Performing Email Migration Security

name: performing-email-migration-security description: >- Secure email platform migrations including tenant-to-tenant moves, on-premises to cloud transitions, and cross-platform migrations. Covers data protection during transfer, authentication continuity, encryption key management, and post-migration security validation. domain: cybersecurity subdomain: email-security tags: - migration - tenant-migration - data-protection - encryption - authentication - cloud-security version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1114", "T1530"] tools: [python3, powershell, openssl, curl]

Performing Email Migration Security

Overview

Email migrations are high-risk windows where data protection controls may lapse, authentication chains break, and encryption keys require careful transfer. Security assessment before, during, and after migration ensures continuity of email authentication (SPF/DKIM/DMARC), data-in-transit protection, retention policy preservation, and access control integrity.

Prerequisites

Workflow

Step 1: Pre-Migration Security Assessment

from typing import Any

def pre_migration_checklist(source: str, target: str) -> dict[str, Any]:
    checks = {
        "spf_record_documented": False,
        "dkim_keys_exported": False,
        "dmarc_policy_recorded": False,
        "retention_policies_mapped": False,
        "legal_holds_identified": False,
        "admin_accounts_audited": False,
        "mfa_enforced_target": False,
        "encryption_at_rest_target": False,
        "conditional_access_planned": False,
        "third_party_integrations_listed": False,
    }
    return {
        "source": source,
        "target": target,
        "checklist": checks,
        "status": "incomplete",
    }

Step 2: Validate Data-in-Transit Protection

# Verify TLS on source SMTP
openssl s_client -connect mail.source.com:587 -starttls smtp 2>/dev/null | \
  grep -E "(Protocol|Cipher|Server certificate)"

# Verify TLS on target SMTP
openssl s_client -connect mail.target.com:587 -starttls smtp 2>/dev/null | \
  grep -E "(Protocol|Cipher|Server certificate)"

# Check migration tool uses encrypted channel
# Verify no plaintext IMAP (port 143) — only IMAPS (993)
nmap -p 143,993,587,465 mail.source.com --script ssl-enum-ciphers

Step 3: DNS Cutover Security

# Document current records BEFORE cutover
dig MX example.com +short > pre_migration_mx.txt
dig TXT example.com +short | grep "v=spf1" > pre_migration_spf.txt
dig TXT _dmarc.example.com +short > pre_migration_dmarc.txt
dig TXT selector1._domainkey.example.com +short > pre_migration_dkim.txt

# Post-cutover — verify new records propagated
dig MX example.com +short
dig TXT example.com +short | grep "v=spf1"

# Lower DMARC to monitor during transition
# v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100
# Then progressively enforce: none -> quarantine -> reject

Step 4: Post-Migration Security Validation

# Verify MFA enforcement on target tenant
Get-MgUser -All | Where-Object { $_.StrongAuthenticationMethods.Count -eq 0 } |
  Select-Object UserPrincipalName

# Verify retention policies migrated
Get-RetentionPolicy | Select-Object Name, RetentionPolicyTagLinks

# Verify no orphaned mailbox permissions
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission |
  Where-Object { $_.User -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false }

# Verify conditional access policies active
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State

Detection Opportunities

title: Email Migration Security Detection
id: 06cc5a6e-6311-4250-86af-0ab67f287554
status: experimental
description: Detects suspicious activity related to performing email migration security techniques in email security context
logsource:
  category: email
  service: exchange
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: medium
tags:
  - attack.t1114
  - attack.t1530
  - attack.initial_access
falsepositives:
  - Bulk email migration by authorized IT administration tools

Verification

• Pre-migration DNS records documented and backed up
• TLS verified on source and target SMTP endpoints
• DKIM keys regenerated or transferred to target
• SPF updated to include target mail servers
• DMARC policy in monitor mode during transition
• MFA enforced on all target mailboxes
• Retention policies and legal holds preserved
• Post-migration authentication records enforce reject

References

• Microsoft — Cross-tenant mailbox migration
• NIST SP 800-177 — Trustworthy Email

v1.0 | Validated: 2026-03-18