Do you advocate setting up something like google authenticator (RFC6238 I think?)if you run your own email server or does it make more sense to use client side SSL certificates for that?
So as far as security for email goes you prefer people to outsource to Google Apps or similar rather than likely screwing up and having an insecure configuration?
Just curious what you consider best practices to be in that case.