Email Spam Filtering for Small Business: How It Works

Spam filtering inspects every message on its way into your mailboxes and decides whether to deliver it, send it to the junk folder, hold it in quarantine, or refuse it. Microsoft 365 and Google Workspace both include filtering in every plan. What changes between plans is the depth of protection against targeted phishing, such as attachment sandboxing, link checks at the moment of click, and impersonation detection. Most of the work for a small office is turning on what you already pay for and handling quarantine sensibly.

This guide covers inbound mail. If your own messages are landing in other people’s spam folders, that is a separate problem with a different fix, covered in why business email goes to spam.

How does a spam filter decide what to block?

No single test catches everything, so filters stack several checks and combine the results into a verdict:

• Connection and reputation checks. The sending server’s IP address and domain are compared against reputation data and blocklists before the message is even accepted.
• Sender authentication. The filter checks SPF, DKIM, and DMARC, the DNS records that show whether a message is authorized by the domain in its From line. Forged senders tend to fail here.
• Malware scanning. Attachments are checked against known malicious files and blocked file types.
• Content analysis. Wording, formatting, and links are scored against patterns seen in spam and phishing, using models trained on very large volumes of mail.
• Sandboxing. On higher plans, unknown attachments are opened in an isolated virtual machine to see what they do before delivery.
• Time-of-click link checks. On higher plans, links are checked again when someone clicks, which catches pages that were harmless at delivery and changed later.
• After-delivery cleanup. Microsoft 365 can pull a message back out of inboxes when it is later identified as malicious, a feature named zero-hour auto purge.

The verdicts you will see in Microsoft 365 are bulk, spam, high confidence spam, phishing, high confidence phishing, and malware. Each verdict can be given its own action in policy.

What is included in each Microsoft 365 plan?

Microsoft now describes the base layer as “built-in security features for all cloud mailboxes.” Older documents and many admins still use the previous name, Exchange Online Protection or EOP. Microsoft’s comparison lays out three tiers:

Tier	What it adds	Where you get it
Built-in protection (formerly EOP)	Anti-spam, anti-malware, anti-spoofing, bulk mail filtering, connection filtering, quarantine, zero-hour auto purge for email, outbound spam controls, Tenant Allow/Block List	Every Microsoft 365 plan with mailboxes, including Business Basic and Business Standard
Defender for Office 365 Plan 1	Safe Attachments (sandboxing), Safe Links (time-of-click checks in email, Office apps, and Teams), user and domain impersonation protection, real-time detection reports	Included in Microsoft 365 Business Premium and Microsoft 365 E3, or as an add-on
Defender for Office 365 Plan 2	Attack simulation training, Threat Explorer, automated investigation and response	Included in Microsoft 365 E5, or as an add-on

Two recent changes are worth knowing. Microsoft’s 2026 packaging update added checks against known malicious websites when users click links in email and Office apps to Business Basic and Business Standard, and added Defender for Office 365 Plan 1 to the E3 plans, effective July 1, 2026. As of September 2026, Microsoft lists Business Basic at $7, Business Standard at $14, and Business Premium at $22 per user per month.

For an office of under 300 people that wants sandboxing and impersonation protection, Business Premium is usually the simplest route because it bundles Plan 1 with device management and identity controls. Our comparison of Business Premium and Business Standard covers the rest of the differences.

Turn on the preset security policies

Buying the license does not finish the job. Microsoft publishes recommended settings as two bundles named Standard and Strict. In the Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Preset security policies, turn on Standard protection, and apply it to all recipients. Microsoft maintains these presets, so settings track its current recommendations without you editing individual policies. Strict quarantines more aggressively and suits people who handle payments or are frequent targets.

What controls does Google Workspace give you?

Gmail filters spam, phishing, and malware by default in every edition. Admins can tighten it in two places in the Admin console.

Apps > Google Workspace > Gmail > Safety holds Google’s advanced phishing and malware protection, in three groups:

• Attachments: protection against encrypted attachments from untrusted senders, attachments with scripts, and unusual attachment types.
• Links and external images: scanning of shortened links and linked images, plus a warning when someone clicks a link to an untrusted domain.
• Spoofing and authentication: protection against domain names that imitate yours, display names that imitate your employees, and unauthenticated mail.

Each group has an option to apply future recommended settings automatically. Turning that on is a sensible default.

Apps > Google Workspace > Gmail > Spam, Phishing and Malware holds the spam settings: more aggressive filtering, an administrative quarantine for spam, approved sender lists, and enhanced pre-delivery message scanning.

Attachment sandboxing in Gmail is named Security Sandbox. Google lists it as available in Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, and Frontline Plus, which means Business Starter does not include it.

How should a small office manage quarantine?

Quarantine is a holding area for messages the filter would not deliver. It is only useful if someone looks at it. Otherwise real invoices and job inquiries sit there until they expire.

In Microsoft 365, quarantine policies decide what users can do with their own held mail and whether they get notified. A practical setup for a small office:

1. Go to Email & collaboration > Policies & rules > Threat policies > Quarantine policies.
2. Open Global settings and set the notification frequency. The choices are within 4 hours, daily, or weekly. Daily suits most offices.
3. Assign a policy with notifications turned on to the spam and bulk verdicts, so staff get a digest and can release their own newsletters and vendor mail.
4. Keep phishing verdicts on an admin-only policy.

Microsoft enforces one limit regardless of your settings: users can never release their own messages quarantined as malware or high confidence phishing. They can only request release, and an admin decides. How long messages are held is set by the retention setting in the anti-spam policy, so check that value and make sure someone reviews admin-only quarantine more often than that.

In Google Workspace, quarantines are managed under Apps > Google Workspace > Gmail > Manage quarantines, and an admin or delegated reviewer releases or denies messages.

Name one person who owns the admin quarantine review and a backup for when they are out. Without an owner, held messages simply expire unseen.

How do you allow a trusted sender without opening a hole?

When a customer’s mail keeps getting caught, the tempting fix is to allow their whole domain everywhere. Every allow entry skips some filtering, and attackers forge or compromise trusted senders for exactly that reason.

Microsoft ranks the allow methods from most to least recommended: Tenant Allow/Block List entries first, then mail flow rules, Outlook Safe Senders, the IP Allow List, and last, allowed sender and domain lists inside anti-spam policies. A safer routine looks like this:

1. Report the false positive. In the Defender portal, open Submissions, submit the message as clean, and choose Allow this message. Microsoft creates a narrow allow entry based on what triggered the block and learns from the report.
2. Let allow entries expire. According to Microsoft’s Tenant Allow/Block List documentation, entries created this way are kept for 45 days after the system determines the sender is clean, or you can set them to expire within 30 days. Entries that expire are a feature: they stop old exceptions piling up.
3. Prefer an address over a domain, and never allow your own domain or a large public domain such as gmail.com. Microsoft warns that doing so lets forged mail skip filtering.
4. Know what cannot be allowed directly. Malware and high confidence phishing verdicts cannot be overridden with a manual allow entry. They must go through Submissions. Block entries always win over allow entries.
5. Ask the sender to fix the cause. If their mail fails SPF, DKIM, or DMARC, the lasting fix is on their side.

In Google Workspace, the equivalent is an approved senders address list, which bypasses the spam filter for listed addresses or domains. Google separates this from the IP allowlist, which skips spam filtering for specific server addresses. Keep both lists short, and review them when vendor relationships change.

What spam filtering cannot do

A filter reduces how much bad mail reaches people. It does not reduce it to zero. Messages sent from a real, compromised mailbox at a vendor pass authentication and often contain no link or attachment at all, only a request to change bank details. That pattern is business email compromise, and the defenses are payment verification procedures, multi-factor authentication on your own accounts, and staff who know how to spot a phishing email.

You may not need to pay for more filtering at all. An office already on Business Premium or an eligible Google edition has sandboxing and link protection included. A separate third-party email gateway adds another layer, along with cost, another quarantine to check, and mail routing changes that need care, so weigh it against simply configuring the built-in tools well.

Common mistakes

• Paying for Business Premium and never turning on the preset security policies.
• Nobody assigned to check the admin quarantine.
• Allowing entire domains, or your own domain, to stop false positives.
• Letting users release anything they like, including phishing verdicts.
• Treating junk folder complaints as a reason to loosen the filter, instead of reporting false positives so the filter learns.
• Forgetting shared mailboxes such as info@ or billing@, which are published on websites and may have no one watching their quarantine notices.

Common questions

Is the spam filtering in Business Basic or Business Standard enough?

It blocks the bulk of ordinary spam and known malware, and since July 2026 it includes checks against known malicious links at click time. It does not include attachment sandboxing or impersonation protection, which come with Defender for Office 365 Plan 1 in Business Premium. Offices that handle payments, client funds, or regulated data generally benefit from Plan 1.

Why did a real email go to quarantine?

Usually because the sender’s domain fails authentication, the message resembles a phishing pattern (an invoice link from a new sender, for example), or the sender’s IP address has a poor reputation. Release it, report it as a false positive through Submissions so the filter learns, and let the sender know if their SPF, DKIM, or DMARC is failing.

Should employees be able to release their own quarantined mail?

For spam and bulk verdicts, yes, with daily notifications, because it keeps newsletters and vendor mail flowing without an admin in the middle. For phishing verdicts, keep release with an admin. Microsoft blocks self-release of malware and high confidence phishing regardless of how you set the policy.

Do we need a separate spam filtering service on top of Microsoft 365 or Google Workspace?

Often not. Both platforms include capable filtering, and the higher plans add sandboxing and link protection. A separate gateway can make sense for specific compliance or archiving needs. Configure and review the built-in tools first, then decide based on what is still getting through.

How Coastal Growth Co. can help

We review and configure inbound email protection for small businesses on Microsoft 365 and Google Workspace: confirming which plan features you have, turning on preset policies, setting up quarantine notifications and a review routine, and cleaning up risky allow entries. This is part of our cloud and email services and can be included in ongoing managed IT. Get in touch to describe what you are seeing, and we will agree on scope and price before any paid work begins.