---
title: "Email security · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-security
updated: 2026-10-20
licence: "All rights reserved"
---

# Email security

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Keep attackers away from your recipients and readers. Send safe links, single-use sign-in links and no secrets, scripts or risky files, and resist phishing.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security`.

## Required

- [Never let visitors pick who gets your mail](https://agentwranglers.se/playbook/email/email-security/fixed-recipients): Forms that send email must never let a visitor choose the recipient or write the message others receive. Limit how much mail any one address can trigger.
- [Send only links people can trust](https://agentwranglers.se/playbook/email/email-security/safe-links): Use HTTPS links on your own domain, and make the visible text match where each link goes. Never use public link shorteners.
- [Make your mail hard to fake](https://agentwranglers.se/playbook/email/email-security/phishing-resistance): Never ask for a password, code or payment detail by email. Send from the same domains and addresses every time, so fakes stand out.
- [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/email/email-security/sign-in-links): A link that signs someone in or resets a password works once, expires within an hour, and holds a long random token. A sign-in code expires within 15 minutes.
- [Keep secrets out of email](https://agentwranglers.se/playbook/email/email-security/no-secrets-in-email): Never send passwords, full card numbers, ID numbers or API keys by email. Email is stored in many places and is hard to delete.

## Recommended

- [Avoid risky attachments](https://agentwranglers.se/playbook/email/email-security/safe-attachments): Send only document types that are safe to open, such as PDF and images. Link to a signed-in download for anything private or large.

## Optional

- [Sign or encrypt sensitive mail](https://agentwranglers.se/playbook/email/email-security/signed-encrypted-mail): For mail that must stay private or be provably yours, sign or encrypt it with S/MIME or OpenPGP.

## Avoid

- [Send no scripts or forms in email](https://agentwranglers.se/playbook/email/email-security/active-content): Do not put scripts, forms, embedded frames or plugins in email. Mail apps strip or block them, and they look like attacks.

- Previous: [Email privacy](https://agentwranglers.se/playbook/email/email-privacy)
- Next: [Automation and agents](https://agentwranglers.se/playbook/email/automation-and-agents)
- [All chapters](https://agentwranglers.se/playbook/email)