How Remote Work Changed the Threat Surface

When the majority of an organization's email users worked in an office building, the threat model was relatively contained. Corporate networks had firewalls, managed switches, centralized DNS, and IT staff nearby. Devices were company-owned and managed. Suspicious behavior on the network was more visible. There was a defined perimeter, and security teams spent a lot of effort defending it.

Distributed work dismantled that perimeter. Today, the same employee might be on a home broadband connection from a consumer ISP, accessing their work email on a personal laptop that also runs games and browser extensions with questionable provenance. The home router probably has not been patched since it was installed. Their network is shared with family members, smart TVs, and other devices the IT team has no visibility into.

This creates specific email security problems. Consumer ISPs have widely varying security postures. Some are vigilant about abuse; many are not. An employee on a home connection may receive email through a different network path than they would in the office, making IP-based anomaly detection less reliable. Outbound email from a home network may trigger spam filters at receiving servers because residential IP ranges are frequently blocklisted.

The expansion of contractor and vendor relationships also increased email risk. Remote-first companies tend to work with more external parties: freelancers, SaaS vendors, consultants. Each of these represents an email thread that crosses the organizational boundary, and each is a potential vector for spear phishing or malicious attachments. An attacker who compromises a small vendor's email account can send highly credible phishing messages to everyone that vendor has a relationship with.

Why Spammers and Phishers Target Remote Workers Specifically

Attackers are rational. They target the weakest point of the system. In most organizations today, that weak point is the distributed employee on a home network, not the hardened corporate server in a datacenter.

Remote workers are more likely to act quickly on urgent-seeming emails without verifying them. In an office, an employee who receives an email purportedly from the CFO asking for a wire transfer can walk down the hall and ask. Working from home, that friction disappears. The email is the primary communication channel, and it feels more authoritative when there is no alternative to verify against.

Remote workers also tend to have less immediate access to IT support. A suspicious email in an office often results in a quick question to a nearby colleague or a walk to the help desk. Remote workers are more likely to either ignore the concern or, worse, try to handle it themselves — sometimes by clicking the link to see if it is legitimate.

Spear phishing — targeted attacks that impersonate known contacts — is particularly effective against distributed teams. The attacker can study a company's public-facing communications, identify the CEO and CFO by name, learn the company's vendors from LinkedIn, and craft a convincing impersonation with very little effort. The lack of in-person context makes these impersonations harder to detect.

How Proxy-Based Filtering Helps Distributed Teams

The key advantage of a proxy-based spam filter like Spam Killer is that it is completely location-agnostic. The proxy sits in front of your mail server at the MX level. It does not matter whether your employees are in an office, a home, a coffee shop, or on another continent — all inbound mail passes through the proxy before it ever reaches your server. The filtering happens in one centralized place, regardless of where the recipients are.

This is a significant architectural advantage compared to client-side filtering. Client-side spam filters (rules built into Outlook, mail client plugins, etc.) have to be deployed, updated, and maintained on every individual device. When an employee gets a new laptop or switches mail clients, the filter configuration may not carry over. With a proxy filter, the protection is at the server level and applies universally.

For remote teams specifically, this means you can provide consistent protection across a workforce that might span dozens of countries, operating on different devices, different networks, and different mail clients. The filter does not need to know or care about any of that.

SPF and DKIM: Protecting Your Domain from Being Weaponized

While proxy filtering protects your employees from inbound threats, SPF and DKIM protect your organization's domain from being used against others — and against your own people.

Business email compromise attacks frequently work by spoofing a company's domain. An attacker sends an email that appears to come from ceo@yourcompany.com to your finance department, requesting a wire transfer or credential submission. Without proper SPF and DKIM records, this spoofing is trivially easy: any mail server can send a message with any From address.

Publishing a strict SPF record that designates your authorized sending servers, and enabling DKIM signing on all outbound mail, makes these attacks much harder. Receiving mail servers that check SPF and DKIM will flag or reject messages claiming to be from your domain but sent from unauthorized servers. This protects both your recipients and your employees — a spoofed email claiming to be from your CEO is far less convincing when it fails SPF checks and gets flagged or rejected before it reaches the inbox.

For remote teams with employees who sometimes send email from personal devices or third-party tools, keeping SPF records accurate is especially important. A common mistake is adding a new SaaS email tool (a marketing platform, a helpdesk system) without updating the SPF record, resulting in legitimate outbound mail failing authentication at the receiving end.

Greylisting Is Location-Agnostic by Design

Greylisting works by temporarily deferring mail from senders on their first delivery attempt to a given recipient. Legitimate mail servers always retry; one-shot spam engines typically do not. This technique is effective regardless of where the sender's server is located, what network the recipient is on, or how many remote employees an organization has.

From the perspective of a distributed team, greylisting is transparent. Users may notice a short delay (usually a few minutes) the first time they receive mail from a new sender. After that, the sender's server is recognized and mail flows normally. The tradeoff is worth it: greylisting eliminates a significant fraction of bulk spam without any false positives from legitimate senders who retry normally.

Practical Recommendations for Remote Organizations

Security is most effective when the controls require no behavior change from end users. These recommendations focus on infrastructure-level protections that work regardless of what your employees do:

  • Enforce SPF with a hard fail (-all) or at minimum a soft fail (~all). This signals to receiving servers not to accept mail claiming to be from your domain unless it comes from authorized sources. Audit your SPF record every time you adopt a new email-sending service.
  • Enable DKIM signing for all outbound mail. This cryptographically ties your messages to your domain and prevents tampering in transit. Rotate DKIM keys annually or after any suspected compromise.
  • Use greylisting at the proxy. It is free, effective, and transparent to users after the first delivery from each sender.
  • Set up per-sender whitelisting for known vendors. If you receive time-sensitive transactional email from a vendor (invoices, contract signatures, order confirmations), whitelist their sending domain or IP to skip greylisting and minimize filtering friction.
  • Train employees to recognize phishing signs. No technical control is a substitute for a workforce that can identify an impersonation attempt. Focus training on high-risk scenarios: urgent financial requests, login prompts from unexpected senders, and emails claiming to be from internal leadership.
  • Alert on SPF and DKIM failure spikes. A sudden increase in SPF failures from your own domain often means someone is actively trying to spoof it. Monitor this metric and investigate promptly.

The combination of proxy-based filtering, strong sender authentication, and greylisting gives remote organizations a security posture that is at least as strong as a traditional on-premises setup — and in some ways more consistent, because the protection applies equally to every employee regardless of where they are.