The one-sentence version#
Phishing is the use of deceptive email to steal credentials, money, or data. Defense combines domain authentication, inbound filtering, user training, and rapid reporting.
Why you should care#
Phishing remains the leading initial access vector in breaches. Domain owners also bear brand damage when their name is spoofed.
The mental model#
Think of phishing protection as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.
Your first setup, step by step#
- Enforce DMARC p=reject so exact-domain spoofing fails.
- Register lookalike domains or monitor them for registration.
- Enable link rewriting and attachment sandboxing at the gateway.
- Run quarterly simulations and make reporting a one-click action.
- Apply BIMI so users learn what authentic mail looks like.
Words you will see#
- Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
- Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
- Reputation: the provider's running score of your domain and IP.
- Placement: whether a message reaches the inbox, spam, or is rejected.
Common mistakes#
- Blaming users while leaving the domain unprotected.
- Allow-listing vendors broadly, which bypasses filtering.
Frequently asked questions#
Does DMARC stop all phishing?
It stops exact-domain spoofing. Lookalike domains and display-name spoofing require additional controls.