Scan a batch of email messages and report ONLY the phishing ones, deterministically, from SPF/DKIM/DMARC results, From/Return-Path/Reply-To/DKIM alignment, and link domains. No AI. Batch counterpart of email-authenticity-check.

Email Authenticity Scan (Batch)

Scan a list of email messages and produce a report of only the phishing ones — deterministically, with no AI and no per-run cost. This is the batch counterpart of email-authenticity-check (which judges a single message); the two share identical verdict logic.

What it does

For every message it reads the forensic facts the receiving server already recorded and aligns the visible identity against the verifiable one:

SPF / DKIM / DMARC results from the Authentication-Results header.
Identity alignment — the visible From domain vs Return-Path, Reply-To, and the DKIM signing domain (d=). A Reply-To on a free webmail domain that doesn't match From is a classic phishing tell.
Link domains in the body — URL shorteners and off-sender domains are flagged.

A message is PHISHING when an auth check explicitly failed, SUSPICIOUS when auth is missing or signals are inconsistent, and GENUINE when auth passes and identity aligns.

Input

Field	Required	Description
`messagesJson`	yes	A JSON array of messages — typically the `messages` output of an `email-read` task. Each item may be the email-read canonical shape (`{headers, message:{payload:{headers}}, body, id}`) or a raw Gmail message. A single object, or an `{messages:[...]}` envelope, is also accepted.
`includeSuspicious`	no	`"true"` to also include `SUSPICIOUS` verdicts in the report. Default `"false"` (phishing only).

Output (published)

Field	Description
`scannedCount`	How many messages were scanned.
`phishingCount`	How many were `PHISHING`.
`suspiciousCount`	How many were `SUSPICIOUS`.
`phishingReport`	Human-readable report of the flagged messages. Empty string when none — so a downstream `message` task self-suppresses.
`alertSubject`	A ready-made alert subject (e.g. `⚠️ Phishing detected in your inbox (2)`). Empty when none.
`verdicts`	JSON array `[{from, subject, verdict, confidence}, …]` for every message scanned.

Why empty-when-clean matters

The message task skips sending when its alert name, subject and body are all blank. Because this tool emits an empty phishingReport and an empty alertSubject when nothing is phishing, you can wire it straight into a message task and it will alert only when there is something to report — no "all clear" noise.

See the inbox-phishing-scan job for the complete read → scan → alert-only-on-phishing automation.