24 October 2026/Personal project

If AI can write convincing phishing emails, how can we use it to defend against them?

My email (phishing) helpdesk — using AI agents to investigate suspicious emails that get past the filters.

Walter Verkerk· 4 min read

AI makes convincing phishing emails easier to produce. The language can read naturally, the layout can look right, and the sending domain can pass SPF, DKIM and DMARC checks.

Mail filters, including those using AI, still miss things. My email (phishing) helpdesk is one way I use AI agents to investigate the emails that get through. I want the person reporting an email to get a clear answer on whether it’s phishing and what to do next.

It’s a personal project alongside my work as a SOC Analyst.

Forwarding a suspicious email

I wanted people to be able to forward a suspicious email without having to follow a technical procedure first. They should get a prompt acknowledgement, followed by a clear answer on whether it’s phishing and what to do next.

The helpdesk checks whether a report comes from an authorised sender. It then sends an acknowledgement and examines the message at scheduled intervals. That investigation is passive: suspicious links aren’t opened and attachments aren’t run. The findings stay with the report, so there’s a record of how the assessment was reached.

After the sender checks, the first submitted email was investigated and assessed as phishing with high confidence. It was trying to steal login details.

Blocking phishing domains at home

I’ve since added Abusix Guardian Mail Free to check the reputation of domains in email links. Its free tier includes 5,000 DNS queries a day under its fair-query policy.

I’ve also connected the helpdesk to Pi-hole. For confirmed, high-confidence phishing, an abuse agent can add the exact hostname from the link to my custom blocklist. It blocks hostnames, not full URLs, and only covers devices using my local Pi-hole resolver.

The local block has to be verified before the agent sends a report to the responsible provider. If that step fails, the report waits.

The Pi-hole integration is still being tested and is working as expected so far.

Working with my agent

I worked with my Mail Platform Architect agent to put the workflow together. I set the goal and the user experience. We worked through what the agent could do, what it was allowed to do and how it should respond in different situations.

The agent helps with the technical setup, automation and tests. I review the code it produces and check that it behaves as expected. I want to understand how it works, including the technical details.

SPF, DKIM and DMARC help verify the sending domain, but they don’t tell me whether the content is safe. Attackers can pass these checks using domains they control. AI makes it easier to write convincing phishing emails and work through the technical setup behind them.

The agent helps me investigate reports and keep track of the findings. I still decide what to do with them. Changes to the mail filters still need my approval.

I’ve thought about adding a dedicated Outlook button. With the changes around Classic Outlook and the new Outlook, I’ve left it for now.

Inside the reporting workflow

I’ve written a technical deep dive about the original email evidence, provider reporting and the Python script the abuse agent uses. It also covers prompt injection hidden in email and an idea for a separate agent to review behaviour over time.