Email Etiquette Tips for Employees

Good email etiquette at work comes down to three habits: send it only to the people who need it, make it easy to act on, and never put in an email what an attacker or a competitor would love to read. Everyone sends email; few were ever taught how, and the mistakes cost time, goodwill and, increasingly, security. This article, first published in 2024 and updated in September 2026, covers the etiquette that keeps colleagues happy and the habits that keep the company out of trouble.

Reply-all, CC and BCC

Reply-all only when everyone on the thread needs your answer. A dozen people receiving “Thanks!” is a small tax on the whole office, and a long reply-all argument is a large one. CC people who need to be informed but not to act, and say why in the first line. BCC is for large distribution lists, so recipients cannot see each other’s addresses or reply-all to the whole list; using it to secretly copy someone into a conversation is a good way to be caught out when they reply. Never copy the entire company on anything without a reason a manager would agree with.

Subject lines and length

The subject line is the summary: “Invoice 4471 approved” beats “Re: Re: Fwd: question”. Put the request or the decision in the first sentence and the background after it. Keep it short; if it needs five paragraphs, it probably needs a call or a meeting. Write in sentences with ordinary capitalization; all capitals reads as shouting, and no capitals reads as a text message.

Tone

Email has no tone of voice, so sarcasm, irony and jokes about colleagues land badly and live forever. Assume anything you write may be forwarded, quoted in a dispute or read aloud in a meeting. If you are angry, wait an hour. Praise in writing; criticize in person.

“Did you get my email?”

Calling to ask defeats the purpose of sending it. Agree expectations instead: a same-day reply for internal mail, an acknowledgement within a business day for customers, and a flag or a call for anything genuinely urgent. If something is urgent, say so in the subject and then call.

Attachments and links

For anything that will be edited, or anything larger than a few megabytes, send a link to the file in SharePoint or OneDrive rather than the file itself. Everyone works on one copy, you can see who has access and remove it, and nobody ends up with the eighth version of a spreadsheet in their inbox. Check attachments before sending: the wrong file, or the right file with the wrong client’s data, is a breach.

Sensitive information

Do not email passwords, Social Security numbers, card numbers, bank details, medical information or anything you would not want on a billboard. Email is copied to several servers, forwarded without your knowledge and read by anyone who gets into a mailbox, which is exactly what attackers do. Use a secure sharing link, a password manager’s sharing feature, or the phone. If a customer emails you theirs, use it and delete it. Compliance rules such as HIPAA and PCI treat email as insecure for good reason, and our guide to encryption explains what protects data at rest and in transit.

External senders and unexpected requests

This is the etiquette rule that is also a security rule. Any email that is unexpected, urgent, and asks for money, gift cards, a password, or a change of bank or payroll details deserves a phone call to a number you already have, however genuine it looks. Attackers copy real names, signatures and previous threads, and a message from “the boss” who “cannot talk right now” is the classic. Hover over links before clicking, do not open attachments you were not expecting, and report anything odd to IT rather than deleting it quietly. Our phishing quiz shows how convincing the fakes are, and what is social engineering explains the tactics.

Personal accounts and forwarding

Do not forward work mail to a personal account, and do not send work documents to one to “work on at home”. It moves company data outside the company’s security and backups, it usually breaks policy and sometimes the law, and it is the most common way people leave a job with data they should not have. Use the phone app for work email instead. Preventing data theft covers the employer’s side of this.

Out of office, signatures and threads

Set an out-of-office message with the date you are back and who to contact, and keep it free of detail an attacker could use. Use the company signature with your name, role and phone number and nothing else. Reply within the thread rather than starting a new one, and change the subject when the topic changes. Archive instead of deleting; you will need it, and a well-run mailbox is searchable.

When to stop emailing

After the third reply on a disagreement, after any misunderstanding, and for anything emotional or complicated, pick up the phone or open Teams. Two minutes of conversation replaces twenty emails, and the relationship survives.

Common questions

When should I use reply-all?

Only when every person on the thread needs your answer to do their job. If the reply is for one person, reply to that person. If you are unsure, it is almost always the smaller group.

What is the difference between CC and BCC?

CC copies people visibly, so everyone knows who is informed. BCC copies people invisibly. Use BCC for large distribution lists so recipients cannot see or reply-all to each other, and never use it to secretly copy someone into a conversation; forward the message afterwards instead.

Is it safe to email a password or an account number?

No. Email is stored in several places, forwarded without your knowledge and read by attackers who get into a mailbox. Share sensitive information through a secure link, a password manager, or by phone. If a customer emails you theirs, delete it once it is used.

How do I tell whether an email request is genuine?

If it is unexpected, urgent, involves money, gift cards, credentials or a change of bank details, or comes from a boss who “cannot talk right now”, verify it by phone using a number you already have, not one in the message. Attackers copy real names and signatures precisely.

Should I send attachments or links?

Links to the file in SharePoint or OneDrive, for anything that will be edited or is larger than a few megabytes. Everyone works on one copy, you can revoke access, and nobody ends up with version seven of a spreadsheet in their inbox.

Can I forward work email to my personal account?

No. It moves company data outside the company’s security and its backups, it usually breaks policy and sometimes the law, and it is the most common way former employees leave with data they should not have. Use the phone app for work mail instead.

Talk to us

Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.