Email channel guide
Phishing and impersonation warnings
Dhalinta AI Automation checks every incoming email and warns you if it looks like a scam: emails pretending to be a bank, a shop, the tax office or your own company to make you open a link, download a file or pay something.
To decide, it looks at things such as:
- Whether the sender is who they claim to be: for example, an email signed “Mercadona” that comes from another domain, or that fails the email security checks (SPF, DKIM and DMARC).
- Impossible senders: the sender address uses a domain that does not exist (nobody could receive your reply), or the email is sent by a server authorised by a different website from the sender’s, without its signature. This happens, for example, when someone uses an online shop’s sign-up form to slip advertising or scams into the «username»: the email comes from the real shop, but with a made-up sender.
- Domains that imitate others:
paypa1.cominstead ofpaypal.com,rnercadona.es(“rn” instead of “m”) or letters from other alphabets that look normal. It also protects your company's domain and those of your customers and suppliers, which Dhalinta AI Automation learns from your conversations. - Dangerous attachments:
.htmlfiles, programs or files with a double extension such asinvoice.pdf.exe. - Trick links: the text shows one website and the link leads to another.
- Scams without links or attachments (lottery prizes, inheritances, “contact our lawyer”), in any language: the email reaches you as a blind copy (it is not addressed to you but to a hidden list) and asks you to write to another free email address (Gmail, Outlook, mail.com…). Large amounts of money (“USD 4,500,000”) add to the suspicion. A single one of these signs is not enough, and they never count for newsletters, replies to an email you sent, or senders you have already written to.
- No word lists: all these signals are technical, so they work the same in any language. The intent of the text (pressure, threats, prizes) is not judged with lists of phrases: if you want that assessment, use ✨ → Security check.
Brands you want to protect (optional)
Dhalinta AI Automation already watches the most impersonated brands from many countries: big banks, courier companies, tax offices and big platforms (Amazon, PayPal, Microsoft, Booking.com…). If an email uses their name or a look-alike domain and does not come from their official domain, you will see the warning.
On top of that, you can protect the companies you work with: your bank, your main supplier, the portal where you publish, your accountant… In the email channel, under Connection, fill in «Brands you want to protect».
What to type: the company name and its official domain, the one its real emails come from. There is no need to list the fake emails: they change every day, and Dhalinta AI Automation automatically detects anything that looks like the real domain without being it. One company per line:
Island Bank: islandbank.com My Supplier: mysupplier.com, mysupplier.co.uk
Example. Your bank is Island Bank and its emails always come from alerts@islandbank.com. You type Island Bank: islandbank.com, and from then on:
| An email arrives… | What happens |
|---|---|
Signed «Island Bank», from alerts@islandbank.com | It is the real one: it reaches the inbox as usual. |
Signed «Island Bank», from security@customer-verification.com | It uses the bank’s name but not its domain: suspicious warning and it goes to Spam. |
From alerts@is1andbank.com (a «1» instead of the «l») | It imitates the bank’s domain: possible phishing warning. |
From alerts@islandbank-secure.com | It puts the bank’s name in another domain: suspicious warning and it goes to Spam. |
It is extra protection, not a permission. If you add nothing, emails from your bank or supplier keep arriving as always. What you gain by adding them is that fake emails pretending to be them are detected better and go to Spam.
- It applies to all mailboxes in that workspace and to emails in any language: it only uses names and domains.
- If you paste the full web address (
https://www.islandbank.com/customers) or an email address (alerts@islandbank.com), only the domain is kept. Up to 50 brands. - If the company sends from several domains, put them all on the same line, separated by commas.
- Your regular customers’ and suppliers’ domains are protected automatically too: Dhalinta AI Automation learns them from the conversations you have replied to.
When an email is suspicious you will see an amber warning; if it has several signs of fraud, a red possible-phishing warning with the reasons. A label also appears in the conversation list and, if it has dangerous attachments, you will be asked to confirm before opening them.
For an email flagged as phishing, the AI does not reply and the bell does not ring. If you have doubts about an email, use ✨ → Security check for an explained second opinion.
Suspicious emails (amber) also go to the Spam tab, with no bell or AI reply, unless the sender is trusted and verified. If one is legitimate, click “Not spam” and it goes back to the inbox. Neither phishing nor suspicious emails go on the Leads board.
If a warning is wrong, click “Not phishing”: emails from that address will no longer be flagged in that mailbox.
It is an aid, not a guarantee: if in doubt, do not open links or attachments and confirm with the sender through another channel.
View the original message (headers)
Below each received email, "Show original" opens the technical details of the message, like in Gmail:
- Message ID: the unique identifier set by the sending server. It is used to group replies in the same conversation, avoid duplicates or ask the sender's provider to find a specific email.
- Creation and reception date, sender, recipients and subject.
- SPF, DKIM and DMARC: in green (PASS) the email came from servers authorised by the sender's domain; in red, be careful.
- The full headers, a button to copy them and another to download the original email (.eml).