Protecting a business email account requires layers, not a single product: enable strong multi-factor authentication (MFA), secure administrator accounts first, train staff to verify unusual requests, use your provider’s filtering and update controls, and publish SPF, DKIM, and DMARC for your domain. If someone enters a password into a phishing site, report it to your IT or email administrator immediately and follow the provider’s recovery process.
Start with this priority order
Use the following sequence if you are a small or midsize business deciding what to do first:
As an Amazon Associate I earn from qualifying purchases.
- Turn on MFA for every business email account that supports it. Start with administrators and employees who handle financial, customer, payroll, legal, or other sensitive information.
- Choose the most phishing-resistant MFA your provider supports. A physical security key is CISA’s strongest listed option, but compatibility, enrollment, and account recovery must be planned first.
- Teach employees to pause, verify, and report. An urgent request for payment, credentials, gift cards, or sensitive data must be confirmed through a known phone number, existing chat, or public company website—not contact details supplied in the suspicious message.
- Use layered technical controls. Configure provider filtering, keep operating systems and security software current, and enable available protections for malicious links and attachments.
- Authenticate mail sent from your domain. SPF, DKIM, and DMARC help receiving systems evaluate messages that claim to come from your domain. They do not stop every phishing message or protect a worker who submits a password to a lookalike website.
- Have an escalation path before an incident. Everyone should know exactly how to contact the IT or email administrator and how to report a suspicious message.
This order protects the sign-in process first, reduces mistakes at the point where people receive requests, and then improves the chance that fraudulent mail using your domain is filtered or rejected.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Why business email deserves special protection
A compromised mailbox can expose years of correspondence, invoices, contracts, customer information, password-reset links, and internal plans. An attacker can also use the account to impersonate an employee, reply inside an existing conversation, or send convincing requests to customers and suppliers. The risk is therefore both confidentiality and impersonation: the attacker may read information and use the trusted account to persuade someone else.
#1 Best Overall
Phishing is not limited to ordinary email. Messages can arrive through collaboration tools, text messages, social networks, or phone calls. The same verification rule applies in every channel: treat an unexpected request for credentials, money, or sensitive information as untrusted until you confirm it independently.
Require MFA, with stronger methods where possible
NIST’s small-business guidance gives the basic instruction plainly: “Enable multi-factor authentication.” CISA advises businesses to work with their IT team or provider to enable MFA for email, file storage, and remote access, beginning with administrator accounts and people who handle sensitive data. See CISA’s MFA guidance and NIST’s phishing guidance.
What MFA protects
MFA adds a second proof of identity after the password. If a password is stolen or reused, the attacker still needs the additional factor. MFA does not prevent a person from visiting a phishing site, but a phishing-resistant method can prevent the stolen password from being useful because the authentication is cryptographically tied to the legitimate website.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the common methods compare
| Method | Relative protection | What it requires | Important limitation |
|---|---|---|---|
| Physical FIDO security key | CISA’s strongest listed option and designed to resist phishing | Compatible identity provider, enrolled key, spare or recovery method, and a process for lost keys | Will not help until every relevant account is enrolled and recovery is tested |
| Authenticator app with number matching | Stronger than password-only access; the number check can reduce approval mistakes | Supported provider, enrolled phone, and a recovery method | A user can still be tricked into approving an unexpected sign-in |
| One-time-code authenticator app | Improves on a password alone | App enrollment and backup or recovery process | Codes can be entered into a phishing site |
| Biometric factor | Depends on the provider and the device’s implementation | Supported device and enrollment | Not automatically phishing-resistant in every sign-in flow |
| SMS or email code | Better than password-only access, but the weakest among the methods CISA lists | Working phone number or alternate email | Codes can be intercepted, redirected, or entered into a fake sign-in page |
CISA describes security keys as providing “the best protection against phishing and [being] easy to use.” That statement is a recommendation about the method, not a guarantee that a key will work with every service. Check the identity provider’s supported standards, browser and device requirements, administrator policies, and recovery options before buying hardware.
Deploy MFA without locking out the business
- Inventory accounts and roles. Include administrator, shared, service, remote-access, and former-employee accounts. Remove accounts that no longer have a business purpose.
- Confirm provider support. Check which MFA methods are available for the email edition your organization uses and whether administrators can require them by group.
- Enroll administrators first. Protect the accounts that can reset passwords, change security policies, create forwarding rules, or add new users.
- Enroll sensitive-role users. Prioritize finance, payroll, executives, customer support, legal, and anyone with access to confidential files.
- Set a recovery design. Provide a spare security key or another approved recovery method, document who can perform an account reset, and store recovery information securely. Do not make one employee the only person who can restore access.
- Test normal and emergency sign-in. Verify that staff can sign in on their usual devices and that the recovery process works without weakening the policy for everyone.
- Extend the requirement. After the highest-risk accounts are covered, require MFA for the remaining email, file-storage, remote-access, and administrative services.
When a physical security key is worth considering
A FIDO security key is a small hardware device that proves possession during sign-in. It is relevant for business email when the organization’s identity provider supports the key’s protocol and the business can manage enrollment and recovery. CISA includes a physical key—using YubiKey as an example—in its phishing-resistant MFA guidance.
Rank #2
Do not choose a key solely because it is advertised as secure. Before purchasing, confirm:
- Which key standards and connection types the provider supports (for example, USB, NFC, or a platform-specific option).
- Whether the browsers, phones, and computers used by employees support the sign-in flow.
- How many keys each user should enroll and where spare keys will be stored.
- How an employee proves identity and regains access after losing a key.
- Whether administrators can require the key for high-risk groups and view enrollment status.
A key protects the sign-in ceremony; it does not filter incoming mail, verify a supplier’s payment request, or prevent a user from sending confidential information to the wrong person. Keep those other controls in place.
Train employees to pause, verify, and report
NIST identifies urgency, suspicious sender addresses, and requests for sensitive information as warning signs. Training should turn those signs into a repeatable behavior rather than a one-time presentation. CISA also recommends explaining to employees why MFA matters. Use NIST’s phishing guidance as a starting point.
The verification routine
- Pause. Do not click a link, open an unexpected attachment, approve an MFA prompt, or alter payment details while feeling rushed.
- Inspect the request. Look for a mismatched or lookalike sender address, an unusual tone, a new bank account, a request for a password or code, or pressure to keep the request secret.
- Use a known contact channel. Call a number already stored in the company directory or on a prior invoice, start a new conversation in the organization’s established collaboration system, or find the contact page by navigating to the known company website. Never use the phone number, reply address, or link supplied by the suspicious message for verification.
- Confirm the exact action. Ask the supposed requester whether they sent the message and confirm the account number, amount, recipient, or file before acting.
- Report it. Forward or submit the message through the business’s established reporting channel, even when you did not click anything. Reporting helps administrators identify similar messages and improve filters.
Requests that always deserve independent confirmation
- Changing a supplier’s bank or payment details.
- Sending payroll, tax, identity, customer, or employee data.
- Buying gift cards, cryptocurrency, or urgent equipment.
- Sharing a password, MFA code, recovery code, or remote-access approval.
- Resetting an account or granting a new administrator permission.
Make the reporting route visible: a mailbox, button in the email client, ticket category, or phone extension. The route should be usable from a device that is not signed in to the potentially compromised account.
Use filtering, updates, and endpoint protections as supporting controls
NIST recommends configurable email filters, current antivirus software, and email-security technologies that verify message origin and can reject spoofed messages. These controls can detect or block some malicious messages, links, and attachments, but none of them catches every well-written social-engineering attempt.
Provider and mailbox settings to review
- Enable the provider’s spam, malware, and impersonation protections.
- Turn on link and attachment scanning where available, while understanding that encrypted or newly created content may evade inspection.
- Review quarantine notifications and give administrators a way to release legitimate mail safely.
- Restrict automatic external forwarding unless a documented business need exists.
- Require alerts for impossible travel, unfamiliar devices, unusual sign-ins, or repeated MFA prompts when the provider offers them.
- Keep the email client, operating system, browsers, and security software updated through a managed process.
Filtering reduces exposure before a person sees a message. Updates close vulnerabilities that attackers could use after a malicious attachment or link is opened. Neither control replaces MFA or human verification.
Recommended Free Tools
Authenticate messages sent from your business domain
If your business uses its own domain, ask the email provider or a qualified administrator about SPF, DKIM, and DMARC. FTC guidance explains the roles of these controls and cautions that setup can require technical expertise. See the FTC’s small-business cybersecurity guidance and its explanation of business impersonation.
SPF: which servers may send
Sender Policy Framework (SPF) publishes a DNS record listing the mail servers authorized to send mail for your domain. A receiving server can check whether the sending server is on that list. SPF is useful only when every legitimate sending service—such as your main provider, marketing platform, ticketing system, or invoicing service—is accounted for. An incomplete record can cause legitimate mail to fail authentication.
DKIM: a signature on the message
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing mail. The receiving server retrieves the public key from DNS and checks whether the signed parts of the message still match. DKIM helps preserve trust when mail passes through intermediate systems, provided the sending service is configured correctly.
DMARC: alignment and a policy
Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks whether SPF or DKIM passes and aligns with the domain visible in the message’s From address. The domain owner can publish a policy telling receiving systems what to do with messages that fail—monitor them, quarantine them, or reject them—and can request reports about authentication results.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
Roll out DMARC carefully. Begin by collecting reports and identifying legitimate senders, then move to a stricter policy after those senders pass authentication. A misconfigured record can interfere with real customer or transactional mail, so obtain provider or qualified administrator help if your business does not manage DNS and mail systems internally.
What SPF, DKIM, and DMARC cannot do
- They do not authenticate a lookalike domain such as a misspelled version of your company’s name.
- They do not stop an attacker from sending from a different, perfectly valid domain.
- They do not prevent an employee from entering a password on a credential-harvesting website.
- They do not guarantee that every message from your domain is safe if a legitimate account or sending service is compromised.
- DMARC primarily protects your domain from being spoofed. As CISA explains in its #StopRansomware Guide, it does not protect a recipient from incoming spoofed email unless the sender’s domain also implements DMARC.
If someone clicked or entered credentials
Speed matters more than embarrassment. Tell the employee to stop interacting with the message and contact the organization’s IT or email administrator immediately. The administrator should use the provider’s account-recovery process and follow the organization’s incident procedure. Exact actions vary by provider and account setup, so do not assume that one universal sequence of password resets, session revocation, token invalidation, or mailbox-rule checks applies everywhere.
The employee should describe what happened precisely: whether a link was opened, a password or MFA code was entered, an approval was accepted, an attachment was opened, or a file was downloaded. Preserve the suspicious message and its headers if the reporting process requests them. If a financial account may also have been exposed, NIST advises contacting the financial institution’s fraud department. Its phishing guidance also urges people to report when they think they have fallen victim.
Do not delay reporting while trying to determine whether the message was “really” malicious. The administrator can make that assessment using sign-in records, provider alerts, and the message details.
A practical rollout plan for a small business
| Phase | Work to complete | Owner | Result to verify |
|---|---|---|---|
| First week | List email and administrator accounts; name the reporting contact; enable MFA for administrators and sensitive-role users | Owner, IT lead, or provider administrator | High-risk accounts require MFA and staff know where to report |
| Weeks two to four | Enroll the remaining users; choose the strongest supported method; document lost-device and lost-key recovery | IT or provider administrator | Every active user can sign in and recover access through the approved process |
| Month two | Review filtering, quarantine, forwarding, sign-in alerts, endpoint updates, and reporting workflow | IT lead with department managers | Suspicious mail has a visible reporting path and systems receive updates |
| Month two or three | Inventory every service that sends mail for the domain; configure SPF and DKIM; begin DMARC monitoring | DNS or email administrator | Legitimate senders authenticate and DMARC reports are understood |
| Ongoing | Run short training refreshers, review new sending services, remove dormant accounts, and test recovery | Business owner and IT administrator | Controls remain effective as staff, devices, and providers change |
Keep the verification habit repeatable
Before approving an unusual payment, credential request, data transfer, or permission change, use contact information that was known before the message arrived. Confirm the request through a separate channel, document who approved it, and report the original message. This routine addresses the part of phishing that technical controls cannot: persuading a legitimate employee to perform a dangerous action.
Review the plan whenever you add a cloud service, change email providers, introduce a new payment process, or hire someone with administrative access. A layered program works only when each layer is maintained: strong MFA for sign-in, trained people for judgment, filters and updates for routine blocking, and SPF, DKIM, and DMARC for mail claiming to come from your domain.
Frequently Asked Questions
Is SMS MFA worth enabling if a security key is not available?
Yes. CISA ranks SMS and email codes below stronger methods, but they still improve on password-only access. Enable the strongest method your provider supports now and plan a move to a phishing-resistant option.
Can DMARC stop a phishing email from reaching an employee?
Not by itself. DMARC helps receiving systems evaluate mail that claims to come from your domain. It does not authenticate lookalike domains or stop a person from entering credentials on a phishing website.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should every employee receive two physical security keys?
The number depends on your provider, risk model, and recovery policy. Enroll enough approved factors to handle loss or replacement without bypassing MFA, and test the recovery process before relying on keys.
Who should configure SPF, DKIM, and DMARC?
An email or DNS administrator, your provider, or a qualified technician should handle the records when your business lacks that expertise. First identify every legitimate service that sends mail for the domain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
