Mailbox security guidelines

Alibaba Mail security hardening

Alibaba Mail provides security features such as a secure phone, IP sign-in restrictions, two-factor authentication for proprietary clients, and security passwords for third-party clients. Enable these features to strengthen your organization's email security.

Review the following scenarios regularly and address any security gaps in your organization. If an employee has not enabled the required protections for a mailbox with known security risks, consider revoking their permissions, such as sign-in or email sending and receiving.

Sign-in security

Apply least-privilege access for daily account use — disable SMTP if not needed. For essential scenarios, enable the available mailbox security features. Conduct regular security checks and awareness campaigns.

1. Using third-party clients (SMTP, IMAP, and POP)

1) Accounts that require a third-party client

Enable security passwords for third-party clients. A security password is a dedicated, auto-generated password for third-party client access. Once enabled, you must use this password instead of your regular password. You can use it long-term and delete it when no longer needed.

Advantages:

1) The client security password is a highly complex string by default.

2) Configure credentials once — they are hidden afterward, reducing the risk of leaks.

3) Generate independent security passwords for different clients, so users can continue using their preferred email clients.

2) Accounts that do not use or are not allowed to use third-party clients for a long time

Disable standard protocols. For accounts that only use Alibaba Mail proprietary clients or have been inactive, disable standard protocols to block third-party client access and prevent brute-force attacks. If no accounts use third-party clients, disable this feature domain-wide in the mail administration console.

2. Using Alibaba proprietary clients

Enable two-factor authentication. This requires a second authentication factor when signing in to an Alibaba Mail proprietary client, preventing unauthorized access even if the password is compromised. You can also disable sign-in permissions for clients you do not use daily.

3. Using passwords securely

Maintain strong passwords. Standard protocols (SMTP, IMAP, and POP) require only a username and password, meaning anyone can attempt to access any mailbox via a third-party client. If a password has not been changed for a long time, it is easily compromised. Change passwords regularly and enforce strong password policies.

4. Analyzing and handling unusual sign-ins

Enable unusual sign-in notifications. You receive an email and text message when your account is accessed from an unusual location. To receive text messages, link a phone number to your mailbox first.

Benefits:

This alerts you when someone else accesses your account, so you can take immediate action.

1) You will not be notified of your own sign-ins.

You may receive a notification for your own sign-in if your client's service IP address or network IP address changes. To prevent false alerts, add your device as a trusted device. For third-party clients, enable a security password — sign-ins with security passwords bypass unusual sign-in notifications. Alternatively, disable notifications entirely.

2) Security hardening for unauthorized sign-ins

If the sign-in IP address (region), time, and method (such as IMAP or POP3) indicate unauthorized access, take immediate action: change your password, enable multi-factor authentication or security passwords, and disable standard protocols. Add the suspicious IP to the blocklist, check for unusual settings or emails, and delete or revoke any suspicious emails.

Sending and receiving security

1. Managing sent and received emails

For important business operations, set up review and monitoring rules for the relevant mailboxes. Emails that do not pass review cannot be sent, and managers can monitor critical emails.

For common spam, submit it to Alibaba and periodically add samples to the filtering rules in the mail administration console. Configure rules to delete unwanted emails directly, reducing the risk of employees falling for scams.

For internal mail groups, set permissions to control who can send emails. For business groups, allow only group members to send. You can also require reviewer approval before delivery.

For important business operations, disable auto-forwarding for the relevant accounts to prevent forwarding to personal or external mailboxes.

For internal-only accounts, disable external domain sending and receiving permissions.

2. Highlighting notifications for external emails

Set warning levels for incoming emails based on the sender's address. Administrators can customize external address warnings in the domain administration console — general warnings show the sender's name, advanced warnings show both name and address. Whitelisted domains can be excluded.

3. Spam quarantine

The email quarantine temporarily stores emails the system identifies as suspicious — potential viruses, phishing links, or unverified senders. Review quarantined emails and decide how to handle them.

Information security threats are a constant global challenge. Alibaba Mail continuously improves its cloud security. Alibaba Mail security covers many areas, such as security policies, organizational security, compliance, data security, access control, personnel security, physical security, infrastructure security, system and software development and maintenance, disaster recovery, and business continuity. However, the greatest threat is human action. Security depends on both product features and user awareness.

Phishing Protection Guide

Note: Any email that asks for your password or directs you to an external link may be a phishing attempt. Exercise caution. Report it as spam, notify your company's mailbox administrator, and do not click any links or open any attachments.

Common phishing tactics used by attackers:

Common tactics include using stolen official images, creating attention-grabbing subjects, spoofing sender addresses, disguising links to look trustworthy, and using deceptive attachments or images.

Security Self-Check

Note: Security features help improve your security posture, but they are not a substitute for vigilance. Check your daily habits for potential security risks and verify that you have enabled the available security features.

What to do if you suspect your mailbox has been compromised:

Stay calm. Determine if your account has been compromised, check for unusual mailbox settings, handle suspicious emails, and enable security features.