The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Protecting a small business from email phishing takes more than switching on an AI filter. Start with the strongest anti-phishing controls your email plan includes, authenticate every legitimate sender for your domain with SPF, DKIM and DMARC, require multifactor authentication (MFA), and give employees a clear way to report suspicious messages. The exact controls and setup depend on your email provider, subscription, DNS host and the services that send mail for your business.
What AI-powered email protection can—and cannot—do
Email providers use filtering to identify suspicious messages, but no filter guarantees that every phishing email will be stopped. Detection and impersonation features vary by provider and plan. Microsoft, for example, documents baseline protections for cloud mailboxes as well as separate, more advanced capabilities in Defender for Office 365. Check what your subscription actually includes before relying on advanced detection or impersonation controls.
As an Amazon Associate I earn from qualifying purchases.
Filtering is only one layer. SPF, DKIM and DMARC help receiving systems authenticate messages claiming to come from your company’s domain. They do not stop every message sent from a lookalike domain, nor do they protect a legitimate account that an attacker has taken over. Use filtering alongside account security and an employee reporting process.
Recommended Free Tools
How do I set up phishing protection for a small business?
1. Identify your email provider, plan and administrators
Confirm whether your business uses Microsoft 365, Google Workspace or another hosted email service. Identify who can administer email security and who controls the domain’s DNS records. Review your subscription before enabling or planning around features such as advanced AI or machine-learning detection, impersonation protection or link scanning; availability depends on the plan.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In Microsoft 365, review the built-in protections and anti-phishing policy options available to your organization. Microsoft documents a default anti-phishing policy for recipients, while advanced controls depend on Defender entitlement. Where available, Standard or Strict preset security policies can be a starting point, but review their effects before applying them and avoid casual exceptions. Google’s small-business security checklist is designed to help organizations without dedicated IT administrators review account and phishing or spoofing protections.
2. Inventory every service that sends mail as your domain
Before changing DNS, list every legitimate sender that uses your business domain. Include your main email host, website or contact forms, invoicing and CRM tools, marketing services, scanners and other business applications. Confirm each sender with its administrator or vendor. Google’s SPF guidance specifically recommends identifying third-party sending services before preparing an SPF record.
This inventory matters because an incomplete SPF record or an enforcement policy introduced too soon can interfere with legitimate business email. Add new senders to the inventory whenever you adopt an application that sends messages using your domain.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Configure SPF and DKIM, then introduce DMARC gradually
Set up SPF and DKIM using the current instructions from your email provider and DNS host. SPF identifies authorized sources that can send mail for your domain. DKIM adds a domain-associated signature that receiving systems can check. DMARC tells receiving systems how to handle messages that fail authentication and enables reporting.
Do not copy a generic DNS record without checking it against your verified sender inventory. The correct record values depend on your provider and all the services that send mail for your domain.
Roll out DMARC in stages. Google recommends starting with a monitoring policy and reviewing reports, then moving to quarantine for a small percentage of messages after confirming legitimate mail is passing. Increase enforcement as confidence grows; the pace should reflect your mail volume and how complete and reliable your sender inventory is. If you cannot identify senders, manage DNS or interpret reports, get qualified help. The Federal Trade Commission notes that correct configuration can require expertise: Cybersecurity for Small Business.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
4. Enable anti-phishing and impersonation protections
In your provider’s security console, confirm that anti-phishing protection covers every mailbox. If your plan supports impersonation protection, configure it for your organization’s domain and high-risk people, such as executives or employees who approve payments. Review available first-contact notices, spoof intelligence, quarantine behavior and reporting controls.
Microsoft documents spoof-related protections for cloud mailboxes and additional impersonation protections and enhanced detection with Defender for Office 365. The specific settings available depend on your Microsoft subscription. Similar feature names at different providers should not be assumed to offer identical coverage.
If a legitimate message is blocked, investigate the reason and correct authentication or routing when appropriate. Do not broadly allow-list your own domain to solve false positives: Microsoft warns that doing so could let malicious messages bypass filtering. Review Microsoft’s guidance on the Tenant Allow/Block List.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Require MFA and make reporting easy
Require MFA for business email accounts where the provider supports it. If you need to phase in enrollment, start with administrator, finance and executive accounts. Prefer a phishing-resistant method, such as a compatible passkey or security key, when supported by the provider, account setup and employee devices. Google identifies security keys as its most secure form of 2-Step Verification and says they protect against phishing; check Google’s guidance on protecting business accounts for applicable options.
A compatible FIDO2 hardware security key can be one way to secure an account, but it is not an email filter or a complete phishing solution. Confirm compatibility before choosing an authentication method.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Show employees how to report suspicious messages using the reporting control in their mail client. Assign someone to review reports and quarantine, investigate suspected account compromises quickly, and look into legitimate messages that are blocked. In Microsoft 365, users can report messages through Outlook’s built-in control, and administrators can review reported messages; see Microsoft’s instructions for reporting messages.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE A Connectivity & DONGLE Design: Designed for PCs, Macs, laptops and Android devices that utilize a USB-A port. Plug and stay, or carry it on a keychain. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
6. Review the controls as your business changes
Check authentication reports for forgotten or newly added senders, review detections and false positives, and confirm protection coverage when you add an application, change email providers or update DNS. Also revisit administrator access and whether required MFA enrollment remains in place. The review screens and reporting tools depend on your provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to check before choosing an email plan
There is no single best email provider or plan for every small business. Compare the capabilities that matter to your setup rather than assuming that the label “AI-powered” guarantees a particular level of protection.
Quick Recap
- Filtering and impersonation coverage: Find out which protections are included in your plan and which require an upgrade, especially advanced detection and protection against messages impersonating your domain or staff.
- Admin visibility and response: Check whether administrators can review reported messages, quarantine and detection history, and how easily employees can report suspicious email.
- Account protection: Confirm whether the provider supports phishing-resistant MFA, and which account and device types can use it.
- Domain authentication: Assess whether you can authenticate all business-domain senders and review DMARC reports with the tools and expertise available to you.
- Support needs: If your team cannot safely administer email policies or DNS, account for the need for qualified provider or managed IT support.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
