Protection against spam and phishing comes from three places, and only one of them is a product feature. Your provider supplies spam filtering and encrypted, access-controlled infrastructure. Your domain configuration — SPF, DKIM, and DMARC — is what stops attackers impersonating you, and it is the highest-leverage control available. Your procedures — verification before payment, and a culture where people report suspicious mail — catch the attacks that defeat both. NevTan Mail includes spam protection and guided authentication setup on every plan, including the free tier.
This guide explains what each layer does, what it cannot do, and how to configure the parts that are yours to configure.
Why Filtering Alone Is Not the Answer
The instinct is to treat spam and phishing as a filtering problem: buy a better filter, get fewer bad emails. That works for spam, which is high-volume and pattern-heavy. It works far less well for the phishing that actually costs businesses money.
The reason is that the expensive attacks contain nothing for a filter to catch. No malicious attachment, no known-bad link, no suspicious payload — just a well-written message from a plausible sender asking someone to do something they do routinely. When an attacker compromises a real vendor's mailbox and sends a real invoice with altered bank details, that message is authentic. It passes every authentication check because it genuinely came from that domain.
The FBI's Internet Crime Complaint Center 2025 Annual Report recorded just over $3 billion in business email compromise losses across roughly 24,700 complaints — second only to investment fraud. Very little of that was stopped or stoppable by a spam filter.
So the honest framing is layered: filtering handles volume, authentication handles impersonation, and procedure handles the rest.
Layer 1: Your Own Domain
This sounds like a branding decision. It is actually the precondition for every other protection.
SPF, DKIM, and DMARC are DNS records published on a domain. If you do not control the domain, you cannot configure them — which means a business running on a free consumer address has no way to stop anyone impersonating it, and no lever to pull when its mail starts landing in spam.
Business email on your own domain is what makes the rest of this possible. See business email on your own domain for the fuller case.
Layer 2: Domain Authentication (The One That Matters Most)
Three DNS records do the heavy lifting against impersonation:
Record | What it does |
|---|---|
SPF | Declares which servers may send mail for your domain |
DKIM | Cryptographically signs outgoing mail so tampering is detectable |
DMARC | Tells receiving servers what to do when SPF or DKIM fails — and reports back who is sending as you |
NevTan Mail generates these records and verifies each one during domain setup, which removes the hand-editing where most misconfiguration originates.
Publishing DMARC is not the same as being protected
This is where most organizations stall, and it is worth being precise about.
Valimail's 2026 State of DMARC Report found that 78% of domains now publish a DMARC record, but only 42% have reached enforcement — a 36-point gap the report calls the "Enforcement Gap." Enforcement moved just from 35% to 42% across 2025, suggesting many organizations published p=none to satisfy the Google, Yahoo, and Microsoft sender mandates and stopped there.
A p=none policy monitors. It blocks nothing.
The staged path:
p=nonefor two to four weeks. Read the reports and identify every legitimate service sending as your domain — CRM, invoicing, helpdesk, marketing platform. There will be more than you expect.p=quarantinefor another two to four weeks. Failures go to spam rather than being rejected, so a missed sender is recoverable.p=reject. Unauthenticated mail claiming your domain is refused outright.
Watch the SPF lookup limit. SPF permits a maximum of 10 DNS lookups. Each sending service consumes some, and exceeding the limit causes permanent failure rather than graceful degradation — a silent break that only surfaces when mail bounces.
And know the boundary: DMARC protects your exact domain. It does nothing about lookalike domains — yourc0mpany.com, your-company.net — because the attacker owns those and can authenticate them perfectly. Lookalikes require defensive registration and trained people, not DNS.
For the full mechanics, see why business emails land in spam and how domain authentication fixes it.
Layer 3: Spam Filtering and Platform Security
NevTan Mail includes spam protection on every plan, including the free tier — it is not an add-on SKU or a premium-tier upsell.
The platform security that surrounds it matters as much as the filter itself:
TLS encryption on every connection between your browser and the service
Session-based authentication with role-based access control
2FA and security key support for protecting accounts beyond passwords
Sentinel security monitoring for continuous detection of suspicious account activity
End-to-end and zero-access encryption, designed so NevTan cannot access the contents of an encrypted mailbox
No ads and no data selling on any plan — your mail is not scanned to build an advertising profile
That last point is a security property, not just a privacy one. Content analysis performed for advertising is a different thing from content analysis performed for threat detection, and knowing which your provider does is worth knowing.
For what each encryption layer actually covers, see email encryption for business.
Layer 4: Compartmentalization With Aliases
An underused defense. NevTan Mail includes unlimited aliases and groups, which means you can give each vendor, service, or signup its own address.
Two benefits. First, when an alias starts receiving spam, you know exactly which service leaked or sold it. Second, you can retire that alias without disrupting anything else — the address stops existing, and the spam stops with it.
For departmental structure, support@ and billing@ as aliases or shared addresses also mean no individual's personal address is exposed on your website, which reduces the targeting surface for spear-phishing aimed at named employees.
Layer 5: Admin Controls and Offboarding
Account takeover is a standard step in serious phishing, so the ability to respond quickly matters.
Role-based access with Admin and Super Admin roles lets you separate who manages domains and billing from who manages mailboxes. Apply least privilege: elevated rights only where the job requires them, which limits the damage when an account is compromised.
When someone leaves, revoke access the same day. A live mailbox belonging to a former employee is an open door, and it is the most common finding in small business security reviews.
Audit admin rights quarterly. Roles change and permissions accumulate.
Layer 6: The One Your Provider Cannot Supply
No filter catches an authentic message from a compromised account. This layer is procedural, it costs nothing, and it prevents more loss than any product on this page.
Out-of-band verification for money. Any request to send a wire, change payment details, update vendor banking, or buy gift cards gets verified through a different channel than the one it arrived on. A phone call to a number you already had — never a number from the email signature. No exceptions for executives, since manufactured urgency and authority are exactly how these attacks work.
A reporting path people actually use. Somewhere to forward anything suspicious, with a clear commitment that reports are welcomed rather than treated as a nuisance. Reporting rate is a better health metric than click rate.
Training that matches current attacks. The FBI's 2025 report added a dedicated AI section for the first time, logging more than 22,000 AI-related complaints and close to $893 million in associated losses. Generated phishing is fluent and contextual, so "watch for bad grammar" is obsolete advice. Replace assessment with procedure: verify, do not judge.
Our guide to protecting your company from business email compromise covers this in depth, including what to do in the first 72 hours if money has already moved.
Setting It Up: A Practical Sequence
Week 1. Verify your domain and publish MX, SPF, and DKIM through guided setup. Publish DMARC at p=none so the observation window starts immediately. Enable 2FA across all accounts, with security keys for anyone who can move money.
Weeks 2–4. Read your DMARC reports and authorize every legitimate sender you find. Write your payment verification rule and circulate it. Set up the reporting address.
Weeks 4–8. Move DMARC to p=quarantine, then to p=reject once reports are clean. Review admin rights and remove anything unnecessary.
Ongoing. Quarterly: audit admin access, re-check SPF as you add services, and refresh training. Whenever you adopt a new tool that sends mail as your domain, update SPF before it starts sending.
Common Mistakes
1. Stopping at p=none. Publishing DMARC without reaching enforcement is the most common gap, and it protects nothing.
2. Jumping straight to p=reject. Without the observation window you will block your own invoicing or marketing platform. Stage it.
3. Breaking SPF with the 10-lookup limit. Adding services without checking the count causes a silent, permanent failure.
4. Believing DMARC stops lookalike domains. It does not. Add defensive registration and train people to check the domain, not the display name.
5. Relying on filtering alone. The expensive attacks contain nothing to filter. Procedure catches those.
6. Leaving former employees' accounts live. Revoke on the last day, every time.
Frequently Asked Questions
How does NevTan Mail help stop phishing?
Through several layers: spam protection included on every plan, guided SPF, DKIM, and DMARC setup so attackers cannot impersonate your domain, TLS-encrypted connections, 2FA and security key support, continuous account monitoring, and role-based admin controls for revoking access quickly. The authentication piece is the most consequential, because domain spoofing underpins most impersonation attacks.
What is the single most effective anti-phishing control?
DMARC at enforcement, combined with out-of-band verification for payment requests. The first stops attackers using your domain; the second catches attacks from genuinely compromised accounts, which no technical control can detect.
Does spam filtering stop business email compromise?
Usually not. BEC messages often contain no links, no attachments, and no malicious content — just a plausible request. Filters are necessary and insufficient. Verification procedure is what catches these.
Is spam protection included on the free plan?
Yes. NevTan Mail includes spam protection with the free tier, which covers 10 mailboxes at 5 GB each on your own domain.
What should I do if a phishing email reaches someone?
Have them report it rather than delete it, so you can see what got through. If anyone interacted with it, reset credentials and revoke active sessions immediately, then check for mail forwarding rules the attacker may have created — resetting a password does not remove a rule that keeps exfiltrating mail.
Can DMARC stop emails from lookalike domains?
No. DMARC governs your exact domain only. A lookalike is a different domain the attacker controls and can authenticate legitimately. Defensive registration of close variants, plus training people to inspect the actual domain, is what addresses this.
How long does it take to get properly protected?
Initial setup is under an hour. Full DMARC enforcement takes four to eight weeks, because the observation period is genuinely necessary. Start today and the clock runs while you handle everything else.
Do I need a dedicated IT team?
No. Guided setup handles the technical step most people find intimidating. The rest — 2FA, verification procedure, access reviews — are administrative decisions rather than engineering work.
Conclusion
Spam and phishing protection is not one product feature. It is a stack: your own domain at the base, authentication records above it, platform filtering and encryption around it, admin controls for fast response, and verification procedure at the top catching what everything else cannot.
NevTan Mail supplies the parts a provider can supply — spam protection on every plan, guided SPF, DKIM, and DMARC setup, TLS-encrypted connections, 2FA and security key support, continuous account monitoring, role-based admin controls, unlimited aliases, and no ads or data selling. Ten mailboxes with 5 GB each are free forever.
The parts you supply — DMARC enforcement, a payment verification rule, and a reporting culture — cost nothing and stop the attacks that actually empty bank accounts.
