Every 15 minutes

Get warned about spoofed emails

You're alerted when a new email fails SPF, DKIM or DMARC checks.

Runs: Every 15 minutes
Apps: Outlook
AI: Not needed
Access: Mail.Read

Send this to your assistant

Create a ClickRuntime automation: every 15 minutes, check the headers of new Outlook emails and email me if any fail SPF, DKIM or DMARC, with the sender and subject.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A finance manager receives an email that appears to come from the CEO asking for an urgent wire transfer, or from a known supplier with new bank details. The display name looks right and the signature is convincing, but the message was sent by someone else. Business email compromise costs companies far more than ransomware does, and the usual warning signs are invisible unless you open the message headers.

Every 15 minutes, new messages are fetched along with their internet message headers, and the Authentication-Results header is read to see whether SPF, DKIM and DMARC passed. When a message fails any of them, an alert is sent that names the sender, the subject, the failed checks and the time it arrived.

It is a lightweight extra layer for small teams and IT admins who do not have a full email security gateway.

What you get out of it

Fake executive requests get flagged
An email claiming to be from your CEO but failing SPF and DMARC is a strong sign of spoofing. An alert gives you a reason to pause before acting. That early flag gives finance and executive assistants a clear reason to stop and double-check.
Fraud losses can be avoided
Payment redirection scams rely on speed and trust. A warning that the message failed authentication gives finance staff the pause they need to verify by phone. That pause is often all it takes to stop a payment going to a fraudster's account.
Header checks you would never do by hand
Reading raw headers is technical and slow, and nobody does it for every email. Automatic checks catch problems on every message without anyone reading headers. Automating the check means no message is skipped because someone was in a hurry or off sick.
Staff learn what spoofing looks like
Alerts that show which checks failed help the team understand why a message was suspicious, which improves their instincts over time. Over a few months, that awareness makes people more careful in general, not only about alerts.
Evidence for your IT team
Each alert records the sender, the failed checks and the time. That helps IT block a domain, tighten rules and report an incident if one occurs. Having these details to hand saves time when you need to explain an incident to a bank or an insurer.

How it works

What happens, step by step

Every 15 minutes, ClickRuntime checks the new emails in your Outlook inbox since the last check.
For each one it reads the sender checks your mail server recorded, known as SPF, DKIM and DMARC, which show whether the email really came from who it claims.
If any email fails those checks, you get an email listing the sender, subject and which checks failed, so you can spot fake invoices or bank detail changes.

Before it runs live

Connect Outlook

What you get

RunsEvery 15 minutes

Get warned about spoofed emailstoday, 9:00Succeeded

Email · 1 email failed sender checksbilling@northwind-payments.co: Updated bank details (spf=fail, dmarc=fail)

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Act only on the items that match your own rules, and skip the rest
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Outlook steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

spoofed_email_alert.pyexample

import re
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched

@on_trigger
def run(event):
    since = state.get("since") or "2026-01-01T00:00:00Z"
    msgs = http.get("https://graph.microsoft.com/v1.0/me/messages",
        headers={"Authorization": f"Bearer {credentials.connection('microsoft', 'work')}"},
        params={"$filter": f"receivedDateTime gt {since}", "$orderby": "receivedDateTime asc",
                "$select": "subject,from,receivedDateTime,internetMessageHeaders", "$top": 50}).json()["value"]
    report_fetched(len(msgs))
    if not msgs:
        return {"summary": "Nothing new"}
    flagged = []
    for m in msgs:
        auth = " ".join(x["value"] for x in m.get("internetMessageHeaders") or [] if x["name"].lower() == "authentication-results")
        fails = re.findall(r"\b(spf|dkim|dmarc)=(fail|softfail)", auth, re.I)
        if fails:
            flagged.append(f"{m['from']['emailAddress']['address']}: {m['subject']} ({', '.join(f'{k}={v}' for k, v in fails)})")
    if flagged:
        notify.email_me(f"{len(flagged)} emails failed sender checks", "\n".join(flagged))
    state.set("since", msgs[-1]["receivedDateTime"])
    return {"flagged": len(flagged)}

FAQ

Common questions

Does a failed check always mean the email is fake?

No. Misconfigured mailing services and forwarded mail can also fail SPF or DKIM. Treat an alert as a reason to be careful, then check the sender through another channel before acting on any request. A forwarded newsletter is a typical harmless failure, so verify before concluding.

Where do SPF, DKIM and DMARC results come from?

They are recorded by the receiving mail server in the Authentication-Results header when the message arrives. Microsoft 365 adds this header to inbound mail, and the check reads the result without doing its own testing.

Will it block or quarantine the message?

No. It alerts you and leaves the message where it is. Blocking spoofed mail belongs in your mail provider's anti-phishing policies, and this alert is a second pair of eyes alongside them. Only an administrator can set strict rules in Microsoft 365.

What permissions does it need?

Mail.Read. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it checks. Checks that find nothing new and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Every 15 minutes