What phishing protection is#
Phishing is the use of deceptive email to steal credentials, money, or data. Defense combines domain authentication, inbound filtering, user training, and rapid reporting.
Why it matters#
Phishing remains the leading initial access vector in breaches. Domain owners also bear brand damage when their name is spoofed.
How mailbox providers use it#
Gmail, Microsoft, and Yahoo combine authentication results, sender reputation, and recipient engagement into a placement decision made per message. Phishing protection feeds directly into that model, and weaknesses compound with other signals.
How to measure the impact#
- Baseline inbox placement with seed tests before any change.
- Make one change at a time and hold volume steady.
- Re-test after 48 to 72 hours; provider models need time to update.
- Track Postmaster Tools and SNDS alongside your seed results.
Improving it#
- Enforce DMARC p=reject so exact-domain spoofing fails.
- Register lookalike domains or monitor them for registration.
- Enable link rewriting and attachment sandboxing at the gateway.
- Run quarterly simulations and make reporting a one-click action.
- Apply BIMI so users learn what authentic mail looks like.
Frequently asked questions#
Does DMARC stop all phishing?
It stops exact-domain spoofing. Lookalike domains and display-name spoofing require additional controls.