Recommended Free Tools
The most reliable defense against AI-written impersonation is a control stack, not a single filter: authenticate every sending domain with SPF, DKIM and DMARC; require phishing-resistant sign-in methods such as FIDO2/WebAuthn; limit guest and cross-organization access; tightly govern OAuth consent; and require independent human verification for high-impact requests.
AI lowers the cost of producing convincing executive language, realistic invoices and urgent file-sharing requests. It does not defeat domain authentication or a security key by itself, but it can exploit weak forwarding rules, anonymous links, excessive app permissions and recovery processes. The settings below close those gaps in the order that gives administrators the clearest evidence and safest rollout.
As an Amazon Associate I earn from qualifying purchases.
1. Authenticate the domain before tuning the mailbox
Domain authentication answers a narrow but essential question: did an approved system send this message, and does that system align with the domain shown in the visible From address? Microsoft describes SPF as identifying permitted email sources, DKIM as digitally signing important message elements, and DMARC as using those results plus domain alignment to validate the visible sender. NIST SP 800-177 Rev. 1 treats the three technologies as core sending-domain controls.
| Control | What it validates | What it cannot do alone |
|---|---|---|
| SPF | Whether the envelope sender’s mail server is authorized in DNS. | It does not authenticate the visible From address and can be disrupted by forwarding. |
| DKIM | Whether selected message content carries a valid cryptographic signature from the signing domain. | A valid signature is not enough if the signing domain is unrelated to the visible sender. |
| DMARC | Whether SPF or DKIM passes and aligns with the visible From domain, with a policy for failures. |
It does not prove that a legitimate, compromised account had a safe business purpose. |
Build an inventory first
List every service that sends as your domain before changing DNS. Include marketing platforms, ticketing systems, scanners, payroll and line-of-business applications, customer-support tools, multifunction printers and cloud services. Ask each owner which envelope-from domain and DKIM selector it uses. An incomplete inventory is the most common reason a strict DMARC policy blocks legitimate mail.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Publish one coherent SPF policy
Maintain one SPF TXT record for each sending domain. Consolidate authorized sources rather than publishing several SPF records, because receivers treat multiple records as an error. SPF has DNS-lookup limits, so remove obsolete includes and avoid nesting unnecessary providers. End with a failure policy appropriate to your rollout, but do not copy a vendor’s sample record without checking your complete sender list.
Enable DKIM for every sending service
Turn on DKIM in each provider and publish the requested public key under the provider’s selector in DNS. Use a custom domain where the service supports it. Rotate selectors according to the provider’s process and retain an inventory so an old key is not left active indefinitely.
Use DMARC reporting before enforcement
- Start with reporting. Publish DMARC with an observation policy and mailbox addresses for aggregate reports. Confirm that the report destinations are monitored and protected from unsolicited volume.
- Inspect alignment failures. Separate unknown senders from legitimate services that authenticate but use a different envelope or signing domain.
- Correct the senders. Configure custom bounce domains, DKIM signing and aligned
Fromdomains where possible. Document services that cannot align and decide whether they should stop sending as your domain. - Raise enforcement gradually. Move toward
p=quarantine, thenp=reject, only after reports show that expected traffic is passing. Apply subdomain and percentage controls deliberately if your DNS provider supports them.
DMARC alignment is the feature that addresses direct domain spoofing. Microsoft’s security-operations guidance summarizes it this way: “Domain-based Message Authentication, Reporting, and Conformance. Uses SPF and DKIM results to verify alignment between domains in the MAIL FROM address and From address to help prevent spoofing.”
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAccount for forwarding and intermediaries
Forwarding can change the connecting server and can modify signed content, causing SPF or DKIM failures even when the original sender was legitimate. Microsoft recommends trusted Authenticated Received Chain (ARC) handling for expected intermediaries. Monitor forwarding services, mailing lists and help-desk relays separately; do not weaken DMARC globally just to accommodate an undocumented forwarder.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Add impersonation policies as a second layer
Mail platforms can flag executive names, finance roles, look-alike domains and unusual display-name patterns. Configure these policies for high-value identities and train users to treat a warning as a reason to verify, not as proof of fraud. They complement SPF, DKIM and DMARC; they do not replace domain authentication or protect a real account that an attacker has taken over.
2. Replace phishable sign-in factors with verifier-bound authentication
CISA’s January 18, 2024 Risk in Focus guidance recommends strong MFA, “especially phishing-resistant MFA like Fast Identity Online (FIDO authentication),” alongside DMARC, SPF and DKIM. NIST SP 800-63B identifies WebAuthn, used by FIDO2 authenticators, as phishing-resistant because the authenticator output is bound to the authenticated verifier’s domain. A credential created for your real sign-in site will not validate on an impostor domain.
Set a risk-based authentication baseline
- Require FIDO2/WebAuthn for administrators, finance staff, executives, help-desk personnel and anyone handling sensitive collaboration data.
- Enroll a second hardware key or another documented recovery path. Store recovery material separately from the primary device.
- Use conditional-access or equivalent risk rules for unfamiliar locations, impossible travel, high-risk sign-ins and unmanaged devices.
- Disable legacy authentication protocols and review app passwords, mailbox forwarding rules and delegated access.
- Use SMS or push-only MFA only as a transitional measure where phishing-resistant methods cannot yet be deployed.
Plan recovery without creating a bypass
Test the lost-key process with a small administrator group before enforcing the policy broadly. A recovery desk should verify identity through an independent procedure, issue a temporary enrollment window and record the action. Keep break-glass accounts protected by long, unique credentials, hardware-backed MFA where supported, restricted access and alerting. Never make email the sole recovery channel: NIST’s FAQ states that SP 800-63B does not allow email as a channel for single- or multi-factor authentication processes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCheck the whole account, not just the login prompt
After deploying FIDO2, review existing sessions, refresh tokens, mailbox rules, forwarding addresses, delegated mailboxes and registered devices. A successful sign-in policy does not remove access that an attacker already obtained through an application grant or an active session. Revoke suspicious sessions and grants as part of the same incident procedure.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Treat Microsoft 365 and Entra collaboration as an access boundary
External sharing spans Entra ID, Teams, Microsoft 365 Groups and SharePoint. Guest or anonymous sharing is enabled by default in many scenarios, so the safe starting point is to narrow it deliberately rather than assume a private tenant is a closed environment.
Restrict invitations and partner scope
- In the Entra admin center, review External Identities and Cross-tenant access settings.
- Limit guest invitations to approved administrators, sponsor groups or an access-review workflow. Do not allow every user to invite outside identities by default.
- Allow-list partner domains and organizations where practical. Block known look-alike or untrusted domains instead of relying only on user judgment.
- Decide whether inbound and outbound B2B collaboration may trust an external organization’s MFA or device claim. Trust only partners whose controls and support processes you understand.
Minimize what guests can discover
Set guest directory visibility to the minimum needed for collaboration. Prevent guests from browsing groups, employee attributes and unrelated memberships. In SharePoint and Teams, disable guest sharing of items they do not own when that option is available in your tenant’s policy set. Requiring a guest to sign in makes an invitation attributable; anonymous links remove that attribution.
Protect sensitive files and sessions
- Use named guests and sign-in-required links for confidential, regulated or financially sensitive material.
- Apply conditional-access rules to guest and external users, including device requirements, session sign-out and reauthentication for higher-risk resources.
- Require reauthentication for verification-code users when the resource or collaboration risk warrants it.
- Run recurring access reviews for guests, Teams memberships, group owners and shared links. Remove identities and links with no current business purpose.
Record the sponsor, purpose, expiry date and owning team for every external collaboration. A guest account that remains indefinitely is an access path an AI-generated invitation can exploit, even when mail authentication is perfect.
4. Govern Google Workspace OAuth and third-party applications
OAuth consent is an access boundary, not a convenience prompt. A user can authorize an external application to read mail, files, contacts or offline data while the password and MFA remain intact. Google Workspace administrators can control this through API controls, including blocking all third-party API access or restricting unconfigured applications.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose an application policy
- Open the Google Admin console and review Security, Access and data control and API controls (labels can vary by edition).
- Set the default to blocked or restricted for unconfigured applications when business operations permit.
- Maintain an allow-list of approved applications and publishers. Verify requested scopes, data handling and whether offline access is necessary.
- Configure a clear denial message that tells users how to request an approved exception, rather than teaching them to bypass the control.
- Review existing grants and remove applications that are unused, over-scoped, owned by an unknown publisher or inconsistent with a user’s role.
Apply the same principle in Microsoft 365: restrict user consent, approve applications centrally and review enterprise applications and delegated permissions. A password reset or MFA reset does not automatically revoke an external application’s already-issued access token. Revoke the grant and terminate active sessions during containment.
5. Make sharing specific, time-limited and recoverable
Prefer identity-bound links
For sensitive material, share with named guests or groups and require sign-in. Avoid “anyone with the link” permissions for confidential, regulated or payment-related data. If an anonymous link is unavoidable for low-risk content, set the shortest practical expiry and prevent editing or downloading where the platform supports those controls.
Use least privilege and expiry
- Give read access when editing is not required.
- Separate a project workspace from the organization’s general file repository.
- Assign an owner who receives expiry and access-review reminders.
- Remove stale links, guest accounts and group memberships together; deleting only the user can leave a reusable link behind.
Maintain a recovery path for authenticators and data
Keep documented break-glass procedures, recovery keys and a second enrolled FIDO2 security key. Test restoration of critical documents and the re-enrollment process under a controlled exercise. Recovery that depends on the same mailbox, phone or administrator account being investigated is not an independent recovery path.
6. Add an AI-era verification rule to technical controls
No setting can reliably infer intent from fluent language. Require independent verification for payment changes, new bank details, credential requests, emergency secrecy, unusual file-sharing invitations and requests to create OAuth access. Call a known number or start a new message to a verified address; do not reply to the suspicious thread or use contact details supplied in it.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Train staff to report suspicious messages, preserve complete headers and avoid consent prompts requesting broad mailbox, file or offline-access scopes. CISA recommends awareness and reporting programs because rapid reporting lets administrators revoke sessions, grants and links before a convincing message becomes a compromise.
7. Compare controls by the risk they actually reduce
| Control area | Spoofing and takeover coverage | Administrative work and user friction | Important limitation |
|---|---|---|---|
| SPF, DKIM and DMARC | Strong against direct domain spoofing, including many third-party sender failures when alignment is enforced. | DNS inventory, report analysis and forwarding exceptions are ongoing work. | Does not stop compromised legitimate accounts or malicious look-alike domains. |
| FIDO2/WebAuthn | Strong phishing resistance through verifier-name binding. | Requires compatible devices, enrollment, spare keys and recovery procedures. | Does not remove existing OAuth tokens, sessions or delegated access. |
| Guest and cross-tenant controls | Limits who can collaborate, what they can discover and which external claims are trusted. | Requires partner onboarding, ownership records and recurring reviews. | Overly broad anonymous links can bypass the intended identity boundary. |
| OAuth app governance | Blocks illicit consent and limits data access by external applications. | Needs an approval queue, scope review and grant revocation process. | Blocking new consent does not automatically invalidate grants already issued. |
| Impersonation detection and training | Helps catch look-alike domains, display-name abuse and socially engineered requests. | Requires tuning, user practice and a monitored reporting channel. | Warnings are advisory; users still need an independent verification rule. |
No authoritative source establishes a single percentage reduction in AI-impersonation risk for this combination of settings. Judge the program by observable outcomes instead: authenticated-sender coverage, DMARC alignment failures, number and age of guest accounts, unapproved OAuth grants, legacy-authentication attempts, recovery-test results and time from report to containment.
8. A practical rollout sequence
- Map exposure. Inventory sending services, domains, guests, external links, OAuth grants, forwarding rules, legacy protocols and privileged accounts.
- Collect evidence safely. Start DMARC reporting, review application grants and run access reviews without immediately breaking legitimate collaboration.
- Fix high-impact gaps. Enable DKIM, correct SPF and alignment failures, disable legacy authentication, restrict guest invitations and block unapproved OAuth consent.
- Deploy phishing-resistant MFA. Enroll administrators first, then finance, executives, help-desk staff and sensitive-data users. Test spare-key and break-glass recovery.
- Enforce and monitor. Move DMARC toward quarantine and reject when reports are clean, require sign-in for sensitive sharing, apply conditional access and alert on new grants or unusual guest activity.
- Exercise the human process. Run a controlled verification drill, confirm that users report suspicious mail with headers and measure how quickly responders revoke sessions, links and app access.
9. Failure modes and fixes
Legitimate mail is quarantined after DMARC enforcement
Use aggregate reports to identify the sender, configure aligned DKIM or a custom envelope domain, and check whether forwarding or a mailing list modified the message. Do not solve one broken sender by returning the entire domain to an unprotected policy.
A guest can see more than the project requires
Check tenant-level external settings, group membership, SharePoint sharing links and directory visibility together. Remove inherited permissions and recreate the share as a named, sign-in-required invitation with an expiry.
An attacker still reads data after a password reset
Investigate OAuth grants, refresh tokens, active sessions, mailbox delegation, forwarding rules and registered devices. Revoke the illicit application grant and sessions; password and MFA resets alone are insufficient.
Users cannot use a security key while traveling or after loss
Enroll a second key before enforcement, document an independently verified recovery path and test it. Do not make SMS or email the permanent fallback for privileged users.
Users approve convincing consent prompts
Restrict unconfigured applications, show a clear denial and approval message, train users to inspect requested scopes and provide a reporting route. Review grants continuously because a previously approved application can later change ownership or behavior.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
