Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Configure email security as a layered control system: authenticate your organization’s sending domains, filter suspicious messages and attachments, scan URLs before delivery and again at click time when your platform supports it, provide a one-click reporting path, and secure mailbox sign-ins with phishing-resistant multifactor authentication (MFA). SPF, DKIM and DMARC reduce abuse of your own domain, but they do not by themselves make inbound email safe.
What an effective email-security design must do
Phishing defense fails when it is treated as a single feature. An attacker may use a legitimate but compromised account, a newly registered domain, a password-protected archive, a link that changes after delivery, or a convincing message that passes basic spam checks. Your controls should therefore cover different points in the attack path:
| Control layer | Primary purpose | Important limitation |
|---|---|---|
| SPF, DKIM and DMARC | Protect the identity of domains your organization uses to send mail and expose unauthorized senders through reports. | They do not automatically reject phishing sent from another organization’s domain. |
| Gateway anti-spam and anti-phishing policies | Score sender, domain, message and reputation signals; quarantine high-confidence threats. | Detection can miss novel, compromised or highly targeted lures. |
| Attachment inspection | Block or analyze risky file types and suspicious content. | Password-protected archives can hide files from inspection. |
| URL scanning at delivery | Inspect destinations before a message reaches a mailbox. | A destination can change after the initial scan. |
| Click-time protection | Recheck a URL when a user follows it, often through a security proxy or rewritten link. | Feature coverage and licensing vary, and no scanner catches every bypass. |
| User reporting and response | Turn suspicious observations into investigation, message removal and account protection. | It only works when the reporting route is easy and non-punitive. |
| Phishing-resistant MFA | Reduce the chance that a stolen password grants mailbox access. | It does not inspect messages or links inside the inbox. |
The order matters operationally. Start with an inventory of sending domains and mail flows, then establish authentication and filtering policy. Add URL and attachment controls, connect them to a reporting process, and protect accounts independently with MFA.
1. Inventory your mail flow before changing policy
Make a written list of every domain and host that sends mail for the organization. Include the primary corporate domain, subsidiary domains, transactional systems, ticketing platforms, marketing systems, printers or applications that send alerts, and approved external services. Record which service sends for each domain, whether it supports DKIM signing, and who owns the configuration.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Checks to complete
- List every organizational domain used in a visible From address.
- Identify authorized IPv4 and IPv6 senders and approved third-party mail services.
- Find systems that send with a subdomain or a return-path domain different from the visible From domain.
- Confirm who receives DMARC aggregate and forensic reports and how those reports will be reviewed.
- Document legitimate forwarding, mailing lists and shared-mailbox workflows that can affect authentication.
Do not move directly to a rejecting DMARC policy while unknown legitimate senders remain. First resolve the inventory and alignment problems so enforcement does not interrupt invoices, password resets or customer notices.
2. Configure SPF, DKIM and DMARC for your sending domains
SPF publishes the servers authorized to send for a domain. DKIM adds a cryptographic signature to messages. DMARC evaluates authentication and alignment with the visible From domain, provides reporting, and lets the domain owner request quarantine or rejection of messages that fail the policy.
Publish SPF precisely
- Collect the IP ranges and include mechanisms required by each authorized sender.
- Publish one SPF TXT record for the domain. Multiple independent SPF records are an error and can cause a permanent failure.
- Keep the record within DNS lookup limits by removing obsolete services and avoiding unnecessary nested includes.
- Test mail from every listed service, including failover and disaster-recovery paths.
SPF authenticates the envelope sender, not necessarily the visible From address. DMARC alignment is therefore essential when a service sends on your behalf.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Enable DKIM signing
- Generate a DKIM key pair in the mail platform or approved sending service.
- Publish the selector’s public key in DNS at the name supplied by that service.
- Enable signing for every relevant domain and subdomain.
- Rotate keys according to your provider’s process and remove selectors that are no longer used.
Check that the DKIM signing domain aligns with the visible From domain under your chosen DMARC alignment mode. A valid signature from an unrelated service domain may not satisfy DMARC alignment.
Start DMARC in monitoring mode, then enforce
- Publish a DMARC record with a reporting address and a monitoring policy.
- Review aggregate reports for legitimate sources, failures, alignment errors and unexpected senders.
- Correct authorized services that are failing SPF, DKIM or alignment.
- Move selected domains or subdomains to quarantine when the report data is understood.
- Move organizational sending domains to a reject policy after validating legitimate traffic.
CISA’s joint phishing guidance states: Ensure DMARC is set to ‘reject’ for sent emails [CPG 2.M].
This recommendation concerns email sent using your organization’s domain. It makes impersonation of that domain harder when receiving systems honor DMARC, but it does not tell every receiving organization to reject messages from other domains. DMARC is not a standalone inbound phishing filter.
Keep transport protection separate
Use STARTTLS on internet-facing mail servers where supported and configured correctly. STARTTLS protects the connection between mail systems when both sides negotiate encryption; it does not authenticate the sender, inspect a URL or determine whether a message is phishing. Treat transport encryption, domain authentication and content inspection as separate controls.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Turn on inbound anti-spam and anti-phishing defenses
Use your mail platform’s threat policies to quarantine high-confidence phishing and to score suspicious messages using sender reputation, authentication results, impersonation signals, language, headers and behavior. The exact names differ by platform, but the policy objectives are consistent.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Recommended policy decisions
- Quarantine high-confidence phishing rather than delivering it to a user’s inbox.
- Apply stricter handling to messages that impersonate executives, finance staff, suppliers or known domains.
- Flag or quarantine messages that fail authentication when the failure is inconsistent with the sender’s normal behavior.
- Enable external-mail indicators if they help users distinguish internal and outside messages.
- Filter known malicious indicators supplied by your security team or trusted intelligence sources.
- Define who can release quarantined mail and require a reason or review trail.
External labels are a recognition aid, not proof that a message is dangerous. An attacker can send from a legitimate external service, while a compromised internal account can send a malicious message without an external label.
Design quarantine for both safety and operations
Set a quarantine retention period that allows investigation without creating an unmanageable backlog. Give administrators a clear queue, message context, authentication results and the ability to search for related messages. Let users report false positives, but avoid unrestricted self-release of high-confidence phishing. A release should trigger re-evaluation and, where possible, a check that the same message was not delivered elsewhere.
4. Set attachment controls that account for evasion
Attachment rules should reflect the organization’s actual work. Block file types that are not needed for business, quarantine executable content and scripts, and inspect office documents, PDFs and archives for malicious behavior where the platform supports it.
Use layered attachment rules
- Block or quarantine executable and script-capable extensions that users do not need.
- Inspect compressed files and nested archives, subject to size and depth limits.
- Apply heightened scrutiny to documents that request macros, credential entry or security-setting changes.
- Use sandbox or detonation analysis when available for suspicious files.
- Review rules periodically as attackers change file types and delivery methods.
Password-protected archives are a known evasion technique because scanners cannot inspect their contents without the password. You can quarantine them, block them from untrusted senders, or route them for a controlled review process. Do not assume that a password-protected archive is safe merely because ordinary antivirus scanning reports no detection.
5. Scan URLs before delivery and at click time
URL defense works best at two points. First, inspect links before the message is delivered. Second, check the destination when a user clicks, because a benign page can later redirect to a credential-harvesting or malware site.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to enable
- Reputation and threat analysis for URLs and linked files before delivery.
- Real-time checks when a user follows a protected link.
- Coverage for internal messages as well as external messages where the platform supports it.
- Protection in supported desktop and mobile mail clients.
- Click-time checks in collaboration applications if your organization uses them for link sharing.
URL rewriting or proxying can let a service evaluate a destination at click time. Explain to users that a rewritten link is a security control, not evidence that the destination is trustworthy. Scanning may still miss a short-lived page, a compromised legitimate site, a malware payload delivered only to selected visitors or a technique designed to evade automated analysis.
Microsoft 365 example: Safe Links
In Microsoft 365 Defender, the CISA minimum viable secure configuration baseline identifies this policy path: Email & collaboration > Policies & rules > Threat policies > Safe Links.
- Open the Safe Links policy area and create or edit the policy that applies to the tenant’s users and domains.
- Enable URL scanning before delivery and real-time scanning for suspicious links and linked files.
- Enable protection for internal messages if your policy requires links exchanged inside the organization to be checked.
- Configure the policy to wait for scanning to complete before delivery where that option is available.
- Enable Safe Links checks in supported Office applications and Teams when those workloads are in scope.
- Test a benign URL in a pilot group, confirm the click warning experience, and review event logs before broad deployment.
The baseline states that Safe Links policies require Defender for Office 365 Plan 1 or Plan 2. Product names, interface labels and licensing can change, so verify the current tenant documentation and license assignment before applying these settings. The Microsoft-specific path is an example, not a universal procedure for every mail platform.
6. Give employees a safe, immediate reporting route
Every user should know exactly how to report a suspicious message, a malicious link warning or a message they already opened. Use a built-in report-phishing action when available, or publish a monitored security address and a short procedure.
Define what happens after a report
- Preserve the original message and relevant headers when the platform permits it.
- Automatically acknowledge receipt so the reporter knows the submission worked.
- Have the security team determine whether the message is malicious, benign or uncertain.
- Search for matching messages and remove confirmed threats from other mailboxes.
- Block confirmed domains, URLs, senders or hashes using the organization’s gateway controls.
- Check whether the reporter clicked, submitted credentials, opened an attachment or disclosed data.
- Escalate account compromise, financial fraud or regulated-data exposure under the incident-response plan.
Do not discourage reporting because a user clicked first. CISA guidance specifically encourages reporting suspicious messages and links, including after interaction with a lure. The sooner the report arrives, the sooner you can revoke sessions, reset credentials and remove related messages.
7. Protect mailbox access with phishing-resistant MFA
Email filtering cannot help if an attacker signs in using a stolen password and reads or sends mail from the real account. Require MFA for all email accounts, administrators and service identities that support interactive sign-in. Prefer phishing-resistant FIDO or PKI-based methods where feasible.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Optional hardware security key
A FIDO2/WebAuthn security key can provide a physical sign-in factor for compatible accounts and devices. Before purchasing or issuing one, verify support from the identity provider, operating system, browser, mobile device and account-recovery process. Provide at least one recovery method that does not undermine the phishing-resistant design.
A security key reduces credential-phishing risk at sign-in; it does not scan received messages, block attachments or inspect destinations. Keep it as a supplement to gateway, URL and reporting controls.
8. Test the configuration without creating a new risk
Use a controlled pilot group and benign test messages. Do not send live malware or credential-harvesting pages to employees.
Pilot checklist
- Send authenticated mail from every approved legitimate service and confirm SPF, DKIM and DMARC alignment.
- Send a test message from an unauthorized source using your domain and verify the receiving service’s handling after enforcement.
- Submit harmless messages with representative attachment types and confirm quarantine behavior.
- Use a benign URL that triggers a documented security warning in the test policy.
- Test a link that is allowed at delivery but blocked by a click-time policy in a safe sandbox.
- Use the report-phishing action and verify acknowledgement, ticket creation and analyst visibility.
- Confirm that external labels, quarantine notices and warning pages are understandable on desktop and mobile.
- Verify that administrators can search, remove and investigate messages without broad end-user release rights.
9. Monitor signals and tune for false positives
Review authentication reports, quarantine events, URL detections, attachment detections, user reports and click-warning events on a defined schedule. Look for changes rather than relying on a single count. A sudden increase in DMARC failures may indicate a new legitimate sender, a misconfiguration or an impersonation campaign. A spike in user reports can mean a campaign is active, but it can also reflect a newly introduced warning that users do not understand.
Questions for each review
- Which authorized senders are failing SPF, DKIM or alignment?
- Which messages were released from quarantine, by whom and why?
- Are password-protected archives arriving from business partners that need a safer exchange method?
- Which URL categories produce repeated false positives, and can policy exceptions be narrowly scoped?
- Are internal messages and collaboration links receiving the intended protection?
- Do users know how to report a message after clicking?
- Are warning pages, quarantine notices and external labels causing avoidable workarounds?
When creating an exception, limit it by sender, recipient, domain, URL or workflow and document an expiration or review date. Broad allowlists can turn a trusted relationship into a bypass for all inspection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common mistakes and how to correct them
“DMARC is enabled, so inbound phishing is solved.”
DMARC primarily protects domains you control from unauthorized use. Keep inbound anti-phishing, reputation, attachment and URL controls enabled for messages from other domains.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“A valid SPF result proves the message is safe.”
SPF only shows that the sending host is authorized for an envelope domain. A criminal can send from a domain they legitimately control, and a compromised account can produce a valid result.
“Scanning at delivery is enough.”
Destinations can change after delivery. Enable click-time checks where supported and keep the report route available for links that evade automated analysis.
“Password-protected archives passed the scanner.”
Passing inspection may only mean that the contents could not be examined. Quarantine or manually review archives from untrusted sources.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute“Users should investigate the destination themselves.”
Users should report the message and stop interacting with it. Security staff should investigate, remove related messages and assess exposure.
“A security key replaces mail security.”
Phishing-resistant MFA protects account access, not the content of incoming mail. Keep filtering, URL inspection and attachment controls in place.
A practical rollout sequence
- Week 1: map the environment. Inventory domains, senders, mailboxes, third-party services, forwarding paths and administrators.
- Week 2: establish authentication. Publish or correct SPF, enable DKIM, start DMARC reporting and deploy STARTTLS on internet-facing mail servers where supported.
- Week 3: strengthen gateway policy. Quarantine high-confidence phishing, define attachment rules, enable external indicators and assign quarantine ownership.
- Week 4: pilot URL protection. Test delivery scanning and click-time checks with a representative user group, including internal mail and collaboration workloads where applicable.
- Week 5: enforce and educate. Move DMARC toward quarantine and then reject after legitimate sources are aligned; teach users the reporting action and post-click procedure.
- Ongoing: review and respond. Analyze reports, tune exceptions narrowly, rotate authentication keys, test recovery and investigate every credible user report.
The resulting design has independent layers: authenticated organizational sending, inbound message and attachment filtering, URL checks before delivery and at click time, a response process that welcomes reports, and phishing-resistant account protection. No single layer is expected to identify every lure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
