# Phish Desk > Triage a reported suspicious email from its full source. The free check runs in the browser and fetches nothing: authentication results and DMARC alignment, the relay path, every link with redirect wrappers unwrapped, look-alike and punycode domains, attachment flags and SHA-256 hashes, business email compromise cues, a verdict floor and defanged indicators. The paid triage returns a verdict, category, evidence, actions and a reply to the reporter, and the page checks it against the headers and the message. App: https://phish-desk.skillsafe.ai/ API tutorial: https://phish-desk.skillsafe.ai/api.html ## What the free check does - Finds the header block even when the paste starts with a "Show original" summary, unfolds header lines and decodes RFC 2047 encoded words. Parses the MIME tree (multipart boundaries, base64, quoted-printable, per-part charsets). A report that forwards the original as a message/rfc822 attachment is recognised and the attached original is analysed. - Reads SPF, DKIM, DMARC, ARC and Microsoft compauth from the topmost Authentication-Results header (falls back to ARC-Authentication-Results and Received-SPF). It does not re-verify signatures or look up DNS; it reads what the receiving server recorded. - Works out DMARC alignment: SPF or DKIM only vouch for the From address when their domain has the same organisational domain as From. Organisational domains are approximated with a short public-suffix list (common two-label country suffixes plus shared hosting platforms such as web.app, github.io, pages.dev, azurewebsites.net), not the full Public Suffix List. - Lays out the Received chain in delivery order, marks private addresses, finds the first public relay and flags timestamps that run backwards. - Sender checks: Reply-To or Return-Path at another organisation, an address inside the display name, a display name that names a brand the domain does not belong to, free-mail senders with executive or role names, and your own domain in From on a message that failed authentication. - Look-alike domains: compared with your domains and a short brand list after folding digits for letters, rn for m, vv for w and Cyrillic or Greek homoglyphs, plus edit distance (1 for names of 5+ letters, 2 for 10+) and names wrapped in hyphens. Punycode labels are decoded (RFC 3492) and mixed scripts flagged. - Links from HTML anchors, forms, image maps and plain text. Microsoft Safe Links, Proofpoint URL Defense, Google and Facebook redirect wrappers are unwrapped. Flags: link text showing another domain, bare IPs, punycode, shorteners, user@host tricks, plain http, look-alike or brand-naming hosts, javascript: and data: links, free hosting and file-sharing platforms, HTML forms. - Attachments: executable and script extensions, double or hidden extensions, macro-enabled Office files, HTML and SVG files, disk images and archives. Each attachment's decoded bytes are hashed with SHA-256 in the browser (SubtleCrypto); nothing is opened. - Content cues: sign-in and verify requests, payment or bank-detail changes, urgency, gift cards, secrecy, requests for codes, QR codes, extortion, invisible characters. - A verdict floor (benign, suspicious, malicious): the least severe verdict the flags alone allow. - Exports: the check as Markdown; indicators (sender addresses and domains, relay IP, link URLs and hosts, attachment names and hashes) as defanged CSV or JSON. - Hunt queries: search text to find and purge the other copies of the message - Microsoft Defender advanced hunting (KQL over EmailEvents and EmailUrlInfo), a Microsoft Purview content search and a Gmail search - built from the sender, the subject and the link hosts (your own domains excluded). - Seen before: when the same message, or one sharing a sender address, link, attachment hash or flagged domain, was already triaged in your history, the page says so and opens that triage, so a phishing wave is not paid for twice. ## The paid triage Input: {"task": "triage", "facts": "", "note": "optional"}. The facts are the check above plus a clipped body excerpt; the raw source and attachment bytes are never sent. Output: one JSON object with verdict (malicious, suspicious, benign), category (credential_phishing, bec_payment_fraud, malware_delivery, extortion_scam, gift_card_scam, callback_scam, spam, legitimate, unclear), confidence, headline, auth (spf, dkim, dmarc, aligned, reading), evidence (flag id, finding, weight, points_to), sender, links, attachments, actions (owner, priority, step), iocs, reporter_reply and summary. The page rejects a verdict less severe than its floor, requires every high-severity flag to be addressed, checks the stated authentication results against the headers, checks link and attachment ids, and matches every indicator against the pasted message before it can be exported. Runs on the gpt-terra model alias and costs credits; the free check does not. ## What it does not do No link is visited, no domain is looked up (no DNS, WHOIS, domain age or reputation), no attachment is opened or sandboxed, and no DKIM signature is re-verified. A clean check is not proof a message is safe. ## Sources - RFC 5322 Internet Message Format: https://www.rfc-editor.org/rfc/rfc5322 - RFC 2045 and RFC 2047 (MIME, encoded words): https://www.rfc-editor.org/rfc/rfc2045 and https://www.rfc-editor.org/rfc/rfc2047 - RFC 8601 Authentication-Results header: https://www.rfc-editor.org/rfc/rfc8601 - RFC 7208 SPF: https://www.rfc-editor.org/rfc/rfc7208 - RFC 6376 DKIM: https://www.rfc-editor.org/rfc/rfc6376 - RFC 7489 DMARC (identifier alignment, section 3.1): https://www.rfc-editor.org/rfc/rfc7489 - RFC 3492 Punycode: https://www.rfc-editor.org/rfc/rfc3492 - Source skill: email-security by zhaoxuya520, MIT - https://skillsafe.ai/skill/@zhaoxuya520/email-security and https://github.com/zhaoxuya520/reverse-skill (defensive parts only: phishing analysis, header authentication, BEC patterns)