Business email protection in 2026: how spam and phishing filtering works for Microsoft 365, Google Workspace and cPanel

Business email protection in 2026 means putting a filter in front of every mailbox on your domain. You point the domain's MX records at a filtering gateway, which checks each inbound message for spam, phishing, malware and spoofing and then passes clean mail on to Microsoft 365, Google Workspace, cPanel/WHM or Exchange. SPF, DKIM and DMARC protect your own domain from being forged. iBlockSpam, BroadNet's email protection service, works this way, at a fixed price per domain.

Why business email is still the main way in

The FBI's 2025 Internet Crime Report counted 1,008,597 complaints and $20.877 billion in reported losses. Phishing/spoofing was the most-reported crime type, with 191,561 complaints. Business email compromise (BEC) had far fewer complaints, 24,768, but the reported losses came to $3,046,598,558, up from $2,770,151,146 in 2024. Among cyber-enabled fraud types, only investment fraud cost victims more. The report also notes that businesses reported more than $30 million in losses to BEC scams that involved AI.

These numbers only cover complaints filed with IC3, so they show the trend rather than the full cost. They also show that the two threats work together. Phishing is the volume attack. BEC is the payoff, where a convincing email from a "supplier" or an "executive" asks someone to change bank details or approve a transfer. IC3 defines phishing as unsolicited email, text messages and phone calls, so the same playbook also runs over SMS. Our guide to smishing defense covers the text-message side.

How inbound filtering works: the MX record decides

Under SMTP (RFC 5321), a sending server looks up the MX records for your domain to find out where to deliver mail. Whatever those records point to sees every inbound message first. A filtering gateway changes the route from "sender → your mail server" to "sender → gateway → your mail server". The gateway accepts the connection, checks the sender's reputation and authentication, scans links and attachments, and either delivers the message, quarantines it or rejects it.

Your mailboxes do not move. Users keep the same apps, passwords and folders. Two settings matter more than anything else. First, every MX record has to point to the gateway, because a forgotten backup MX that still points straight at your mail server lets attackers skip the filter. Second, your mail platform should accept inbound internet mail only from the gateway. Microsoft's built-in protection keeps running behind the gateway, so you end up with two independent layers instead of one.

Microsoft 365, Google Workspace and cPanel: platform specifics

Microsoft 365 and Exchange Online

Microsoft documents this setup in Manage mail flow using a third-party cloud service. The MX record points to the filtering service, and you create a Partner inbound connector that only accepts mail arriving from the service's certificate or IP addresses. Without it, attackers can send directly to your tenant and bypass the filter. Microsoft "strongly recommends" turning on Enhanced Filtering for Connectors, also called skip listing. With a gateway in front, every message arrives from the gateway's IP address. Enhanced Filtering preserves the original source IP and sender information, so Microsoft's SPF, DKIM, DMARC and anti-spoofing checks still see the real sender. Microsoft advises against simply bypassing spam filtering for the gateway's IPs, because those addresses are often shared between many customers.

Google Workspace

In Google Workspace, you register the filter as an inbound mail gateway in the Admin console, list its IP addresses and, optionally, reject all mail that does not come from the gateway. Google notes that Gmail does not enforce the sender's DMARC policy on messages that arrive through the gateway, though it still uses the authentication results to fight spam and phishing. Your gateway should therefore do its own SPF, DKIM and DMARC checks.

cPanel/WHM and on-premises Exchange

Hosting servers and self-managed Exchange follow the same MX logic. Before you change DNS, confirm which server actually receives mail for the domain. Then point the MX at the gateway, set the gateway to deliver to your server, and restrict inbound SMTP to the gateway's addresses where your setup allows it. Lower the MX record's TTL a day ahead so that both the change and any rollback take effect quickly.

SPF, DKIM and DMARC: protecting your own domain

Inbound filtering protects your users. Domain authentication protects everyone who receives mail that claims to come from your domain. Each of the three standards proves something different:

• **SPF** (RFC 7208) publishes which servers may send mail for your domain. Checks are capped at 10 DNS-querying mechanisms, so a record with too many "include" entries fails.
• **DKIM** (RFC 6376) adds a cryptographic signature that receivers verify against a public key published in your DNS. It proves that the signing domain sent the message and that the message was not altered.
• **DMARC** (RFC 7489) ties SPF or DKIM to the domain in the visible From: address, tells receivers what to do when a message fails (none, quarantine or reject), and sends you reports on who is sending as your domain.

In May 2026 the IETF published RFC 9989, the updated DMARC specification (the "DMARCbis" work), on the Standards Track. It obsoletes RFC 7489, and two companion RFCs, 9990 and 9991, cover aggregate and failure reporting. Existing DMARC records keep working. The usual path stays the same: publish p=none, read the reports, fix every legitimate sender, then move to quarantine and finally to reject.

Lookalike domains, impersonation and quarantine

DMARC stops attackers from using your exact domain. It cannot stop them from registering a similar one, with a swapped letter, an added hyphen or a different ending, and sending from there with fully valid SPF and DKIM. Many BEC attempts work this way, which is why a good filter also looks at display-name impersonation, newly seen sender domains and lookalikes of your own name. Monitoring registrations of lookalikes of your domain warns you before one starts sending mail.

Quarantine decides whether people will accept a filter at all. Suspicious mail should be held, not deleted, and each user should be able to see what was held and release a real message without filing a ticket. Admins need a domain-wide view and message history to trace any complaint about missing mail. Microsoft's own service, for example, sends high-confidence phishing straight to an admin-only quarantine by default. Decide in advance who may release what.

What the Gmail, Yahoo and Outlook.com sender rules mean for your domain

Since 1 February 2024, Google's email sender guidelines have required every sender to Gmail accounts to set up SPF or DKIM, use TLS, have valid forward and reverse DNS, and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day must also have SPF, DKIM and DMARC, with the From: domain aligned, and support one-click unsubscribe for marketing mail. Yahoo's Sender Hub sets the same baseline: SPF or DKIM for everyone, both plus DMARC of at least p=none for bulk senders, a spam rate below 0.3%, and unsubscribes honored within 2 days. Yahoo says it does not publish a volume threshold for who counts as a bulk sender.

Microsoft followed for Outlook.com consumer addresses (hotmail.com, live.com, outlook.com). Its April 2025 announcement requires domains sending more than 5,000 emails a day to pass SPF and DKIM and to publish DMARC of at least p=none, aligned with SPF or DKIM. From 5 May 2025, non-compliant mail is rejected with the error "550; 5.7.515 Access denied". For a typical business this has two consequences. Every platform that sends as your domain, such as your CRM, invoicing tool or marketing platform, needs aligned authentication. And once DMARC is enforced, it also makes your domain much harder to forge against your own customers. For transactional and marketing sending, BroadNet's Email service handles authenticated sending through SMTP and API.

Checklist: choosing an inbound email filter

1. 1Does it work in front of your platform (Microsoft 365, Google Workspace, cPanel/WHM, Exchange) using the vendor's documented method, such as a connector with Enhanced Filtering, or an inbound gateway?
2. 2Does it check SPF, DKIM and DMARC on inbound mail itself, and detect display-name and lookalike-domain impersonation?
3. 3Does every user get a personal quarantine with digests, plus an admin view and searchable message history?
4. 4What happens if your mail server goes down? Look for a stated spooling period.
5. 5Is pricing per user or per domain, and what message volume and size limits come with it?
6. 6Does the setup record your current DNS and give rollback steps, and does anything monitor MX, SPF and DMARC for drift afterwards?
7. 7Where is mail processed, what is stored, and for how long?
8. 8Are refund terms, cancellation and how to leave written down before you sign?

Email is only one channel. If your customers receive one-time codes or alerts by text, apply the same discipline there. See our SMS OTP security standards guide, and use MobileValidate to check phone numbers and email addresses before you send.

How iBlockSpam fits

iBlockSpam is part of the BroadNet family of brands. According to its How it works page, you point your MX records at iBlockSpam's filtering servers, and every inbound message is checked for spam, viruses, malware, phishing and spoofing before clean mail goes to the server you already use. The steps are check, configure, verify and monitor. A guided wizard shows current and new DNS side by side and saves rollback steps. iBlockSpam does not edit your DNS for you. Its published facts:

• Works with Microsoft 365, Google Workspace, cPanel/WHM, Exchange and other mail servers.
• Personal quarantine for every user with scheduled digests, a shared admin quarantine and 30 days of message history.
• If your mail server is down, mail is held for up to 5 days and delivered when the server is back.
• Unlimited mailboxes and domain aliases. Each domain includes 100,000 inbound messages a month, a 400 MB maximum message size and 500 outbound relay messages with DKIM signing.
• Lookalike Domain Watch, DMARC report monitoring and MX/SPF/DMARC drift alerts (weekly on Protect, daily on Protect Plus).
• Mail is processed in the United States.

Pricing is per domain, in USD, excluding tax: **Protect** costs $12 per domain per month billed annually ($144 a year) or $15 month-to-month. **Protect Plus** costs $19 billed annually ($228 a year) or $24 month-to-month and adds daily monitoring, a monthly owner report and a human setup session. There is no free trial. Instead, a domain's first annual subscription has a 30-day money-back guarantee. The free Email Health Check reads your MX, SPF, DMARC and common DKIM selectors without an account. BroadNet's wider security approach and Trust Center cover the group's certifications.

Frequently asked questions

Is Microsoft 365's built-in spam filter enough for a business?

For some organizations it is. Microsoft 365 includes anti-spam, anti-malware and anti-phishing protection for every cloud mailbox, and it is on by default. A separate gateway adds an independent layer in front of it, with its own detection, personal quarantines, outage spooling and per-domain controls. If you add one, follow Microsoft's documented setup: a locked-down Partner connector with Enhanced Filtering for Connectors turned on.

What is an MX-level spam filter?

An MX-level spam filter is a service that your domain's MX records point to, so it receives all inbound email before your mail server does. It checks each message for spam, phishing, malware and spoofing, delivers clean mail to your existing platform, and holds suspicious mail in quarantine. Your mailboxes, apps and passwords stay the same. Only the route mail takes to reach them changes.

What is Enhanced Filtering for Connectors in Exchange Online?

Enhanced Filtering for Connectors, also called skip listing, is a Microsoft 365 setting for inbound connectors that receive mail from a service sitting in front of Exchange Online. It looks past the gateway's IP address to the original sender, so Microsoft's SPF, DKIM, DMARC and anti-spoofing checks evaluate the real source. Microsoft strongly recommends it whenever your MX record points to a non-Microsoft filter.

Do SPF, DKIM and DMARC stop phishing emails?

They stop one kind of phishing: mail that forges your exact domain. With DMARC at quarantine or reject, receivers can block messages that falsely use your From: address. They do not stop lookalike domains, compromised accounts at real suppliers, or phishing sent from properly authenticated free accounts. Those need inbound filtering, impersonation checks and staff who verify payment changes through a second channel.

What changed with the Gmail, Yahoo and Outlook.com bulk-sender rules?

Since February 2024, Gmail (above 5,000 messages a day) and Yahoo (bulk senders, with no published threshold) require SPF and DKIM, DMARC of at least p=none with alignment, one-click unsubscribe and spam rates below 0.3%. Since 5 May 2025, Outlook.com rejects non-compliant mail from high-volume domains with error 550 5.7.515. Every sender needs at least SPF or DKIM.

What is the difference between phishing and business email compromise?

Phishing is the broad category: unsolicited messages that impersonate a trusted organization to steal credentials, money or data. Business email compromise is a targeted fraud against companies that pay suppliers or move funds by wire, using a compromised or impersonated email account to redirect payments. The FBI's 2025 IC3 report recorded 191,561 phishing/spoofing complaints and 24,768 BEC complaints, with $3.05 billion in BEC losses.

Will an email filter block legitimate messages?

Any filter can misjudge a message, so the safeguard is quarantine rather than deletion. Look for a personal quarantine with regular digests so users can release a held message themselves, a shared admin quarantine, approved-sender lists for known contacts, and message history to trace what happened. iBlockSpam, for example, provides each of these and keeps 30 days of message history.

How much does iBlockSpam cost?

iBlockSpam is priced per domain with unlimited mailboxes. Protect costs $12 per domain per month billed annually ($144 a year) or $15 month-to-month. Protect Plus costs $19 billed annually ($228 a year) or $24 monthly and adds daily DNS monitoring, a monthly owner report and a human setup session. Prices are in USD excluding tax. There is no free trial, but first annual subscriptions carry a 30-day money-back guarantee.

Ready to see where your domain stands? Run the free Email Health Check on iBlockSpam, then compare the Protect and Protect Plus plans. Setup is an MX change plus guided platform steps, and your mailboxes stay where they are.