Most email account takeovers leave settings behind, a forwarding rule, a mail-read app grant, an extra delegate, and those settings outlive the password reset unless someone looks for them on a schedule. This health check gives you nine quarterly metrics, each with a formula, a data source type and thresholds, for the hosted or on-premises email platform your organisation runs on. It is written for messaging administrators, identity teams and the security operations staff who review them. The detailed hunt for malicious rules lives in How to Audit Mailbox Forwarding and Inbox Rules; this page measures the whole platform and links that guide rather than repeating it.
What this health check covers
The scope is the mailbox platform and its tenant: user, shared and service mailboxes, the protocols clients use to reach them, mail flow (transport) rules, administrative roles, applications granted access to mail, mailbox delegation, audit logging and the domain authentication records that protect your sending domains. Secure email gateways in front of the platform have their own review; see Securing the email security gateway itself. The review is run by the messaging team, checked by security operations and signed off by the collaboration service owner.
Use this as your email platform audit checklist when a regulator, insurer or board asks whether the mail tenant is under control. Each metric relates to a technique that MITRE ATT&CK records for email: forwarding rules (T1114.003), hiding rules (T1564.008), added delegates (T1098.002) and stolen application tokens (T1528). Use the Email Security Guide for the controls themselves.
Key takeaways
- Persistence lives in settings. External forwarding, delegate grants and app consents survive a password reset, so count them every quarter.
- Legacy protocols undo MFA. Every mailbox still reachable by basic authentication protocols is a mailbox where a stolen password is enough.
- Shared mailboxes are identities. A shared or service mailbox with direct sign-in enabled is an account with a password nobody owns.
- Apps that read mail are the quiet risk. Tenant-wide mail permissions granted to applications deserve the same scrutiny as administrator roles.
- No audit log, no investigation. Mailbox audit coverage is the metric that decides whether you can answer "what did they read" after an incident.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Email Platform Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Full nine-metric health check | Quarterly | Messaging platform lead | Collaboration service owner and security delegate | Metric workbook, raw exports, findings log |
| External forwarding and delegate snapshot (MAIL-01, MAIL-09) | Monthly | Security operations | Messaging platform lead | Rule and permission exports, investigated exceptions |
| Application mail permissions review (MAIL-05) | Quarterly and after any consent phishing alert | Identity team | Collaboration service owner | App grant export with owner and business reason |
| Domain authentication check (MAIL-03) | Monthly | Messaging platform lead | Security operations lead | DNS record snapshot and aggregate report summary |
| Ad hoc rerun | After a business email compromise, tenant migration or merger | Messaging platform lead | CISO delegate | Same as quarterly |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "Mailboxes" means enabled user, shared, resource and service mailboxes unless a metric says otherwise.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| MAIL-01 | Mailbox forwarding rules to external addresses | Mailboxes with an inbox rule, mailbox forwarding setting or redirect that sends mail outside the organisation without an approved exception / total mailboxes | Mailbox rule and forwarding configuration export | 0 without exception | Above 0 to below 0.1%, each investigated | 0.1% or more, any uninvestigated, or any on an executive or finance mailbox |
| MAIL-02 | Legacy protocol enabled mailboxes | Mailboxes on which a protocol that supports only basic (password) authentication is enabled or was used in the quarter / total mailboxes | Mailbox protocol settings export and sign-in logs filtered by client protocol | 0% | Above 0% to 2%, each with a dated retirement plan | > 2%, or any successful legacy sign-in to an administrator |
| MAIL-03 | DMARC enforcement | Sending and parked domains you own with a published DMARC policy of quarantine or reject (not in test mode, t=y) / total domains you own | Public DNS records and DMARC aggregate reports | 100% | 80% to below 100%, rest at monitoring with a plan | < 80%, or a primary domain without enforcement |
| MAIL-04 | Shared mailbox sign in | Shared, resource and service mailboxes whose underlying account can sign in directly / total shared, resource and service mailboxes | Directory account status export joined to mailbox type | 0%, apart from documented service mailboxes on modern authentication | Above 0% to 5% | > 5%, or any with a successful interactive sign-in |
| MAIL-05 | App permissions to mail | Applications holding tenant-wide mail read, send or full mailbox permissions without an owner, a business reason and a scope restriction to named mailboxes / applications holding any mail permission | Identity provider application grant and consent export | 0% | Above 0% to 10% | > 10%, or any user-consented app with mail read on all mailboxes |
| MAIL-06 | Transport rule drift | Mail flow (transport) rules created, changed or deleted in the quarter without a matching approved change / total mail flow rule changes in the quarter | Admin audit log joined to change management records | 0% | Above 0% to 5% | > 5%, or any unapproved rule that redirects, copies (blind copy) or bypasses filtering |
| MAIL-07 | Admin count | Accounts holding a global, messaging or mailbox-wide administrator role (standing, not time-bound) / total enabled user accounts | Role assignment export from the identity provider and mail platform | Fewer than 5 standing holders per role and < 0.05% | 5 to 10 holders | > 10 holders, or any without phishing-resistant MFA |
| MAIL-08 | Audit log enabled | Mailboxes with mailbox auditing on and owner, delegate and admin actions recorded, including mail access events / total mailboxes | Mailbox audit configuration export, tenant audit log status | 100% and retention of at least 180 days | 95% to below 100%, or retention 90 to below 180 days | < 95%, retention below 90 days, or tenant audit logging off |
| MAIL-09 | Delegated access | Mailbox full access, send-as and send-on-behalf grants without an owner-approved request or past their review date / total such grants | Mailbox permission export joined to access request records | < 2% | 2% to 10% | > 10%, or any grant to an account outside the organisation |
MAIL-03 follows the DMARC specification now published as RFC 9989 (Proposed Standard, May 2026), which obsoletes RFC 7489 and RFC 9091; see the DMARCbis Changes Guide for what changed in how policy is expressed. Parked domains that never send mail count in the denominator because attackers spoof them too.
How to collect the data
- Mailbox configuration export: from the platform's administrative shell or reporting interface, export for every mailbox its type, forwarding settings, inbox rules with actions, enabled client protocols, audit settings and permission grants. One export feeds MAIL-01, MAIL-02, MAIL-04, MAIL-08 and MAIL-09.
- Sign-in logs: from the identity provider, pull 90 days of sign-ins filtered by client protocol and by shared or service mailbox accounts (MAIL-02, MAIL-04). Configuration can say a protocol is off while a per-mailbox exception keeps it on; the logs show the truth.
- Application grants: export every application and service principal with mail permissions, the permission type (delegated or application), who consented and when (MAIL-05). See the SaaS and OAuth App Governance Guide.
- Admin audit log: pull mail flow rule, role assignment and permission change events for the quarter and join them to change records (MAIL-06, MAIL-07).
- DNS and reports: query the published DMARC, SPF and DKIM records for every domain you own and summarise the quarter's aggregate reports (MAIL-03). Take the domain list from the registrar account, not from the mail platform, so parked domains are included.
Collect with a read-only administrative role, record the query, time window and record count for each export, and keep the raw files with the workbook. Check retention before you start: if logs older than your retention period are gone, record that rather than reporting a clean quarter.
Red flags that need action now
- An inbox rule that forwards to an external address and moves or deletes the original, the classic sign of business email compromise.
- A user-consented application with permission to read every mailbox.
- A successful legacy-protocol sign-in to any account with an administrator role.
- A new mail flow rule that blind copies messages to an outside address or bypasses filtering, with no change record.
- A shared or service mailbox with interactive sign-ins from unfamiliar locations.
- A full access or send-as grant to an account in another organisation.
- Mailbox auditing switched off, or retention shorter than your investigation window.
- A primary sending domain whose DMARC policy has been lowered back to monitoring.
If a red flag points to an active intruder, stop the review and follow the Business Email Compromise Response Playbook.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-MAIL-01 | [Number] mailboxes forwarding externally without exception | MAIL-01 | [Critical / High / Medium / Low] | [Name, role] | [YYYY-MM-DD] | [Open / In progress / Closed / Risk accepted] |
| HC-MAIL-02 | [Number] applications with unscoped mail read permission | MAIL-05 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-MAIL-03 | [Finding] | [MAIL-nn] | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
Suggested severity: red on MAIL-01, MAIL-05, MAIL-06 or MAIL-08 is critical with a 30-day due date (same day for a suspected intruder); other reds are high at 60 days; ambers are medium at 90 days.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| External forwarding and hiding rules (MAIL-01) | How to Audit Mailbox Forwarding and Inbox Rules |
| Legacy protocols (MAIL-02) | Legacy Authentication and ROPC Retirement Guide |
| DMARC not enforced (MAIL-03) | DMARC, SPF and DKIM Guide; Email Authentication Checklist |
| Shared mailbox sign-in (MAIL-04) | How to find shared mailboxes and service mailboxes with sign in enabled |
| App permissions to mail (MAIL-05) | Consent Phishing and Illicit OAuth Grants Guide; AI Agent Email Access Security |
| Transport rule drift, admin count (MAIL-06, MAIL-07) | Email Security Guide |
| Audit gaps (MAIL-08) | SaaS Audit Log Retention and Licensing Guide |
| Delegated access (MAIL-09) | How to Audit Mailbox Forwarding and Inbox Rules, hardening section |
Framework mapping
| Metric | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|
| MAIL-01 | SC-7 Boundary Protection; AU-6 Audit Record Review | DE.CM-03 | T1114.003 Email Forwarding Rule; T1564.008 Email Hiding Rules |
| MAIL-02, MAIL-04 | IA-5 Authenticator Management; AC-2 Account Management | PR.AA-01 | T1078.004 Cloud Accounts |
| MAIL-03 | SI-8 Spam Protection | PR.PS-04 | Not applicable |
| MAIL-05 | AC-6 Least Privilege | PR.AA-05 | T1528 Steal Application Access Token |
| MAIL-06 | CM-3 Configuration Change Control | PR.PS-04 | T1114.003 Email Forwarding Rule |
| MAIL-07, MAIL-09 | AC-6(7) Review of User Privileges | PR.AA-05 | T1098.002 Additional Email Delegate Permissions |
| MAIL-08 | AU-2 Event Logging | PR.PS-04 | Not applicable |
In CIS Controls v8.1 these fall mainly under Control 9 (Email and Web Browser Protections), Control 5 (Account Management) and Control 8 (Audit Log Management). NIST SP 800-177 Rev. 1 Trustworthy Email covers the domain authentication and transport security behind MAIL-03.
Related guides
- How to Audit Mailbox Forwarding and Inbox Rules: the step by step rule hunt this check measures.
- Email Security Maturity Model: where repeatable platform measurement sits.
- Identity Security Metrics Guide: reporting mailbox identity metrics alongside the rest of IAM.
- Business Email Compromise Response Playbook: response when findings point to an intruder.
- Top 10 Email Security Threats: the threats behind each metric.
References
- NIST: SP 800-177 Rev. 1 Trustworthy Email
- IETF: RFC 9989 Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls Version 8.1
- MITRE ATT&CK: Email Forwarding Rule
- MITRE ATT&CK: Additional Email Delegate Permissions
Related NHI Mgmt Group resources: Email Security Policy Template, Email Archiving and Journaling, CIS Control 9 Email and Web Browser Protections Guide.