The use of TLS (which is what uses a CA-issued certificate) isn&#x27;t to prevent phishing attacks, it&#x27;s to prevent emails being read or modified in transit.<p>DKIM (which does not use a CA-issued certificate, it uses a public key published in DNS) is the technology that&#x27;s intended to authenticate the email sender.  It still wouldn&#x27;t stop phishing attacks where the purported email sender is something like &quot;admin@facebook-account-verification-2016.net&quot; though, and I don&#x27;t know that there really <i>is</i> a good technical solution to that sort of thing.