How to Protect Against Phishing

TL;DR: Email authentication (SPF + DKIM + DMARC at p=reject) stops attackers sending phishing email that appears to come from your domain. Layer on MFA, DNS filtering and basic staff training and you eliminate the most common attack paths. Scan your domain free to see whether your email authentication is in place.

Why phishing still works in 2026

Phishing succeeds because it exploits people and processes, not software bugs. Attackers either impersonate your domain directly (possible when DMARC is missing or set to p=none) or register a lookalike domain one character off yours. Both methods are cheap and fast — and both have technical countermeasures that most small businesses haven't applied.

Step 1 — Deploy DMARC at p=reject

This is the single highest-impact step. DMARC tells receiving mail servers to reject any email that claims to be from your domain but fails SPF and DKIM alignment. Without it, anyone can send an email that says it's from you@yourbusiness.com and most inboxes will accept it.

The full setup: What is DMARC and how to set it up. Start at p=none, verify no legitimate senders break, then move to p=quarantine and then p=reject over two to four weeks.

Step 2 — Enable SPF and DKIM for every sender

DMARC only protects you if SPF and DKIM are passing. Audit every service that sends email on your behalf — your main email platform, CRM, helpdesk, marketing tool, WooCommerce — and make sure each is included in your SPF record and signing with DKIM.

Common gap: adding a new ESP (email service provider) without updating SPF. SPF records explained.

Step 3 — Monitor for lookalike domains

Attackers register yourbusiness-support.com, yourbusinеss.com (Cyrillic е) or yourbusiness.co and send phishing from those. DMARC on your domain does not protect against this.

Mitigations:

• Register obvious variations of your domain name and park them with a locked-down DMARC record.
• Set up Google Alerts for your brand name + "invoice", "payment", "support".
• Use a domain monitoring service (many free tiers exist) to alert on new registrations that resemble yours.

Step 4 — Enable multi-factor authentication (MFA) everywhere

Even if a phishing attack steals a password, MFA stops the attacker using it. Enable MFA on:

• Email (Google Workspace, Microsoft 365)
• Cloud services (AWS, Azure, GCP)
• Accounting software and payment platforms
• Domain registrar and DNS provider
• Any tool with access to customer data

Prefer authenticator apps (Google Authenticator, Authy) or hardware keys (YubiKey) over SMS, which can be intercepted via SIM-swap.

Step 5 — Use DNS filtering

DNS filtering blocks access to known malicious domains at the network level — before a browser loads the phishing page. Free options include Cloudflare Gateway (1.1.1.2) and Quad9 (9.9.9.9). Enterprise tools like Cisco Umbrella add threat intelligence and policy controls.

Set DNS filtering on your office router and in MDM profiles for remote devices to cover staff wherever they work.

Step 6 — Train staff to recognise phishing

Technology reduces the attack surface; training reduces the human factor. Key topics to cover:

• How to check the actual sender domain (not just the display name)
• Recognising urgency and fear as phishing triggers
• Verifying payment or password-change requests out-of-band (phone call, not email reply)
• How to report a suspected phishing email internally

Run simulated phishing campaigns quarterly (KnowBe4, Proofpoint Security Awareness, Gophish for free self-hosted) to measure and improve. People who click in simulations get targeted micro-training — not public shame.

Step 7 — Tighten email filtering rules

Your email platform's built-in filters catch a lot, but default settings are conservative to avoid false positives. Review and tighten:

In Google Workspace: Admin → Apps → Gmail → Safety. In Microsoft 365: Defender portal → Email & collaboration → Policies.

Step 8 — Have a response plan

When (not if) a phishing email gets through, you need a clear process:

1. Employee reports it to a shared mailbox or IT channel immediately
2. IT or security team assesses: was it clicked? Were credentials entered?
3. If credentials compromised: reset password, revoke active sessions, check for forwarding rules set by attacker
4. If malware downloaded: isolate device, scan with EDR
5. Notify affected parties per your data-breach obligations
6. Post-incident review: how did it get through? What changes prevent recurrence?

FAQ

Does DMARC at p=reject stop all phishing?

It stops phishing that impersonates your exact domain. It does not stop lookalike domains, compromised supplier accounts, or display-name spoofing where the From address is a free webmail address. That is why the other steps — lookalike monitoring, MFA, training — are necessary layers.

How much does this cost?

Steps 1–3 (DMARC, SPF/DKIM, parked domains) cost nothing but time — it is DNS record editing. MFA is free on Google Workspace and Microsoft 365. Cloudflare Gateway DNS filtering is free. Staff training can be done with free tools. The meaningful costs start with enterprise filtering platforms or dedicated security awareness training services — neither is required at the SMB level.

We already have antivirus — is that enough?

No. Antivirus catches known malware but does not prevent credential-stealing phishing (no malware to detect), domain impersonation, or business email compromise where no malicious file is involved. Email authentication + MFA + training covers the gaps antivirus cannot.

What is the difference between phishing and spear phishing?

Standard phishing sends the same message to thousands of targets hoping some click. Spear phishing is targeted — the attacker researches the specific victim (from LinkedIn, company website, social media) and crafts a convincing message. Business email compromise is a form of spear phishing targeting finance or executive staff. The defences are the same but the training emphasis is higher for spear phishing.