Phishing is the use of deceptive email to steal credentials, money, or data. Defense combines domain authentication, inbound filtering, user training, and rapid reporting.
What good looks like#
- Done: Enforce DMARC p=reject so exact-domain spoofing fails.
- Done: Register lookalike domains or monitor them for registration.
- Done: Enable link rewriting and attachment sandboxing at the gateway.
- Done: Run quarterly simulations and make reporting a one-click action.
- Done: Apply BIMI so users learn what authentic mail looks like.
What bad looks like#
- Seen in audits: Blaming users while leaving the domain unprotected.
- Seen in audits: Allow-listing vendors broadly, which bypasses filtering.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
Does DMARC stop all phishing?
It stops exact-domain spoofing. Lookalike domains and display-name spoofing require additional controls.