12 Best Practices for Email Signature Security
July 8, 2026
A signature is a trusted-looking block of HTML that appears at the bottom of every message your company sends. That makes it useful to you — and interesting to anyone impersonating you.
Signature security rarely gets its own review. These twelve practices cover the realistic risks: impersonation, credential harvesting through look-alike links, data leakage, and the quieter problem of employees editing their own templates into something unverifiable.
Control who can change the template
1. Manage signatures centrally, not per device. If every employee can edit their own signature, you cannot state with confidence what your company’s outbound mail looks like — which means you cannot tell staff or customers how to spot a fake.
2. Keep an approved-template inventory. A short list of the templates in use, with owners and last-review dates. Anything not on the list is drift.
3. Restrict local editing. Where your platform allows it, lock the signature so it cannot be modified on the client side. This is the control that makes the others enforceable.
Make links verifiable
4. Use full, plain destinations. Avoid URL shorteners in signatures. A shortened link is unverifiable by eye, and it trains recipients to click links they cannot inspect — which is precisely the habit phishing relies on.
5. Keep link text and destination consistent. If the text says your domain, the link must go to your domain. Mismatches are flagged by security tooling and erode trust when a recipient hovers.
6. Limit the number of links. Three or four. Every extra link is another thing to audit and another opportunity for a stale destination to be re-registered by someone else.
Host images and assets properly
7. Serve images from a domain you control, over HTTPS. Third-party or free image hosts can change, expire, or serve different content later. Your logo should not be someone else’s to modify.
8. Do not embed tracking that you would not disclose. If your signature contains open or click tracking, make sure it is covered by your privacy notice. This is a compliance question as much as a security one.
Reduce what the signature gives away
9. Publish less personal data than you think you need. Direct mobile numbers, internal extension patterns, and detailed job titles are useful to attackers building a social-engineering pretext. A department number and a name is often sufficient.
10. Be careful with organisational hints. “Executive Assistant to the CFO” tells an attacker exactly who to impersonate and who to target for a payment-redirection attempt.
Support the technical controls
11. Make sure SPF, DKIM, and DMARC are in place — and that your signature tooling does not break them. Any system that rewrites messages in transit to append signatures must be configured so the results still authenticate. A signature deployment that quietly breaks DKIM alignment turns your legitimate mail into suspicious mail.
12. Give staff and customers a way to verify. Publish what your official signature looks like, and state clearly what you will never do in an email — for example, never send bank-detail changes. A signature is a good place to carry that one-line notice.
What a signature cannot do
It is worth being direct about the limits. A signature is not an authentication mechanism. Anyone can copy your HTML, and a convincing visual signature on a spoofed message proves nothing. The value of the practices above is that they keep your legitimate mail consistent and technically well-formed, so that authentication controls work and so that anomalies are easier to notice.
If you want recipients to be able to prove a message came from you, that is a job for DMARC enforcement and, for high-value correspondence, message signing — not for the block at the bottom.
A quarterly checklist
- Every link in every live template resolves to a domain you still own.
- Every image loads over HTTPS from your infrastructure.
- DKIM still aligns on a sample of outbound mail.
- Sampled employee mail matches an approved template.
- Leavers’ signatures no longer appear on any shared mailbox.
Twenty minutes, four times a year. It is one of the better security-to-effort ratios available.