What are some generally preferred methods for handling suspected phishing messages?

Saving it to a specific phishing folder

Deleting it entirely

Safely forwarding the message to the IT provider

All of the above