Email Filtering Best Practices for Phishing

Email filtering is the first technical control most phishing messages meet, and every message it stops is one users never have to judge. The volume is large: phishing/spoofing was again the most-reported crime type in the FBI’s 2025 Internet Crime Report, with 191,561 complaints, and APWG tallied 1,069,681 phishing attacks in the second quarter of 2026 alone, up 10.1% from the first quarter. Filtering works best alongside DMARC/SPF/DKIM and phishing-resistant MFA.

Attackers adapt to filters. The FBI report notes that AI-generated content is becoming increasingly difficult to detect, and IC3 received more than 22,000 complaints referencing AI in 2025. AI-generated phishing produces unique, well-written messages that give signature-based detection little to match, so modern filtering combines several detection layers.

The Email Security Stack

Layer 1: Authentication-Based Filtering

The first layer checks whether the sending server is authorized to send for the domain shown in the From address. NIST’s SP 800-177 Rev. 1, Trustworthy Email, recommends SPF, DKIM, and DMARC for authenticating sending domains.

Configuration:

Enforce DMARC: honor senders’ p=reject and p=quarantine policies
Don’t reject on an SPF hard fail (-all) alone. RFC 9989, the current DMARC specification (May 2026, replacing RFC 7489), warns in section 7.1 that an SPF hard fail can get a message rejected early in the SMTP transaction, before any DMARC processing, so mail that fails SPF but carries a valid, aligned DKIM signature would be lost. Let the DMARC evaluation decide.
Treat missing or failing DKIM signatures as a risk signal rather than proof of fraud
Apply stricter filtering to messages that fail any authentication check
Publish your own DMARC policy at p=quarantine or p=reject. A May 2024 advisory from the FBI, the State Department, and NSA warned that North Korean actors exploit domains with missing or p=none DMARC policies to deliver spoofed spear-phishing email.

Layer 2: Reputation-Based Filtering

Check the sender’s domain, IP address, and email address against reputation data:

Domain age: newly registered domains (for example, under 30 days old) sending email are higher risk
IP reputation: known spam and phishing sources
Sender reputation: history of malicious or spam activity
URL reputation: links to known phishing sites

Layer 3: Content Analysis

Analyze the message itself for phishing indicators:

Keyword analysis: urgency language, credential requests, financial terminology
Brand impersonation detection: logo matching and template similarity to known brands
Tone analysis: machine-learning detection of social engineering patterns
Language anomalies: mismatches between the claimed sender (for example, “Your Bank”) and the message content

Layer 4: URL Protection

Links are one of the most common phishing payloads. Advanced filtering includes:

URL rewriting: replace links with security-proxy URLs that check reputation at click time
Time-of-click analysis: re-evaluate URLs when clicked, not just at delivery, which catches pages weaponized after the message arrives
URL sandboxing: open suspicious URLs in an isolated environment to observe behavior
QR code scanning: detect and analyze QR codes embedded in email bodies and attachments

Layer 5: Attachment Protection

Malicious attachments deliver malware or contain phishing links:

File type blocking: block high-risk attachment types (.exe, .js, .vbs, .scr, .bat)
Macro controls: flag or block documents with macros (.docm, .xlsm)
Sandbox detonation: open attachments in isolated environments to detect malicious behavior
Hash matching: compare file hashes against known malware databases

Layer 6: Behavioral Analysis

Behavioral models catch anomalies that content scanning misses:

Communication pattern deviations: first-time sender, unusual sending time, uncharacteristic tone
Impersonation detection: a display name matching an internal employee on mail from an external or free webmail address. In APWG’s Q4 2025 report, Fortra found that 69% of the BEC attacks it observed were sent from free webmail domains. Name matching alone is not enough: in Q2 2026, Fortra saw a significant increase in scammers swapping the sender display name and the subject line, presumably to get past filters that look for executives’ names in the display name.
BEC detection: requests for wire transfers, payment changes, or sensitive data from unusual sources (see our BEC guide)
Two-step lures: Fortra also reported an uptick in two-step phishing, where a harmless-looking business inquiry comes first and the phishing link arrives only after the victim replies. Replies in an ongoing thread deserve the same scrutiny as first contact.
Account compromise indicators: changes in sending behavior from known contacts

Platform-Specific Configuration

Microsoft 365 (Defender for Office 365)

Start from the Standard or Strict preset security policies, which apply Microsoft’s recommended settings across anti-spam, anti-malware, anti-phishing, Safe Links, and Safe Attachments. Organizations with Defender for Office 365 licenses also get a Built-in protection preset that gives basic Safe Links and Safe Attachments coverage to users not covered by other policies.
Enable Safe Links with URL rewriting and time-of-click protection, and Safe Attachments for sandbox detonation
Configure impersonation protection. In the preset policies, mailbox intelligence covers all recipients and your accepted domains are protected automatically; you can add up to 350 users (executives and finance staff, for example) for user impersonation protection and up to 50 custom domains, such as key partners. Microsoft notes that user impersonation protection doesn’t flag senders the recipient has corresponded with before.
Set quarantine policies for suspected phishing rather than sending it to Junk
Turn on user reporting with the built-in Report button in Outlook, and route reports to a reporting mailbox, to Microsoft, or both

Google Workspace

In the Gmail advanced phishing and malware protection settings:

Turn on “Protect against domain spoofing based on similar domain names,” “Protect against spoofing of employee names,” “Protect against inbound emails spoofing your domain,” and “Protect against any unauthenticated emails”
Under links, turn on “Identify links behind shortened URLs,” “Scan linked images,” and “Show warning prompt for any click on links to untrusted domains”
Turn on the attachment protections for encrypted attachments and scripts from untrusted senders and for anomalous attachment types
Review the actions: for the attachment and spoofing protections, the default keeps a flagged message in the inbox with a warning, while moving it to spam or quarantine is stricter
Consider “Apply future recommended settings automatically” so new protections switch on as Google adds them

Third-Party Gateways and API-Based Tools

Third-party email security comes in two main forms: secure email gateways that sit in front of the mailbox (the domain’s MX record points to them), and API-based tools that connect to Microsoft 365 or Google Workspace and scan mail inside the mailbox. If you put a gateway in front of Microsoft 365:

Messages arrive carrying the gateway’s IP address as their source. Microsoft recommends Enhanced Filtering for Connectors (also called skip listing), which preserves the original source IP and sender information so Microsoft 365 can run explicit SPF, DKIM, and DMARC checks. Test it on a few recipients before applying it to the whole organization.
After enabling it, disable mail flow rules that bypass spam filtering (SCL -1) for gateway traffic, as Microsoft advises
Enable every detection layer the product offers, and integrate it with your SIEM and incident response tools
Enable automated quarantine with one-click release for false positives

Tuning for Effectiveness

Reducing False Positives

Overly aggressive filtering blocks legitimate email, disrupts business, and teaches users to ignore security warnings:

Start with moderate sensitivity and increase gradually
Keep allow lists narrow (specific senders rather than whole domains) and review them regularly
Review quarantined messages regularly; patterns in false positives reveal tuning opportunities
Provide self-service quarantine access so users can release legitimate messages

Reducing False Negatives

Phishing that passes the filter is the greatest risk:

Analyze phishing simulation results to see which kinds of lures get through
Review user-reported phishing for common characteristics of missed attacks
Enable all available detection layers; no single layer catches everything
Update custom rules as campaigns change, such as the display-name swapping Fortra described

External Email Warnings

Apply a short, consistent banner to mail from outside the organization:

[EXTERNAL] This message originated outside your organization.
Exercise caution with links and attachments.

The banner is a cheap cue on messages that claim to come from a colleague or executive but were sent from outside, a common BEC pattern. It cannot distinguish a real vendor from a lookalike vendor domain, because both are external; see our supply chain phishing guide for vendor-specific checks.

Integration with the Security Stack

Email filtering works best when connected to other defenses:

Feed blocked phishing indicators to DNS filtering and the web proxy; see our URL inspection guide
Share indicators of compromise with endpoint detection and response (EDR)
Send quarantine decisions to your SIEM for correlation
Connect the user report button to your incident response workflow
Use filtering data to prioritize security training topics

Key Takeaways

Layer six kinds of detection: authentication, reputation, content, URL, attachment, and behavioral
Let DMARC decide on authentication failures rather than hard-rejecting on SPF alone, and publish your own DMARC policy at quarantine or reject
AI-written lures, display-name swapping, and two-step phishing defeat simple keyword and name checks; behavioral analysis and time-of-click URL checks fill the gap
On Microsoft 365, start from the preset security policies; with a gateway in front, enable Enhanced Filtering for Connectors
External email banners flag outside senders but not lookalike vendor domains
Balance sensitivity: too aggressive blocks legitimate mail, too permissive misses attacks

For the complete phishing defense framework, see our phishing recognition and reporting guide.

Sources

This content is for educational purposes only. Test email filtering changes thoroughly before deployment to avoid disrupting legitimate business communications.