Spam is rarely just an annoyance. The junk that reaches an inbox is the same channel used for phishing, invoice fraud and credential theft, so cutting the volume genuinely reduces risk, not just irritation.
Most businesses can cut spam dramatically in an afternoon. Here's the order to do it in.
1. Fix your email authentication first
This is the step almost everyone skips, and it's the one that matters most. Three DNS records tell the world which servers are allowed to send email as your domain:
- SPF lists the servers permitted to send on your behalf.
- DKIM cryptographically signs your outbound mail so it can't be tampered with.
- DMARC tells receiving servers what to do when SPF or DKIM fail, and reports back who's trying to spoof you.
Without these, attackers can forge your domain to your own staff and your customers. With them properly configured, spoofing largely stops working and your legitimate mail is far less likely to land in other people's junk folders.
Start DMARC on p=none so you can see the reports, fix any legitimate senders that fail (your CRM, accounts package, marketing platform), then move to p=quarantine and eventually p=reject. Rushing straight to reject is the classic mistake, it blocks your own invoices.
2. Turn on the filtering you're already paying for
Microsoft 365 includes anti-spam and anti-phishing policies that most tenants leave on default. Worth reviewing:
- Increase the bulk complaint level threshold so marketing floods get quarantined.
- Enable impersonation protection for your directors and finance team.
- Turn on Safe Links and Safe Attachments if your licence includes them.
- Enable mailbox intelligence so unusual sender patterns are flagged.
We tune these as standard during Microsoft 365 support onboarding, and it typically removes most of the noise on its own.
3. Block, don't unsubscribe
Never click unsubscribe on genuine spam, it confirms your address is live and monitored. Unsubscribe only from mail you actually signed up for. For everything else, use block sender or report as phishing so the filter learns.
4. Stop publishing addresses in plain text
enquiries@ on a website is a harvesting target. Use a contact form instead, and avoid publishing individual staff addresses on the site. Generic role addresses attract far more junk than named ones.
5. Tidy up catch-all and legacy addresses
A catch-all mailbox accepts anything at your domain, including thousands of dictionary-attack guesses. Disable it and use explicit aliases. The same applies to old distribution lists nobody uses, every one is an open door.
6. Check whether you've been breached
If a staff address appears in a public data breach, spam volume to it will rise permanently. Check the addresses in question, force a password reset, and confirm MFA is enforced. Our guide to securing your Office 365 account covers the setup.
7. Watch for the signs of a compromised mailbox
Sudden spam from your domain means an account is compromised, not that your filter is failing. Signs include unexpected mailbox rules that move mail to RSS Feeds or Deleted Items, sign-ins from unfamiliar locations, and colleagues receiving odd replies. If you see any of these, treat it as an incident, our cyber security team can help contain it.
8. Train the team on the two questions
Filtering never reaches 100%. The two questions that catch most of what gets through:
- Is this asking me to do something urgent involving money or credentials?
- Have I verified the request through a channel other than this email?
That's more effective than teaching people to spot spelling mistakes, modern phishing doesn't have any. There's more on this in our rundown of current cyber threats.
A note on professional signatures
Consistent, centrally managed signatures help staff and recipients spot forged mail, because the fakes never quite match. We use Exclaimer for email signatures to keep this uniform across a business.
Where to get help
If spam is a daily problem, the underlying cause is usually missing DMARC, default filter policies, or a compromised account, all fixable. We look after email security for businesses across Birmingham, Solihull and the West Midlands. Get in touch and we'll check your DNS records and filter policies for free.
