How to Stop Spam Email at Your Business

By most industry estimates somewhere between 45 and 50 percent of all email sent worldwide is spam, and that figure has barely moved in a decade because sending it costs almost nothing. What has changed is what reaches an inbox. Modern filtering stops the great majority before anyone sees it, so the spam that still gets through tends to be the cleverer kind: the fake invoice, the delivery notice, the message that looks like it came from your own CEO. This guide covers how to cut both the volume and the danger: the filtering already built into Microsoft 365 and Google Workspace, the settings worth changing, protecting your own domain with SPF, DKIM and DMARC, and the habits that keep addresses off spammers’ lists in the first place.

Four kinds of unwanted email, and why the difference matters

• Bulk marketing from companies you actually dealt with. Legal, annoying, and the unsubscribe link works.
• Scam spam: lottery wins, miracle products, fake pharmacies. Never engage; report and delete.
• Phishing: messages built to steal a password or a payment. This is the dangerous kind, and it is why spam is a security topic rather than a nuisance. Our phishing quiz shows ten realistic examples.
• Impersonation of your own executives, vendors or domain, aimed at your accounts-payable team. Low volume, high cost, and the reason for the domain-protection steps below.

Use the filtering you already pay for

Every Microsoft 365 mailbox sits behind Exchange Online Protection, and Google Workspace has equivalent filtering in Gmail. Both are good and both ship with cautious defaults. In Microsoft 365, the changes that make the most difference are:

• Apply the Standard preset security policy. Microsoft maintains two ready-made policy sets, Standard and Strict, that tighten spam, phishing and malware settings to its own recommendations. Turning on Standard for everyone is a five-minute job that most tenants have never done.
• Turn on Defender for Office 365 if you have Business Premium: Safe Links rewrites and checks every link when it is clicked, Safe Attachments opens attachments in a sandbox first, and impersonation protection flags messages pretending to be your executives or your domain. Our guide to what Business Premium includes covers the rest of that plan.
• Enable the Report button in Outlook so people can flag junk and phishing with one click. Reports train the filter and tell your IT team what is arriving.
• Use the quarantine. Suspected spam should go to quarantine with a daily digest, not to the Junk folder where people rummage through it. Quarantine policies decide who can release what.
• Tag external mail. A visible “External” label on messages from outside the company costs nothing and defeats a whole class of impersonation.
• Tune the bulk threshold down a notch if newsletters are the main complaint, and add persistent offenders to the tenant block list.

Google Workspace administrators have the same levers under Gmail settings: enhanced pre-delivery scanning, attachment and link protection, external-warning banners and an admin quarantine. Either platform, properly configured, stops the bulk of the problem.

Add a layer for the messages that get through

For businesses that handle payments, patient data or client funds, we put a third-party filter in front of or inside the mailbox. It sees what the built-in filter missed, checks links again at the moment they are clicked, and gives us one console for every client’s email security. The specific product matters less than having a second opinion on every message and someone watching the results; ours is part of managed cybersecurity services. If you are getting a real volume of phishing, this is the step that changes it.

Protect your own domain: SPF, DKIM and DMARC

Sender addresses are easy to forge, so criminals send spam and phishing as your company, to your customers and your own staff. Three DNS records stop that. SPF lists the servers allowed to send as your domain. DKIM signs each message so a receiver can check it was not altered. DMARC tells receivers what to do when a message fails those checks (nothing, quarantine or reject) and sends you reports of who is sending as you. Set DMARC to reject once your legitimate senders, including the marketing platform and the accounting system, are all in SPF and DKIM.

This also affects whether your own email is delivered. Since early 2024 Google and Yahoo, and since 2025 Microsoft, have required SPF, DKIM and DMARC from anyone sending in volume and will reject mail from domains that lack them. Our email spoofing check tests a domain in a few seconds, and our article on why email gets blacklisted explains what to do if a mistake has already landed your domain on a blocklist.

Habits that keep addresses off lists

• Do not publish addresses as plain text on your website. Use a contact form, and if an address must appear, use a role address that can be changed rather than a person’s.
• Use a separate address for sign-ups. Plus-addressing (for example lenny+vendor@oactechnology.com) or a dedicated alias makes it obvious who sold the address and easy to shut off.
• Never reply to spam, even to complain, and do not click unsubscribe on anything you do not recognise. Both confirm the address is live.
• Check whether addresses have leaked. Data breaches at other companies are the main source of spam lists. The free Have I Been Pwned service shows which breaches included an address, and the breached passwords should already have been changed; our article on creating secure passwords explains why.
• Set expectations with vendors. Tell suppliers which address to use and unsubscribe from the rest through the legitimate link.

When spam is a symptom of something worse

Two patterns deserve a call to IT rather than a delete key. A sudden flood of hundreds of newsletters in an hour is often a spam bomb: criminals bury a password-reset or purchase notification under noise so you will not see it. Check your bank, your Microsoft or Google account activity and recent orders before deleting anything. And spam that appears to come from a colleague, with real internal details, may mean a mailbox has been compromised and is being used to send. Read what to do if your email has been hacked and call us; a compromised mailbox that keeps sending gets your whole domain blocklisted within hours.

What we do for clients

Email security is part of every managed plan: the Microsoft 365 or Google Workspace settings above are applied and reviewed, the domain has SPF, DKIM and DMARC at reject, a second filtering layer sits in front of the mailboxes for clients that need it, and reported messages are looked at by a person. The result is a Junk folder that stays quiet and a phishing message that is caught before accounts payable sees it. The pricing calculator gives a monthly figure for the whole plan.

Common questions

Should I click unsubscribe?

Only when you recognise the sender as a legitimate company you once dealt with. Legitimate marketers must honour unsubscribe requests, and the one-click unsubscribe link at the top of Gmail and Outlook is safe. For anything you do not recognise, unsubscribing confirms your address is read by a human. Report it as junk or phishing instead.

Why am I suddenly getting hundreds of spam emails a day?

A sudden flood, sometimes called a spam bomb, is often deliberate. Criminals sign an address up to thousands of newsletters to bury a password-reset, purchase or bank notification they do not want you to see. If it happens to you, check your bank, your Microsoft or Google account activity and your recent orders before you start deleting.

Does Microsoft 365 filter spam on its own?

Yes. Every Microsoft 365 mailbox sits behind Exchange Online Protection, and Business Premium adds Defender for Office 365 with link and attachment scanning and impersonation protection. The defaults are conservative, though; applying Microsoft’s Standard preset security policy and turning on the report button makes a noticeable difference.

What is DMARC and does it stop spam?

DMARC, with SPF and DKIM, tells other mail systems which servers are allowed to send email as your domain and what to do with messages that fail. It does not reduce the spam you receive, but it stops criminals sending spam and phishing as you, and since 2024 Google, Yahoo and Microsoft require it of anyone sending in volume. Our email spoofing check tests it for your domain in a few seconds.

Why am I getting spam addressed to a colleague, or from my own address?

Sender addresses in email are easy to forge, like the return address on an envelope. Spam that appears to come from you or a colleague means your domain is being spoofed, which is exactly what DMARC with a reject policy prevents. If the message contains real internal details, treat it as a possible compromised mailbox and read our article on what to do if your email has been hacked.

Can we block whole countries or domains?

Yes. Both Microsoft 365 and Google Workspace let an administrator block sender domains, top-level domains and, in Microsoft 365, messages by originating country. Blocking a country is a blunt tool that also stops legitimate mail from travelling staff and overseas customers, so we use it sparingly and log what it catches.

Talk to us

If your team is drowning in junk mail or a phishing message recently got through, we will review your email security settings and domain records free of charge and tell you what to change. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.