If you run a business with its own email address, spam is part of daily life. Most of it is just annoying: unwanted offers, newsletters you never signed up for, and messages that go straight to the bin.
But some spam is designed to do real damage. A single click on the wrong link can hand over your password, infect your computer, or trick you into paying a fake invoice. Small businesses are a favourite target, because they often don't have an IT team watching their inbox.
The good news is that a few simple habits, and a couple of settings on your domain, protect you from the vast majority of it. In this guide, we'll cover the main types of spam email, how to spot a dangerous one, and the practical steps you can take to protect yourself and your business.
The Main Types of Spam Email
Not all spam is the same. Knowing the different types helps you judge how careful to be.
Junk and marketing spam. Unwanted adverts, offers and newsletters. Irritating, but usually harmless. It's mostly a nuisance that clutters your inbox.
Phishing emails. Messages pretending to be from someone you trust, such as your bank, Microsoft, a delivery company or HMRC. They try to get you to click a link and enter your password, card details or other personal information on a fake website.
Malware attachments. Emails carrying a file, often disguised as an invoice, a delivery note or a shared document. Opening it can install software that steals data, spies on you or locks your files.
Spoofed emails. Emails made to look as if they come from a real address, sometimes even your own business's domain. Scammers use this to trick your customers, suppliers or staff into trusting the message.
Invoice and payment fraud. A message that appears to come from a supplier, client or colleague, asking you to pay an invoice or update their bank details. These are often carefully written and can be very convincing.
How to Spot a Spam or Phishing Email
Scam emails have become much more polished, but most still give themselves away if you know what to look for.
The sender's address doesn't match. The name might say "Microsoft Support", but the actual address is a random Gmail account or a slightly misspelt domain, such as micros0ft-support.com. Always check the full address, not just the display name.
It creates urgency or fear. "Your account will be closed in 24 hours", "Unusual sign-in detected" or "Final payment notice". Scammers want you to act before you think.
The link goes somewhere unexpected. Hover your mouse over a link (or press and hold on a phone) to see where it really leads. If the address doesn't match the company it claims to be from, don't click.
It asks for passwords, payment or personal details. Genuine banks, HMRC and software companies don't ask you to confirm your password or card details by clicking a link in an email.
There's an unexpected attachment. Be especially wary of invoices, documents or "voicemail" files you weren't expecting, even from a name you recognise.
Bank details have suddenly changed. Any email saying a supplier has new bank details should be treated as suspicious until you've confirmed it another way.
Something just feels off. Odd greetings like "Dear Customer", unusual wording, or a message from a colleague that doesn't sound like them. Trust your instinct.
Everyday Habits That Protect You
Most spam protection comes down to a few simple habits. None of them take long, and together they stop the large majority of attacks.
Don't click, go direct. If an email claims to be from your bank, supplier or a service you use, don't use the link in the email. Open your browser and go to the website yourself, or use the official app.
Verify payment requests by phone. If anyone asks you to pay an invoice to new bank details, call them on a number you already have, not one from the email. This one habit stops most invoice fraud.
Turn on two-factor authentication (2FA). With 2FA, a stolen password alone isn't enough to get into your email account. It's one of the most effective protections available, and most email providers offer it for free.
Use strong, unique passwords. Reusing the same password means one leak can unlock everything. A password manager makes it easy to have a different strong password for every account.
Mark spam as spam. Use the "Report spam" or "Report phishing" button rather than just deleting. It trains your email filter to catch similar messages in future.
Don't reply or unsubscribe from suspicious emails. Replying, or clicking "unsubscribe" on an obvious scam, can confirm your address is active and lead to even more spam.
Keep your devices updated. Software updates often fix the security holes that malicious attachments rely on. Keep your computer, phone, browser and email app up to date.
Make sure your spam filter is switched on. Business email services like Microsoft 365 and Google Workspace include spam and malware filtering. Check it's enabled and not set too loosely.
Protect Your Domain with SPF, DKIM and DMARC
Good habits protect your inbox. But there's another side to spam that many small businesses miss: scammers sending emails that pretend to come from your domain.
If your domain isn't protected, anyone can send an email that appears to be from you@yourbusiness.com. Your customers and suppliers could receive fake invoices or phishing links in your name, and your reputation takes the hit.
Three DNS records, added to your domain's settings, close that gap. (If DNS records are new to you, our beginner-friendly guide to DNS explains how they work.)
SPF (Sender Policy Framework) lists which servers are allowed to send email for your domain. Emails from anywhere else can be flagged as suspicious.
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server checks the signature to confirm the email really came from you and wasn't altered along the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells other email providers what to do when a message fails those checks: let it through, send it to spam, or reject it entirely. It can also send you reports showing who is trying to send email using your domain.
There's a bonus, too. Setting these up properly also helps your genuine emails land in your customers' inboxes instead of their spam folders, because providers like Gmail and Outlook trust properly authenticated domains far more.
What to Do If You've Clicked Something Suspicious
It happens to everyone eventually. If you've clicked a dodgy link, entered your details, or opened an attachment you shouldn't have, acting quickly makes a big difference.
Change your password straight away. Start with the account you entered details into, then any other account that uses the same password.
Turn on two-factor authentication if it isn't on already, so a stolen password can't be used on its own.
Contact your bank immediately if you shared card or bank details, or made a payment you're now unsure about.
Scan your device with up-to-date security software if you opened an attachment or downloaded a file.
Warn the people who might be affected. If your email account may have been accessed, let your contacts know not to trust unusual messages from you.
Report it. In the UK, you can forward suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk, which helps take scam websites down.
Stay One Step Ahead of Spam
You can't stop spam from being sent, but you can make sure it doesn't cost you. Careful habits protect your inbox, and properly configured SPF, DKIM and DMARC records protect your domain, your customers and your reputation.
Not sure whether your domain is protected? Domohelp can check your email setup and configure SPF, DKIM and DMARC for you remotely, so your emails are trusted and harder for scammers to fake. Get in touch with Domohelp and we'll take a look.