Article contents
Company email is protected from phishing in two layers: technical settings stop others from forging your domain and filter out dangerous messages, and simple rules for people stop what gets through the filters. Neither layer works alone: filters let some messages pass, and a person cannot study every email closely and still get their work done. [11]
Below is what to set up, how to check each item with free tools, what rule to give accounting, and how to train people so they report suspicious emails instead of hiding mistakes.
In short
- SPF, DKIM and DMARC are three records in DNS (the internet’s address book for your domain). They stop other servers from sending mail in your domain’s name. They are visible from outside, and checking takes a minute.
- DMARC with p=none only watches. Protection starts with p=quarantine or p=reject.
- External sender tags and link and attachment protection catch part of what gets through.
- The most expensive attacks often have no links and no malware: it is an email saying “our bank details have changed“. The rule that works against it: new bank details are confirmed by a call to a known number. [9]
- A report button and a calm response to mistakes matter more than the share of people who clicked.
Setting, what it does and how to check it
| Setting | What it does | How to check |
|---|---|---|
| SPF | A list of servers allowed to send mail from your domain | A public domain test: one record, no +all, includes all your sending services |
| DKIM | A digital signature on each email: the recipient sees it is genuine and unchanged on the way | dkim=pass in the headers of a received email; DKIM is on for your own domain in your mail service |
| DMARC | A rule telling recipients what to do with mail that fails the checks, plus reports about it | The _dmarc record of your domain: p=quarantine or p=reject, a reporting address in rua |
| External sender tag | People see that the “director” is actually writing from outside | Send yourself an email from a personal mailbox and look for the tag |
| Link and attachment protection | Links are checked at the moment of the click, attachments before delivery | Policies apply to all mailboxes, not just some |
| Bank detail check rule | A change of bank details never goes through on email alone | Ask the accountant what they would do with such an email |
| Report button | A suspicious email reaches IT within a minute | Click it on a test email and check where it arrives |
| Phishing simulations | Show where the process breaks and build the habit of reporting | Written approval, agreed scenarios, a report without names |
SPF, DKIM and DMARC in plain words
Think of your domain as company letterhead with a stamp. SPF is the list of couriers allowed to carry your letters: if someone not on the list delivers one, the recipient can see it. [1] DKIM is the seal on the envelope: it proves your server signed the letter and nobody opened it on the way. [2] DMARC is the instruction to the recipients' post offices: what to do with a letter that has neither the right courier nor the seal, and where to send reports about such letters. [3]
Without DMARC anyone can send an email in your accountant’s name to your clients, and some mail services will deliver it. The NCSC advises moving in stages: start with p=none, read the reports, set up SPF and DKIM for every service that sends in your name, then move to quarantine and reject. [4] Microsoft describes the same path for domains in Microsoft 365. [5]
How to check it yourself. Enter your domain in a free public test such as internet.nl or MXToolbox. Another way: open any email sent from your company mail to a Gmail address, choose “Show original” and find the line with the spf, dkim and dmarc results. All three should say pass.
Warning signs:
- there is no DMARC at all;
- DMARC has sat at p=none for years and nobody reads the reports: that is watching without protecting;
- two separate SPF records on one domain: under the standard this is an error, and the check does not work; [1]
- DKIM is not on for your own domain. In Microsoft 365 this is done in the Microsoft Defender portal: Email & collaboration > Policies & rules > Threat policies > Email authentication settings, the DKIM tab. [6]
Do not forget domains you never send mail from: old names, regional domains. Give them an SPF record with no allowed servers and DMARC with p=reject, so attackers cannot use them. [5]
External sender tag
A typical scenario: the “director” writes from a personal mailbox and asks for an invoice to be paid urgently. The name is right, the signature is right, and on a phone the address is hidden. An External tag next to mail from outside shows at once that something is off.
In Microsoft 365 an admin turns it on with Set-ExternalInOutlook -Enabled $true in Exchange Online PowerShell, after which Outlook shows the External tag. [7] In other mail services, look for an external sender setting or add the tag with a mail flow rule.
Link and attachment protection
A link in an email can lead to a normal page at delivery and to a phishing page an hour later. That is why a check at the moment of the click helps, not only at delivery. In Microsoft 365 this is done by Safe Links in Microsoft Defender for Office 365. [8] Attachments there are checked by Safe Attachments: it opens the file in an isolated environment (a sandbox) before delivery.
What to check: the policies apply to all mailboxes, not a test group; dangerous attachment types (executables, scripts, disk images) are blocked; users cannot release mail from quarantine themselves without IT review.
A rule for accounting: confirm bank details by voice
The most expensive phishing often has no links and no attachments. An email arrives from a supplier, sometimes from their real but compromised mailbox: “we have a new account, please pay to it“. Filters are powerless here, because the email looks like any other. The FBI specifically advises verifying changes to payment details through a different channel. [9]
Give accounting a simple written rule:
- Any change of bank details or an “urgent” payment to a new recipient is confirmed by phone.
- The number comes from the contract or the supplier record, never from the email or its signature.
- A payment above an agreed amount is approved by a second person.
- The accountant may hold a payment to check it, even if “the director insists“, and is never punished for it.
The last point matters most. Attackers push with urgency and authority, and the rule only works when people are not afraid to use it.
The report button
Someone who spots an odd email should be able to report it in one click. Outlook has a built-in Report button, and in the Microsoft Defender portal the User reported settings page sets the mailbox where those reports land. [10] Gmail has a “Report phishing” option.
What happens next is what counts. Every report gets an answer: “thanks, this one is safe” or “thanks, we removed it for everyone“. If reports disappear without a reply, people soon stop reporting.
Phishing simulations: legal and without shaming
A phishing simulation is a training phishing email a company sends to its own people to see where the process breaks. The NCSC warns plainly: no training teaches people to spot every phishing email, punishing clicks does not work and creates legal risk, so simulations should be agreed with HR. [11]
How to do it properly:
- Written approval from management listing the people, scenarios and dates. HR knows about the simulation in advance.
- No real passwords. A good simulation records only the fact that something was typed and does not store the password itself.
- A report without names for management: by department and role, not a list of “who fell for it“.
- A debrief as training: afterwards people see exactly what they should have noticed.
- The main metric is how many people reported the email and how fast, not only how many clicked.
This is how we run phishing simulations at Veiltrack: scenarios are agreed in advance, results are aggregated, and the goal is processes and learning, not finding someone to blame.
If your mail is set up and the question is what else is visible and reachable from the internet, that is work for a penetration test or a review of accounts and cloud.
Email protection checklist
Download the preparation checklist (PDF)PDF · A4
FAQ
What are SPF, DKIM and DMARC in one sentence?
SPF says which servers may send mail from your domain, DKIM signs every email, and DMARC tells recipients what to do with mail that fails those checks.
Can we set DMARC to p=reject straight away?
You can, but it is risky: mail from a CRM, a newsletter service or accounting software that you forgot to add to SPF and DKIM will start being rejected. Start with p=none for a few weeks, read the reports, fix the sources and only then tighten.
Is it legal to test employees with phishing emails?
The simulation is run in the company’s name on a written management decision, with agreed limits and with HR informed. It does not collect passwords or personal data beyond what the report needs, and the results are not used for punishment. If you have doubts about employment matters, agree the format with a lawyer.
Should we punish people who clicked?
No. Punishment teaches people to hide mistakes, and then you learn about a real attack too late. Someone who clicked and reported it right away did everything right.
Do we need a pentest if our email is set up?
Mail settings close off domain forgery and part of the harmful mail. Whether your website, customer area or API can be broken into is shown by a penetration test. These are different checks for different risks.
References
- RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 rfc-editor.org
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures rfc-editor.org
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) rfc-editor.org
- NCSC: Email security and anti-spoofing ncsc.gov.uk
- Microsoft Learn: Set up DMARC to validate email in Microsoft 365 learn.microsoft.com
- Microsoft Learn: How to use DKIM for email in your custom domain learn.microsoft.com
- Microsoft Learn: Set-ExternalInOutlook learn.microsoft.com
- Microsoft Learn: Safe Links in Microsoft Defender for Office 365 learn.microsoft.com
- FBI IC3: Business Email Compromise: The $55 Billion Scam (PSA, 2024) ic3.gov
- Microsoft Learn: Configure user reported message settings learn.microsoft.com
- NCSC: Phishing attacks: defending your organisation ncsc.gov.uk
