Credential hygiene, mailbox access, account protection, and provider security practices.
Use app passwords or OAuth where supported. Never reuse personal account passwords for SMTP.
Rotate mailbox passwords and API tokens periodically or immediately after team changes.
Remove old mailboxes and verify the active sender identity before high-volume campaign sends.