Security
A Basic Security Checklist for Google Workspace Admins
Quick Answer
A basic Workspace security review covers 2-Step Verification enforcement, admin account recovery options, DKIM/DMARC configuration, and a periodic audit of active user accounts and their access levels.
Security configuration in Workspace is not a single switch - it is a set of related settings across authentication, email, and user management that work best reviewed together periodically.
Common Causes
- Admin recovery options left outdated after staff changes.
- Former employees' accounts still active with access long after they left.
- DKIM/DMARC treated as an email deliverability issue only, when it is also a security one (preventing spoofing).
Safe Troubleshooting Steps
- Confirm 2-Step Verification is enabled, at minimum for admin accounts.
- Review and update admin account recovery options.
- Confirm SPF, DKIM and DMARC are configured to reduce spoofing risk.
- Periodically review active users and remove or suspend accounts no longer needed.
What to Verify
- Admin accounts have current, correct recovery information.
- DKIM and DMARC are both configured, not just SPF.
- No former employee retains active account access.
When Professional Help May Be Useful
A periodic outside review of these settings can catch gaps that build up gradually, like a recovery email pointing to a former employee's personal account.