The BSI report scores free email providers based on their security measures they implement.

Protection for the sending address:

• SPF
• DKIM
• DMARC

Measures for confidentiality and integrity:

• DNSSEC
• DANE
• TLS version

Other measures:

• Disable insecure TLS versions
• MTA-STS
• TLS-Reporting

The DKIM validator websites provides a randomized email address. You can send an email to this address to get a report of the senders email security protocol. The website reports on DKIM, SPF, and a plain SpamAssassin result.

When migrating between different email providers you might want to migrate your existing emails between the two provider mailboxes. As prerequisite the mailbox setup for the new mailbox provider should be done and credentials for both mailboxes. The tool imapsync provides the capability to connect to two IMAP mailboxes and copy emails and folder structures. Depending on the arguments, duplicates can be detected, transformations applied, or the data copied to a subfolder. The last option is particularly interesting if you want to backup emails from one mailbox to another.

imapsync \
    --host1 '<host_src>' \
    --port1 '<port_src>' \
    --user1 '<user_src>' \
    --password1 '<passwd_src>' \
    --host2 '<host_dst>' \
    --port2 '<port_dst>' \
    --user2 '<user_dst>' \
    --password2 '<passwd_dst>' \
    --delete2duplicates

The option --delete2duplicates ensures that the command can be run multiple times during the migration without creating duplicate emails in the destination system.

When interfacing with Outlook special care must be taken. Outlook does not offer a normal IMAP interface, but instead requires their own OAuth2 on top. This is not supported by imapsync. Instead, you can setup email-oauth2-proxy to interface with Outlook and use localhost+port for imapsync.

You can install and run email-oauth2-proxy like:

python -m pip install "emailproxy[gui]"
python -m emailproxy

Configuration is done via the emailproxy.config file (see sample):

[Account setup]

[[email protected]]
permission_url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/common/oauth2/v2.0/token
oauth2_scope = https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access
redirect_uri = http://localhost
client_id = *** your client id here ***
client_secret = *** your client secret here ***

Configure each email mailbox behind Outlook with one of these entries. Go to https://entra.microsoft.com/ and log in with enough permissions to create new App Registrations. Create a new registration and pick any name. Make sure to select as "Supported account types" the most widespread option "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)" and as "Redirect URI" select Web with "http://localhost/. Edit the App Registration and under "Certificates & secrets" create a new secret that you add to the above configuration in place of the client_id and client_secret.

Now when imapsync runs a prompt by email-oauth2-proxy will appear. Open the request and use the browser to login to the mailbox.

The German BSI has some notes on performing an email migration at https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Onlinekommunikation/E-Mail-Sicherheit/Wechsel-E-Mail-Anbieter/Wechsel-E-Mail-Anbieter_node.html.

Ben Hardill reviews the DNS records that support email security and deliverability for hardill.me.uk. The post explains SPF, DKIM and DMARC as TXT records and gives concrete examples. It shows MX records for mail routing and options for client auto-configuration using SRV or .well-known. It covers MTA-STS (TXT + HTTPS file) to enforce TLS for inbound delivery and TLS-Reporting for telemetry. The author demonstrates parsing DMARC reports (zipped XML) with parsedmarc and a visualizer to inspect compliance. Practical tips include SPF syntax, DKIM selectors, DMARC rua reporting, and the t=s flag for subdomains.

Hardenize is a domain hardening checker that covers various aspects. It checks for the presence of basic security extensions and protocols for DNS, email, and web content. This covers such aspects as DNSSEC and CAA records for DNS, email encryption and security like SPF, DMARC, and DANE, and for the web valid certificates and security headers like HSTS or CSP.