How to stop phishing emails in Microsoft 365 and Google Workspace: admin settings and when to add a gateway

To stop phishing emails in Microsoft 365, turn on the Standard or Strict preset security policies, add the people and domains attackers are most likely to fake to impersonation protection, keep Safe Links on, and give users the built-in Report button. In Google Workspace, turn on Gmail's advanced phishing and malware settings and publish SPF, DKIM and DMARC. If too much still gets through, put an MX gateway such as iBlockSpam in front and lock down direct delivery.

What protects your mailboxes before you change anything?

Both platforms already filter inbound mail. The question is which extra protections your license includes, and which are switched off.

Microsoft describes a three-step protection ladder in its Defender for Office 365 overview. The built-in security features for all cloud mailboxes (often called Exchange Online Protection, or EOP) block broad, known attacks. Defender for Office 365 Plan 1 adds impersonation protection, phishing thresholds, Safe Links and Safe Attachments. Microsoft lists Microsoft 365 Business Premium and Microsoft 365 E3 as examples that include Plan 1. Plan 2 (for example in Microsoft 365 E5) adds attack simulation training and automated investigation.

In Google Workspace, the protections live under Apps > Google Workspace > Gmail, on the Safety and Spam, Phishing and Malware pages. Some features depend on your edition.

For the wider picture (why email is still the main way in, and how MX routing works), read our business email protection guide.

How do you stop phishing emails in Microsoft 365?

Start with Microsoft's own recommended baseline, then add the protections that are not on by default. Work in the Microsoft Defender portal at security.microsoft.com.

1. 1Turn on a preset security policy. Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies. Microsoft's preset security policies page describes Standard as a baseline for most users and Strict as a more aggressive profile for high-value targets. Most settings are fixed, and Strict is always applied first, then Standard, then any custom policies.
2. 2Add people and domains to impersonation protection. Presets protect your accepted domains automatically, but you must name the people. You can add up to 350 users and 50 custom domains in the Standard or Strict preset. Add executives, finance staff and key suppliers. Microsoft notes that a look-alike domain can pass SPF, DKIM and DMARC, which is why this step matters.
3. 3Check the phishing threshold in custom policies. In Defender for Office 365 anti-phishing policies, the threshold runs from 1 (Standard, the default) to 4 (Most aggressive). Higher values also flag more good mail.
4. 4Leave spoof intelligence on and honor DMARC. Spoof intelligence and the first contact safety tip are available to all cloud mailboxes. The Honor DMARC record policy setting lets you quarantine or reject mail that fails a sender's p=quarantine or p=reject policy.
5. 5Confirm Safe Links is active. Safe Links scans URLs during mail flow and checks them again when a user clicks. If you have at least one Defender for Office 365 license, the Built-in protection preset applies Safe Links to anyone not covered by another policy. Keep Let users click through to the original URL turned off.
6. 6Turn on the Report button. In user reported settings, enable the built-in Report button. Per Microsoft's reporting guide, users can then report phishing from supported Outlook apps, and reports go to Microsoft, a reporting mailbox, or both.
7. 7Run the configuration analyzer. The configuration analyzer compares your policies with the Standard and Strict settings and lists every weaker setting.

Microsoft 365 quarantine: what users can and cannot release

According to Microsoft's quarantine overview, malware and high-confidence phishing are always quarantined, and only admins can release them. By default, users can work with their own spam, bulk, phishing and spoof detections. Quarantine policies set what users may do and whether they get notifications. Spam held by the default policy expires after 15 days (adjustable from 1 to 30); the presets keep it for 30 days. Turn on notifications so wanted mail is released before it is deleted.

How do you stop spam and phishing in Google Workspace?

In Gmail, the biggest gains come from the advanced Safety settings and from authenticating your own domain. You need the Gmail Settings admin privilege.

1. 1Open Gmail Safety. Go to Apps > Google Workspace > Gmail > Safety. Google's advanced phishing and malware protection page groups the controls into three areas: attachments, links and external images, and spoofing and authentication.
2. 2Turn on each protection and choose an action. The default action is "Keep email in inbox and show warning". You can instead move mail to spam, or send it to an admin quarantine where users get no notice.
3. 3Tick "Apply future recommended settings automatically" in each area, so new protections from Google are switched on for you.
4. 4Enable enhanced pre-delivery message scanning. Under Spam, Phishing and Malware, this setting briefly delays suspicious messages so Gmail can run extra checks before delivery.
5. 5Turn on Security Sandbox if your edition has it. Security Sandbox opens attachments in a virtual environment. It is off by default, can delay delivery by up to 3 minutes, and is listed for Business Standard, Business Plus, Enterprise and Frontline Plus editions.
6. 6Apply settings at the top-level organization so every user is covered. Changes can take up to 24 hours.

Do SPF, DKIM and DMARC on your domain stop inbound phishing?

They stop attackers from sending as your exact domain. They do not stop look-alike domains or compromised outside accounts.

• SPF (RFC 7208) lists the servers allowed to send for your domain. See Google's SPF guide for the Workspace value.
• DKIM (RFC 6376) signs each message. In Google Workspace, generate the key under Gmail > Authenticate email, publish it, then click Start authentication (Google's DKIM guide recommends 2048 bits).
• DMARC (RFC 7489) tells receivers what to do when both checks fail. Google's DMARC guide says to wait 48 hours after SPF or DKIM, start with p=none, then move to quarantine or reject.

An inbound gateway does not change your SPF record. Add a service to SPF only if you send outbound mail through it.

When should you add a third-party spam filter in front of Microsoft 365 or Google Workspace?

Add a gateway when tuning the built-in filter no longer fixes the problem, or when you need features it does not give you. It is a second layer, not a replacement.

Microsoft is direct about the trade-offs. Its guide to integrating non-Microsoft security services lists more cost, more complexity and more false positives as products are added. It also says "total protection never reaches 100 percent." Common reasons to add a gateway anyway:

• Spam or phishing still reaches inboxes after you apply Standard or Strict settings.
• Your license does not include Defender for Office 365, and per-user add-ons cost more than your budget allows.
• You want one quarantine and one set of rules for several domains or mail platforms, with a simple personal quarantine for each user.

Microsoft fully supports the setup where MX points to the gateway and Enhanced Filtering for Connectors is on. It recommends avoiding in-and-out routing, where mail leaves Microsoft 365 for scanning and comes back.

How do you add a gateway filter in front of Microsoft 365?

You create a Partner inbound connector, turn on Enhanced Filtering, move MX, then lock the tenant so only the gateway can deliver. Order matters.

1. 1Lower the MX TTL to about 300 seconds a day before the change.
2. 2Create a Partner inbound connector in the Exchange admin center (Mail flow > Connectors), for all sender domains (*), requiring TLS. Leave restrictions off for now.
3. 3Turn on Enhanced Filtering for Connectors at security.microsoft.com/skiplisting. Without it, Microsoft explains, every message appears to come from the gateway's IP, so spoof checks lose accuracy. Enter the gateway's IP ranges, or choose "Automatically detect and skip the last IP address" for a single hop. A pilot on a few users must list every address of each recipient.
4. 4Change the MX record to the gateway's hosts. Do not keep Microsoft's MX as a backup. RFC 5321 section 5.1 has senders fall back to other listed MX hosts, and spammers can target the backup directly.
5. 5Lock down the connector once the old TTL has passed. Microsoft's third-party cloud routing guide says to restrict the Partner connector by the gateway's TLS certificate (preferred) or IP addresses. Mail sent straight to your tenant is then rejected.
6. 6Remove any SCL -1 bypass rule. Microsoft calls SCL -1 "an input to filtering, not a final decision" and warns that bypassing shared gateway IPs can let spoofed and phishing mail through.
7. 7Turn off link rewriting in the gateway if you use Safe Links. Microsoft warns that double link wrapping can stop Safe Links from checking links.

Microsoft's opt-in RejectDirectSend setting (announcement) also blocks anonymous messages that use your own domains as the sender. Move scanners and apps that use Direct Send first.

How do you add a gateway filter in front of Google Workspace?

In Gmail, the key setting is Inbound gateway. It tells Gmail which IPs to look past so it judges the real sender.

1. 1Lower the MX TTL a day ahead.
2. 2Open Inbound gateway under Apps > Google Workspace > Gmail > Spam, Phishing and Malware at the top-level organization. Google's inbound gateway guide lists every option.
3. 3Add the gateway IPs. Only public IPs are accepted. List every gateway the mail passes through.
4. 4Select "Automatically detect external IP" so Gmail uses the original sender's IP for SPF.
5. 5Select "Require TLS for connections" and save. Leave "Disable Gmail spam evaluation" off, so Gmail stays a second layer.
6. 6Wait for the setting to apply (up to 24 hours), then change MX to the gateway's hosts. Do not keep Google's MX as a backup.
7. 7Select "Reject all mail not from gateway IPs" after the old TTL has expired and test mail arrives through the gateway.

One limit to know: Google states that "Gmail does not enforce the sender's DMARC policy for messages that arrive from the inbound gateway." Your gateway must handle spoofing checks for that mail.

Before you lock anything down, send a test message from an outside account and read its headers. The hop just before Microsoft 365 or Gmail should be the gateway, and SPF should name the original sender's IP. To roll back, remove the lockdown first and point MX back second, or the tenant will reject mail that arrives directly.

How iBlockSpam does this

iBlockSpam is a BroadNet Group brand (see all our brands). It is an inbound filter that works at the MX level. You point your domain's MX records at its filtering servers. Every message is checked for spam, viruses, malware, phishing and spoofing. Clean mail goes on to the platform you already use: Microsoft 365, Google Workspace, cPanel/WHM, Exchange or another server. Mailboxes do not move (how it works).

Here is what the iBlockSpam website states about the product:

• Per-domain pricing. Protect costs $12 per domain per month billed annually ($144 a year), or $15 month to month. Protect Plus costs $19 per domain per month billed annually ($228 a year), or $24 month to month. Prices on the pricing page are beta prices in USD, excluding tax.
• Every mailbox included. Mailboxes and domain aliases on a domain have no per-mailbox charge. Each domain includes 100,000 inbound messages a month and a 400 MB maximum message size.
• Personal quarantine for every user, with digest emails hourly, daily, on a chosen weekday or on a custom schedule. Admins also get a shared domain quarantine. See quarantine and digests.
• Filters and lists. Geographic, attachment-type and Microsoft Office macro filters, custom domain rules, and allow and block lists with sender verification.
• Guided setup. A wizard shows your current DNS and the new values side by side, and records rollback steps. The Microsoft 365 setup page covers the Partner connector, Enhanced Filtering and connector lockdown. The Google Workspace setup page covers the Inbound gateway setting.
• Outage spooling. If your mail server is down, mail is held for up to 5 days. Message history is kept for 30 days.
• Monitoring. MX, SPF and DMARC drift alerts (weekly on Protect, daily on Protect Plus), DMARC report monitoring and daily Lookalike Domain Watch. Protect Plus adds a monthly owner report and a human setup session.

The site is also clear about limits. There is no free trial; instead, a domain's first annual subscription has a 30-day money-back guarantee. Month-to-month fees are not refundable. Mail is processed in the United States. No filter catches everything, so some spam will get through and some wanted mail will be held. Lookalike Domain Watch detects look-alike domains but cannot take them down. DMARC monitoring reports but does not block mail.

Phishing also arrives by text message; see our smishing defense guide. For sending transactional mail, see BroadNet's email service.

Ready to see where your domain stands? Run the free Email Health Check to read your MX, SPF, DKIM and DMARC records, then compare plans on the iBlockSpam pricing page and create your account to start the guided setup for Microsoft 365 or Google Workspace.

Frequently asked questions

What are the Standard and Strict preset security policies in Microsoft 365?

They are Microsoft's ready-made protection profiles for email. Standard is a baseline for most users. Strict is more aggressive and suits high-value targets such as executives and finance staff. Most settings cannot be edited. Where Defender for Office 365 is licensed, they also cover Safe Links, Safe Attachments and impersonation protection. Turn them on in the Microsoft Defender portal under Threat policies.

Do I need Defender for Office 365 to stop phishing in Microsoft 365?

Not for basic protection. Every cloud mailbox gets anti-spam, anti-malware, spoof intelligence and quarantine. Impersonation protection, phishing thresholds, Safe Links and Safe Attachments need Defender for Office 365 Plan 1 or Plan 2. Microsoft lists Microsoft 365 Business Premium and E3 as examples that include Plan 1, and E5 as an example that includes Plan 2. Defender for Office 365 is also sold as an add-on.

How long does Microsoft 365 keep quarantined email?

It depends on why the message was held. Spam quarantined by the default anti-spam policy is kept for 15 days, and admins can set 1 to 30 days. The Standard and Strict preset policies keep it for 30 days. After the retention period, messages are permanently deleted and cannot be recovered.

Which Gmail settings should a Google Workspace admin turn on against phishing?

Open Apps, Google Workspace, Gmail, Safety in the Admin console. Turn on the attachment, links and external images, and spoofing and authentication protections, and tick Apply future recommended settings automatically. Under Spam, Phishing and Malware, enable enhanced pre-delivery message scanning, and Security Sandbox if your edition includes it. Apply settings at the top-level organization so every user is covered.

Can I add a third-party spam filter to Google Workspace?

Yes. First add the filtering service's public IP ranges in the Inbound gateway setting under Spam, Phishing and Malware, and select Automatically detect external IP and Require TLS. Then point your MX records to the service. Once mail flows through it, select Reject all mail not from gateway IPs. Google does not enforce the sender's DMARC policy for gateway mail, so the gateway must check spoofing.

What breaks if I lock Microsoft 365 to accept mail only from a gateway?

Anything that delivers straight to your tenant stops working. This includes scanners, printers and line-of-business apps that use Direct Send to the mail.protection.outlook.com host. Move them to authenticated SMTP submission or their own connector first. Lock the connector only after the old MX TTL has expired and test mail arrives through the gateway.

Does a gateway filter replace Microsoft 365 or Gmail spam filtering?

No. It sits in front as a first layer. Microsoft 365 always scans inbound mail, and with Enhanced Filtering for Connectors it judges the original sender instead of the gateway. Gmail keeps scanning too unless you disable its spam evaluation for gateway mail, which is usually not recommended. Two layers catch more but add cost.