Skip to content

E-mail Security Checklist

Intro

Nearly 50 years since the first e-mail was sent, it is still central to how we communicate within Democrats Abroad. If a hacker gets access to your e-mails, it provides a gateway for your other accounts to be compromised through password resets, therefore e-mail security is paramount for your digital safety.

Checklist

Essential Activities

  • Use More Than One E-mail Address
    Priority: Essential
    Use different addresses to separate work vs. volunteer vs. on-line social vs. personal security-critical communications. This kind of compartmentalization will reduce the amount of damage caused by a data breach of one account, and also make it easier to recover a compromised account. ( Why Use Multiple Email Accounts )

  • Keep your Account Secure
    Priority: Essential
    Use a long and unique password, enable 2FA/MFA and be careful while logging in. (See guidance under Passwords and Authentication) Your e-mail account provides an easy entry point to all your other online accounts for an attacker.

  • Regularly Review your Google Security Checkup
    Priority: Essential
    If you use a Google hosted e-mail, like G-mail (more than 80% of DA leaders do) then regularly check your Google Account Security Checkup (DNC Jan 2026)

  • Verify Senders and Recipients
    Priority: Essential
    E-mails can be easily spoofed and e-mail scams are common and clever. Verify that the sender is who they say they are: Check that the e-mail address is one you are already familiar with, and use a secondary channel to confirm if something seems changed or odd (i.e. call your friend to confirm if they intended to send the message).
    If an e-mail raises suspicions, and you are not sure if it is legitimate, do not reply, forward, click on the links, scan QR codes, open attachments, or send any sensitive information.
    Always check the URL address to confirm your destination and even type a URL manually rather than clicking on suspicious links in emails. Do not respond to emails promising money, checking on the delivery of a package you didn't order, threatening you if you don't send them bitcoin, insisting that you must "act now", or saying you need to verify an account.

  • Disable Automatic Loading of Remote Content/Use PlainText
    Priority: Recommended
    E-mail messages can contain remote content such as images and tracking tokens. Prefer plaintext over HTML e-mail, HTML messages often include identifiers in links and inline images which can collect usage and personal data. You should disable auto image-loading, as it exposes your IP address and device information, and is often used for user tracking. In a Gmail account, simply go to >Settings >See all Settings > General > Images > Ask before displaying external images

  • Don't Connect Third-Party Apps to your E-mail Account
    Priority: Recommended
    If you give a third-party app or plug-in full access to your inbox, they effectively have full unhindered access to all your e-mails and their contents, which poses significant security and privacy risks.

  • Don't Share Sensitive Data via E-mail
    Priority: Recommended
    Avoid sharing confidential information via unencrypted e-mail. E-mails are very easily intercepted and you can't be sure of how secure your recipient's environment is. Use a "temporary link" tool like Bitwarden Send or OneTimeSecret.com to safely send encrypted information.

Advanced Activities

  • Use Aliasing / Anonymous Forwarding
    Priority: Advanced
    E-mail aliasing allows messages to be sent to <anything>@my-domain.com and still land in your primary inbox, effectively allowing you to use a different, unique e-mail address for each service you sign up for. This means if you start receiving spam, you can block that alias and determine which company leaked your e-mail address.

  • Subaddressing
    Priority: Advanced
    An alternative to aliasing is subaddressing, where anything after the + symbol is omitted during mail delivery. This enables you to keep track of who shared or leaked your e-mail address, but unlike aliasing, it will not protect against your real address being revealed.