The Phish Protection works by modifying the URL in the email body and rewrites it to your custom branded phishing protection domain.  Once a user clicks on a rewritten URL it is scanned against real time databases to verify the content of website to ensure that it is not a Phish.