes encryption at rest and in transit between facilities, as well as TLS with other email providers. Confirm whether the relevant capability applies to your intended Workspace edition and configuration.
- Proton describes its business email security in terms of end-to-end and zero-access encryption. Treat these as Proton’s descriptions and ask how they apply to the communication patterns and recipients your business uses.
- Fastmail says it encrypts data in transit and at rest, and that its own apps do not offer end-to-end encryption. That difference may matter if end-to-end protection is a requirement.
Decide whether data location is a requirement
If your organization has a data-residency requirement, define exactly what must stay where before comparing providers. Ask where mail and related data are stored and processed, what location applies to support or backups, and what the contract actually guarantees. A published location option from one provider does not determine whether it satisfies another organization’s legal or contractual obligations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fastmail says customers can choose EU or US primary data residency in its security information. Confirm the scope and contractual terms directly; the provider’s statement is not a legal-compliance determination for your business.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L2 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Fully compatible with ID Austria, this hardware key meets the mandatory FIDO2 Level 2 (L2) security standard. Check FIDO2 compatibility before purchase - Known limitations: Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Check workflow fit before committing
Security controls are only useful if the service can support the way your organization works. Verify the requirements that apply to your company before purchase:
- Mail clients, calendars, and directories employees need to use.
- Connections to line-of-business applications and other services that send mail from your domain.
- Migration of existing mail, accounts, and domain configuration.
- Deliverability needs, including any external senders that must pass SPF, DKIM, and DMARC checks.
- Who will configure and maintain DNS records and respond when authentication reports reveal failures.
Ask each provider to confirm these details for the intended plan and setup. Do not infer comparative integration support from a general security page.
Use provider examples as questions, not a security ranking
The following examples illustrate different published security information. They are not a ranked recommendation or a complete, plan-by-plan comparison.
Quick Recap
| Provider | Published information relevant to evaluation | What to verify for your purchase |
|---|---|---|
| Google Workspace / Gmail | Google recommends SPF, DKIM, and DMARC for sending domains. Its 100+ user checklist covers examples including partner-domain TLS settings and mail storage and retention configuration. | Confirm which controls apply to the Workspace edition and configuration you intend to buy. |
| Microsoft 365 | Microsoft Learn explains SPF, DKIM, and DMARC and their role in detecting forged senders. | Consult current technical and plan documentation for the administrative protections and retention settings you need. |
| Proton Mail for Business | Proton describes end-to-end and zero-access encryption and documents domain authentication features. | Ask how the encryption model applies to your recipients and workflows, and which features are included in the specific plan. |
| Fastmail | Fastmail says it encrypts data in transit and at rest, offers a choice of EU or US primary data residency, and does not offer end-to-end encryption in its own apps. | Confirm the residency scope and contractual terms, and whether the encryption model meets your requirements. |
Questions to ask before signing
- Does this specific plan support SPF, DKIM, and DMARC for every domain and legitimate sending source we use?
- What administrator-enforced account security policies, retention controls, and security alerts are included?
- What do your encryption claims cover, and what content or metadata can the provider access?
- Is end-to-end encryption available for the communication patterns we need, and what functionality or recipient steps does it involve?
- Which data is stored or processed in each location, and what residency commitment appears in the contract?
- How will mail migration and third-party senders be handled, and who is responsible for keeping authentication records current?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
