Scoring reported phishing emails with SPF, DKIM, DMARC and local lure rules
Most phishing that users report to Indian helpdesks is a handful of local lures: "KYC pending, account will be blocked", UPI collect requests dressed up as cashback, income-tax refunds, electricity disconnection notices. Generic analysers check SPF and DKIM but don't know that sbl-netbanking.online is pretending to be SBI, or that nobody needs a UPI PIN to receive money.
PhishDesk-IN takes a reported .eml and returns a verdict (phishing, suspicious or clean), a 0–100 score and the list of rules that fired, as JSON for ticketing and Markdown for the analyst. It uses only the Python standard library.
What it checks
- SPF, DKIM and DMARC results from
Authentication-Results(RFC 8601) and relaxed alignment (RFC 7489). - Lookalike domains: registrable domain handling for
.co.in/.gov.in, Levenshtein typosquats, homoglyphs likern→m, punycode, and anchor text that points somewhere else. - 12 India-specific lure rules plus UPI VPA detection, with negation handling so "never share your OTP" counts as advice, not a lure.
- Attachment hashes and risky or double extensions.
Results
I tested it on 69 synthetic lab emails (36 phishing, 33 legitimate, 9 built to be hard):
| Precision | Recall | F1 | False positive rate |
|---|---|---|---|
| 0.909 | 0.833 | 0.870 | 0.091 |
All 9 errors were in the hard categories:
- 4 misses from compromised real accounts. SPF, DKIM and DMARC all pass and align, and the only signal is a bit.ly link. The DMARC credit cancels it out. Header rules can't catch a real account sending a bad link; that needs URL detonation or sender baselining.
- 2 misses from quishing. The URL is inside a QR code image and I don't decode images.
- 3 false positives from mailing lists. The list rewrites the message so all three checks fail, even though the mail is fine. ARC (RFC 8617) support would fix this.
I wrote both the emails and the rules, so these numbers are a regression suite, not a real-world detection rate. The useful part is knowing exactly which kinds of mail it will get wrong.