Protect domain from spam, phishers and viruses
Spam, phishing, and viruses enter an organization through email, so the domain must be protected on more than one level. An email hygiene service filters the mail in both directions, and SPF, DKIM, and DMARC records stop attackers from spoofing the domain. In this guide you will learn how to protect a domain from spam, phishing, and viruses and how to verify the protection is working.
Protect the domain with an email hygiene service
Every organization that uses email needs a spam filter protecting incoming and outgoing mail, regardless of whether the mailboxes run on Exchange Server or Exchange Online. A cloud-based hygiene service scans every message before it reaches the mailboxes and before it leaves the organization.
A good email hygiene service is easy to use, runs in the cloud so there is no downtime and no dedicated server to maintain, filters mail in both directions, and can send automatic reports that monitor all incoming and outgoing messages.
Incoming and outgoing filtering
The service sits between the internet and the mail server. Incoming mail is scanned before it is delivered, and outgoing mail is scanned before it reaches the recipient.
Route the domain MX records to the hygiene service so incoming mail arrives there first, and configure the mail server to send outgoing mail through the service. The service then reports which sender sends unusual volumes of mail.
Protect the domain with SPF, DKIM, and DMARC
A spam filter alone is not enough. The three email authentication records tell receiving servers which hosts may send mail for the domain and what to do with mail that fails authentication.
Publish all three records for every domain that sends mail. A missing record leaves the domain open to spoofing and makes legitimate mail more likely to be treated as spam.
Check the domain protection
Verify that the records are in place and that the authentication is configured correctly.
Frequently asked questions
What protects a domain from spam and phishing?
An email hygiene service filters mail in both directions, and SPF, DKIM, and DMARC records stop attackers from spoofing the domain.
Does every organization need a spam filter?
Yes. Any organization that uses email should run a spam filter for incoming and outgoing mail, no matter which mail platform it uses.
Which DNS records should every domain have?
SPF, DKIM, and DMARC. All three records are needed for maximum protection against spam and spoofing.
How do I check that the domain is protected?
Run an online DMARC domain check for the records, and send an email to a TLS mail test service to review the authentication report.
Does a spam filter replace SPF, DKIM, and DMARC?
No. The records and the filter work together. The filter blocks the messages, and the records tell receiving servers which senders are legitimate.