Key concepts
The guide covers signing and encrypting messages, planning and hardening mail servers, content filtering, network infrastructure for mail, mail clients and server administration. It assumes an on-premises mail server.
How it is organized
- Background and standards
- Signing and encrypting email (OpenPGP, S/MIME)
- Planning and managing mail servers
- Securing the server operating system and application
- Secure network infrastructure
- Securing mail clients
- Administering the mail server
What a school district should take from it
- Most districts now use hosted email, so the server-hardening chapters rarely apply.
- Use this guide only if the district still runs its own mail server.
How to use it in your district
- If you run an on-premises mail server, use the hardening and administration chapters as a checklist.
- Plan a move to hosted email if the server is hard to keep patched.
- Otherwise, follow SP 800-177 Rev. 1 for domain authentication and transport security.
Common misconceptions
- Final means current best practice.
- It is still final on CSRC, but it is from 2007; newer guidance covers today's threats.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- PR.PSPlatform Security
Tools in the program portal
- Domain healthEmail authentication (SPF, DKIM, DMARC) checks
Related publications
- SP 800-177 Rev. 1Email authentication: SPF, DKIM and DMARC
Citation and source
SP 800-45 Version 2, Guidelines on Electronic Mail Security. National Institute of Standards and Technology. 2007. https://doi.org/10.6028/NIST.SP.800-45ver2.
Replaces: SP 800-45 (2002).
Topics: Email security. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.