Protecting users and domains with ATP anti-phishing protection and policies