Report: securing a company email system
Apprenticeship at Suite De Soins: audit and fix of a Google Workspace email system on an OVH domain, two-factor authentication and written security rules.
Context
Suite De Soins is a home care agency with no IT department that handles health data. As its only IT contact, I took over the email system: domain at OVH, mailboxes on Google Workspace.
The problem
Without properly configured SPF, DKIM and DMARC, anyone can send an email that looks like it comes from the company's domain, and genuine emails may land in spam. For a healthcare business, that is a direct phishing risk.
What I did
- Audit of the domain's DNS records
- SPF fix: only authorised servers may send on behalf of the domain
- DKIM enabled in Google Workspace and its key published in the OVH DNS zone
- A DMARC policy put in place
- Two-factor authentication (MFA) enforced on every account
- Simplified security policy, password procedure (ANSSI and CNIL guidelines) and staff awareness
Typical records for a domain on Google Workspace:
exemple.fr. TXT "v=spf1 include:_spf.google.com ~all"
google._domainkey.exemple.fr. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.exemple.fr. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"Outcome
The domain is authenticated, spoofing is blocked by the DMARC policy and every account is protected by a second factor. The rules are written down and the team knows what to do with a suspicious email.