Source: https://help.spamfoo.com/guides/phishing-protection
Last updated: 2026-10-20

***

# Protect Against Phishing

Phishing is mail that pretends to come from someone you trust so it can steal passwords, money, or data. This page explains how SpamFoo spots phishing, how to set up the Anti-Phishing model, and how to set up protected identities for your domains.

## How SpamFoo Spots Phishing

SpamFoo runs three phishing checks on every message. The Impersonation check needs a SpamFoo Anti-Phishing license.

- **Known phishing links:** links in the message are compared to a list of known phishing sites. SpamFoo Client downloads this list on its own and refreshes it about once an hour. No setup is needed.
- **Impersonation:** the sender's display name is compared to the [protected identities](https://help.spamfoo.com/guides/phishing-protection#protected-identities) for the domain the message was sent to. If the name matches but the sender isn't approved for that identity, the message is phishing. This check needs a SpamFoo Anti-Phishing license.
- **Look-alike domains:** the sender's domain is checked for typos and look-alike characters that copy a well-known internet domain.

These checks run early. Only Domain Spam Rules and mailbox rules come before them. A message that fails a check gets the **Phishing** result and is handled like spam. See [How SpamFoo Classifies Email](https://help.spamfoo.com/guides/how-classification-works).

With a SpamFoo Anti-Phishing license, SpamFoo also scores each message with the [Anti-Phishing model](https://help.spamfoo.com/guides/phishing-protection#anti-phishing-model). The model reads the message and judges how likely it is to be phishing or a scam, so it can catch phishing that the three checks above miss.

## Find Phishing Messages

On the Messages page, a phishing message shows **Phishing** as its Detection Type. Set the **Detection Path** filter to **Phishing / impersonation** to list them. The message details show which check caught it:

| Label | What It Means |
| --- | --- |
| **PhishTank match** | The message links to a known phishing site. |
| **Impersonation** | The display name matches a protected identity, but the sender is not approved for it. |
| **Look-alike domain** | Same as Impersonation, and the sender's domain is also a typo or look-alike of an approved domain. |
| **Typosquat domain** | The sender's domain copies a well-known internet domain. |
| **Phishing Model** | The Anti-Phishing model scored the message as phishing. |

## Turn On the Anti-Phishing Model

The Anti-Phishing model needs a SpamFoo Anti-Phishing license:

- **With the license:** the model downloads with model updates. It is off until you turn it on.
- **Without the license:** the model doesn't download or run, and the switch to turn it on can't be changed.

As a system administrator, go to **Anti-Phishing > Detection** and use **Anti-Phishing detection model** to turn the model on or off. The model adds some processing time to each message.

## Choose a Phishing Sensitivity

Sensitivity sets how sure the model must be before it marks a message as phishing. On **Anti-Phishing > Detection**, move **Sensitivity** to one of three levels:

- **Conservative:** fewer legitimate messages are marked as phishing, but more phishing reaches the inbox.
- **Recommended:** the default, and the best choice for most servers.
- **Aggressive:** catches the most phishing, but more legitimate messages may be marked as phishing.

Each Anti-Phishing model update comes with its own cutoff for each level, so a level keeps about the same balance when the model changes. The page shows the current model's cutoff for the level you pick, and says so when two levels use the same cutoff.

## Understand Protected Identities

Many phishing attacks don't use a dangerous link at all. Instead, the attacker writes as someone the reader knows and trusts. A message from the "owner" asks for an urgent wire transfer, "payroll" asks an employee to update their bank details, or "IT support" asks for a password. This is often called business email compromise. The message usually comes from a free mail account or a look-alike domain, but it shows the real person's name, and many mail apps show only the name.

A protected identity tells SpamFoo who those people are. Each identity has a display name and a list of approved senders, which are the addresses or domains that person really sends from. When a message uses a protected name but comes from a sender that isn't approved, SpamFoo marks it as phishing. For example, if you protect the name "Pat Jones" with the approved sender `yourcompany.com`, a message from "Pat Jones" at `pat.jones@freemail-example.com` is marked as phishing.

Add every address the person really sends from, including personal ones. If Pat sometimes writes from a personal Gmail account, add that full address as an approved sender. Otherwise, Pat's own messages from that account are marked as phishing. Add the address, not the domain, because approving `gmail.com` would approve every Gmail user.

Name matching also catches look-alike characters, names in a different order, and small typos. If the display name doesn't match, SpamFoo also checks whether the subject line names a protected identity. A sender at a look-alike of an approved domain, such as `yourc0mpany.com` with a zero, is caught too.

Protected identities belong to one domain. SpamFoo checks the identities of the domains the message is addressed to. If it can't tell, for example when the only recipients are in Bcc, it checks the identities of every domain.

Protected identities need a SpamFoo Anti-Phishing license. Without it:

- SpamFoo doesn't check display names against protected identities.
- The **Protected identities** tab still shows your identities and delegated senders, but you can't add, change, or delete them.
- Your identities, delegated senders, and Strict Mode setting are kept. They're checked again as soon as the license is active.

## Open Protected Identities

- **System Admin:** click **Anti-Phishing** in the menu, open the **Protected identities** tab, and pick a domain in the **Domain** box.
- **Domain Admin:** click **Domain Admin > Anti-Phishing**. You manage your own domain only.

## Add a Protected Identity

1. Click **Add Identity**.
2. In **Display Name**, enter the full name as it appears in email.
3. Under **Senders** (or **Email Addresses** in Strict Mode), enter an approved sender and add it to the list. Repeat for each one.
4. Optionally, add a **Note** about the person's role.
5. Click **Add Protected Identity**.

### Import From vCards

To add many identities at once, click **Import vCards** and choose a `.vcf` file or a `.zip` file of `.vcf` files. A vCard is the standard contact file that most address books can export. The file can be up to 50 MB, and a `.zip` can hold up to 100 MB once unpacked. Identities that already exist are skipped.

### Edit, Turn Off, or Delete Identities

- Right-click an identity for **Edit**, **Disable** or **Enable**, and **Delete**. The **Enabled** switch also turns an identity on or off without deleting it.
- Select several identities to add the same sender to all of them, or to delete them together.

## Choose a Matching Mode

Each domain has one matching mode, set with the **Strict Mode** switch at the top of the list.

| Mode | Who Counts as Approved |
| --- | --- |
| **Relaxed** (Strict Mode off) | Anyone whose domain is in the identity's **Senders** list or is a delegated sender. If you enter an email address, SpamFoo uses its domain. |
| **Strict** (Strict Mode on) | Only the exact addresses in the identity's **Email Addresses** list, plus any [delegated senders](https://help.spamfoo.com/guides/phishing-protection#delegated-senders). |

Use Strict when other people share the identity's domain and could fake the name, such as a large company or a public email service.

## Add Delegated Senders

Some real mail shows a protected person's name but comes from somewhere else. Examples are an outside assistant, a scheduling service, or tools like Bitbucket, Jira, and Google Docs that put a person's name in their notifications.

Instead of adding these senders to every identity, add them under **Delegated Senders for Every Identity**, below the identity list. They are approved for all protected identities on the domain.

1. Click **Add Delegated Sender**.
2. Enter an email address or a domain.
3. Optionally, add a note.
4. Click **Add**.

> **Note** A delegated sender approves everyone at its domain, even when you enter a full email address. To approve only one address, turn on Strict Mode and add the address to the identity's **Email Addresses** list instead.

## Let Mail Through From a Flagged Sender

If Anti-Phishing keeps flagging a sender you trust, first check the cause:

- For **Impersonation** or **Look-alike domain**, add the sender to the identity or as a delegated sender.
- For **Phishing Model**, you can set [Sensitivity](https://help.spamfoo.com/guides/phishing-protection#sensitivity) to **Conservative** so the model flags fewer messages.
- For any phishing result, you can add a **Not Spam** Spam Rule for the sender. A Spam Rule decides the result even when a phishing check fails. See [Manage Spam Rules and Senders](https://help.spamfoo.com/guides/rules-protection).

Check [Sender Verification](https://help.spamfoo.com/guides/rules-protection#sender-verification) before you do this. A Not Spam rule for a sender that is often Spoofed lets real phishing through.