Skip to main content

Email Security and Phishing

Email Security and Phishing

Adapted from GitLab's Phishing Program and Email Security Standards.

Email is the most common way into an organisation: phishing pages steal passwords, attachments install malware, and fake invoices or "urgent" requests trick people into paying.

How to spot phishing

  • Urgency or fear: "your mailbox will be deleted today", "invoice overdue", "account suspended".
  • Login links: "verify your account", "storage full", "shared document". NFE systems never ask you to log in from an email link. Open nextcloud.nearlyfreeenergy.com yourself.
  • Mismatched sender: a display name that says "Nextcloud Admin" but a strange address, or a Reply-To that differs from From.
  • Unexpected attachments: .html, .htm, .zip, .iso, .exe, Office files asking to "enable content".
  • Money or gift-card requests, even from a colleague's name. Confirm by phone or Talk.
  • Grant, loan and "funding" offers that ask for fees or personal details.

What to do

You... Do this
Got a suspicious email, didn't interact Forward it as an attachment to the Security DRI or post in Talk, then move it to Junk
Clicked a link but entered nothing Report it (S3). Close the tab. Run a malware scan
Entered your password, opened an attachment or replied Urgent: change your password from a trusted device, then follow the Leaked Credentials Runbook
See bounces for mail you didn't send Urgent: your account is probably sending spam. Report immediately

Domain protections (nearlyfreeenergy.com)

Checked October 2026:

  • SPF: -all (strict), covering our server and the Federated Computer relays. Has some duplicate entries to tidy.
  • DKIM: selector mail, published.
  • DMARC: p=quarantine; sp=none, with reports to admin@. Target: p=reject; sp=reject once reports look clean.

These stop other people forging our domain. They don't stop someone who has a real NFE password: that mail is genuinely signed. So account protection (2FA, unique passwords, rate limits) matters most.

Training

Phishing awareness is part of onboarding. The Security DRI may run occasional practice phishing emails. If you report them, great; if you click, you'll get a short refresher, with no blame.

No comments to display

Back to top