Since e-mail infrastructures can be highly complex, the many possible settings and interdependent parameters involved may cause numerous security issues.

For example, an e-mail server may reject legitimate e-mails from other servers due to a faulty configuration. Essential settings (e.g. transport encryption of e-mails) can also be ignored or disregarded.

Furthermore, incorrect configurations in e-mail clients can lead to them executing malicious code in e-mails. These vulnerabilities can significantly impact the availability, integrity, and confidentiality of information.

Many organisations fail to use security mechanisms that enable e-mail servers in other organisations to check whether an e-mail is actually from the specified sender. An incorrectly set e-mail server can also be misused by attackers to send spam e-mails.