Analyze phishing emails and validate domain authentication

This skill analyzes suspicious emails and phishing indicators and validates a domain's email authentication posture through SPF, DKIM, and DMARC alignment. It also covers business-email-compromise fraud patterns, OAuth app phishing and mailbox token abuse, and, where authorized, the design of security-awareness exercises.

Use it to analyze a suspicious message or a domain's spoofing exposure, or to validate a domain's email authentication posture. It is authorized-use-only: before any active probing or exploitation step, the skill requires the user to state the exact target, confirm written authorization and scope, and see the exact commands before they run. It must never be used to run unauthorized mass-phishing tests against third-party domains. Because live mailbox investigation touches personal data, exposure should be minimized and anonymized wherever possible, and header analysis alone cannot detect a compromise that leaves no mail trail.

Input is the full raw email headers (the Received chain, From/Return-Path consistency), a suspicious URL or attachment, or a domain's SPF/DKIM/DMARC records and tenant configuration. Output is a header-authentication conclusion, detectable IOCs that feed into the threat-hunting skill, brand-spoofing and reply-address findings, and a tenant policy review covering anti-phishing rules, external-sender tagging, MFA, and OAuth app consent.

The email client's raw-source view supplies the headers; dig or nslookup pull SPF and DMARC DNS records; urlscan or a sandbox analyze links and attachments, working alongside the malware-analysis skill for attachment statics; the tenant admin center is the source for policy configuration.

Security analysts investigating phishing or BEC incidents, and teams validating a domain's email authentication and tenant anti-phishing posture, working under explicit written authorization and minimizing exposure to personal mailbox data.