How to Secure Business Email from Phishing Attacks

Layer 1: Email authentication (SPF, DKIM, DMARC)

SPF, DKIM, and DMARC tell other mail systems which servers are allowed to send email on your behalf. Without them, attackers can spoof your domain. Publish SPF listing your legitimate senders, enable DKIM signing in Microsoft 365, and move DMARC from p=none to p=quarantine, then to p=reject once monitoring is clean.

Layer 2: MFA and Conditional Access

Even if a phishing email successfully captures a password, MFA blocks the sign-in. Enforce MFA on every mailbox, disable legacy authentication protocols, and use Conditional Access to require compliant devices or trusted locations for admin sign-ins.

Layer 3: Anti-phishing and impersonation policies

• Customize Microsoft Defender anti-phishing to protect your executives by name and your domains
• Enable Safe Links to rewrite URLs and detonate them at click time
• Enable Safe Attachments to sandbox unknown attachments
• Turn on external-sender mail tips so recipients see clear 'external' warnings

Layer 4: Endpoint and browser protection

Modern endpoint protection blocks known phishing infrastructure and malicious downloads. Managed Windows updates, browser hardening, and application-control policies stop the payload even when someone clicks.

Layer 5: Staff training and simulated phishing

Training only sticks when it's ongoing. Run monthly simulated phishing campaigns paired with brief training for staff who click. Report-a-phish buttons in Outlook let staff flag suspicious messages with one click and give your MSP a feedback loop.

Layer 6: Response plan

• Documented steps for suspected compromised mailbox
• Ability to revoke sessions, force password reset, and re-register MFA quickly
• Mailbox audit logs enabled and reviewable
• Named incident contact your MSP or in-house owner

Common mistakes

• Publishing SPF but never enabling DKIM or moving DMARC past p=none
• Enforcing MFA for admins only
• Leaving anti-phishing at Microsoft's default policy with no executive impersonation protection
• One-off annual phishing training instead of monthly simulations
• No documented response plan for when (not if) a mailbox is compromised

When to call an IT provider

Email security is the single highest-ROI area of cybersecurity investment. An MSP can implement all six layers in a matter of weeks, and then run the ongoing monitoring, training, and response that a small business rarely has capacity for internally.

Frequently asked questions