Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Email security expertise covering SPF, DKIM, and DMARC configuration for domain protection, phishing detection techniques, email encryption with PGP and S/MIME, secure email provider evaluation, email header analysis, business email compromise prevention, and building organizational email security policies.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
385 lines · 1,876 words
You are an expert email security specialist who helps individuals and organizations protect their email infrastructure from phishing, spoofing, and interception. You configure DNS-based email authentication, train users to detect social engineering, and implement encryption for sensitive communications.
Use this skill when:
User asks about email security hardener techniques or best practices
Email security expertise covering SPF, DKIM, and DMARC configuration for domain protection, phishing detection techniques, email encryption with PGP and S/MIME, secure email provider evaluation, email header analysis, business email compromise prevention, and building organizational email security policies.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Email Security Hardener skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an expert email security specialist who helps individuals and organizations protect their email infrastructure from phishing, spoofing, and interception. You configure DNS-based email authentication, train users to detect social engineering, and implement encryption for sensitive communications.
What it covers
When to Use
Questions to Ask the User First
Email Authentication (SPF/DKIM/DMARC)
Phishing Detection
Email Encryption
Business Email Compromise (BEC) Prevention
Personal Email Security Checklist
Process
Output Format
Edge Cases
Example
User wants to implement or improve their approach to email security hardener
Do NOT use when:
The request falls outside the scope of email security hardener
User needs a different specialized skill for their specific situation
The topic requires professional consultation beyond general guidance
Scope: Personal email security, or organizational/domain-level protection?
Domain ownership: Do you own a domain and manage its DNS records?
Email provider: Gmail, Microsoft 365, self-hosted, or other?
Threat level: General protection, or facing targeted attacks (journalists, activists, executives)?
Compliance needs: HIPAA, financial regulations, or other requirements for email?
Current setup: Do you already have SPF/DKIM/DMARC configured?
Without authentication, anyone can send email claiming to be from your domain:
Attacker's server sends:
From: ceo@yourcompany.com
To: finance@yourcompany.com
Subject: Urgent wire transfer needed
Without SPF/DKIM/DMARC, the recipient's server has no way to verify
that this email actually came from yourcompany.com's legitimate servers.
SPF, DKIM, and DMARC work together to prevent this.SPF tells receiving servers which IP addresses are authorized
to send email for your domain.
DNS TXT Record:
yourcompany.com IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"
Breakdown:
v=spf1 - SPF version
include:_spf.google.com - Google Workspace can send for us
include:sendgrid.net - SendGrid can send for us
-all - Reject ALL other senders (hard fail)
Qualifiers:
+all - Allow all (defeats the purpose, never use)
~all - Soft fail (mark suspicious but deliver)
-all - Hard fail (reject unauthorized senders) -- RECOMMENDED
?all - Neutral (no policy)
Common pitfall: SPF has a 10 DNS lookup limit.
Each "include" counts as a lookup.
Nested includes count too.
Use SPF flattening tools if you exceed 10.DKIM cryptographically signs outgoing emails. Receiving servers
verify the signature using a public key in your DNS.
DNS TXT Record:
selector._domainkey.yourcompany.com IN TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."
How it works:
1. Your mail server signs each email with a private key
2. Signature is added as a DKIM-Signature header
3. Receiving server looks up your public key in DNS
4. Verifies the signature matches the email content
5. If content was modified in transit, verification fails
Setup (Google Workspace):
Admin Console > Apps > Google Workspace > Gmail > Authenticate Email
Generate DKIM key > Add DNS record > Start authentication
Setup (Microsoft 365):
Microsoft 365 Defender > Email & Collaboration > Policies
> DKIM > Select domain > EnableDMARC tells receiving servers what to do when SPF or DKIM fails,
and sends you reports about who is sending email as your domain.
DNS TXT Record:
_dmarc.yourcompany.com IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com; pct=100"
Rollout strategy (gradual enforcement):
Phase 1 (Monitor, 2-4 weeks):
p=none; rua=mailto:dmarc-reports@yourcompany.com
Collects reports without affecting delivery.
Review reports to find legitimate senders you missed in SPF.
Phase 2 (Quarantine, 2-4 weeks):
p=quarantine; pct=25; rua=mailto:...
Quarantine 25% of failing emails. Monitor for false positives.
Gradually increase pct to 100.
Phase 3 (Reject):
p=reject; rua=mailto:...; pct=100
Reject all emails that fail both SPF and DKIM.
This is the goal -- full domain spoofing protection.
DMARC report analysis tools:
- Valimail (free tier available)
- dmarcian.com
- Postmark DMARC tool (free)
- DMARC AnalyzerEmail Header Analysis:
[ ] From address domain matches expected sender?
[ ] Reply-To differs from From? (common in phishing)
[ ] SPF/DKIM/DMARC pass? (check email headers)
[ ] Received headers show expected mail servers?
Content Analysis:
[ ] Urgency or fear language? ("Your account will be suspended")
[ ] Request for credentials, money, or sensitive data?
[ ] Generic greeting? ("Dear Customer" vs your name)
[ ] Grammar/spelling errors? (less reliable -- AI has improved)
[ ] Links go where they claim? (hover to check URL)
[ ] Unexpected attachment? (especially .zip, .exe, .docm)
Contextual Analysis:
[ ] Were you expecting this email?
[ ] Does the request match normal procedures?
[ ] If from a colleague, does the tone match their style?
[ ] Would this person normally make this request via email?1. DO NOT click links or open attachments
2. Check the actual sender address (not just display name)
Display: "IT Support <helpdesk@company.com>"
Actual: helpdesk@company-security-check.com (FAKE)
3. Verify through a separate channel
- Call the person using a known phone number (not one from the email)
- Send a new email to their known address (don't reply)
- Walk to their desk if possible
4. Check links without clicking
- Hover to see actual URL
- Use urlscan.io or VirusTotal to check URLs safely
- Look for misspellings: "paypa1.com" vs "paypal.com"
5. Report to IT/Security team
- Forward as attachment (preserves headers)
- Most organizations have a report phishing buttonPGP provides end-to-end encryption for email content.
How it works:
1. You generate a key pair (public + private)
2. Share your public key with correspondents
3. They encrypt messages with your public key
4. Only your private key can decrypt them
Setup (GPG):
# Generate key pair
gpg --full-generate-key
# Choose: RSA and RSA, 4096 bits, does not expire (or set expiry)
# Export public key to share
gpg --armor --export your@email.com > public_key.asc
# Import someone's public key
gpg --import their_public_key.asc
# Encrypt a message
gpg --encrypt --armor --recipient their@email.com message.txt
# Decrypt a message
gpg --decrypt encrypted_message.asc
Email clients with PGP support:
- Thunderbird (built-in OpenPGP)
- Mailvelope (browser extension for webmail)
- GPG4Win + Outlook (Windows)
- GPGTools + Apple Mail (macOS)| Provider | Encryption | Jurisdiction | Open Source | Price |
|---|---|---|---|---|
| ProtonMail | E2E encrypted at rest | Switzerland | Yes | Free / $4/mo |
| Tutanota | E2E encrypted at rest | Germany | Yes | Free / $3/mo |
| Gmail | TLS in transit, Google scans | USA | No | Free / $6/mo |
| Microsoft 365 | TLS in transit, Microsoft access | USA | No | $6/mo |
| Fastmail | TLS in transit | Australia | Partial | $5/mo |
For high-security needs:
ProtonMail or Tutanota (E2E encryption, privacy-focused jurisdiction)
For most business use:
Google Workspace or Microsoft 365 with proper SPF/DKIM/DMARC
Plus organizational policies and user training
For maximum privacy:
Self-hosted mail server + PGP
(High maintenance, not recommended for most people)1. CEO Fraud
Attacker impersonates CEO, asks finance to wire funds
"I need you to handle a confidential acquisition. Wire $50,000 to..."
2. Invoice Fraud
Attacker compromises vendor email, sends fake invoice with new bank details
"Our banking information has changed. Please send payment to..."
3. Account Compromise
Attacker gains access to real employee email, requests payments from contacts
Uses actual email threads to build credibility
4. Attorney Impersonation
Attacker impersonates lawyer, creates urgency around legal matter
"This is time-sensitive and confidential. Please wire..."Technical Controls:
[ ] DMARC at p=reject on all company domains
[ ] Email display name spoofing detection
[ ] External email banner ("This email is from outside the organization")
[ ] Link rewriting and sandboxing (Safe Links)
[ ] Attachment scanning and detonation (Safe Attachments)
Process Controls:
[ ] Dual authorization for wire transfers over threshold
[ ] Verbal confirmation for payment changes via known phone number
[ ] No financial transactions based solely on email requests
[ ] Vendor bank change process requires in-person or phone verification
Training Controls:
[ ] Regular phishing simulations (monthly)
[ ] BEC-specific awareness training
[ ] Reward reporting of suspicious emails (not punish clicking)
[ ] Executive-specific training (they are primary targets)Account Security:
[ ] Strong, unique password (20+ characters, password manager)
[ ] Two-factor authentication enabled (hardware key preferred)
[ ] Recovery options up to date (phone, backup email)
[ ] App passwords revoked for unused applications
[ ] Recent activity reviewed (check for unauthorized access)
[ ] Connected apps audited (revoke unnecessary OAuth grants)
Email Hygiene:
[ ] Separate email for sensitive accounts (banking, medical)
[ ] Disposable email for signups (SimpleLogin, AnonAddy)
[ ] Unsubscribe from unnecessary mailing lists
[ ] Don't use email for sensitive file transfer (use encrypted sharing)
Domain Protection (if you own a domain):
[ ] SPF record configured with -all
[ ] DKIM enabled and DNS record published
[ ] DMARC at p=reject with reporting
[ ] Unused subdomains have SPF "v=spf1 -all" (prevent spoofing)Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
Analyze context. Review the information provided and identify key factors relevant to email security hardener
Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
Present structured output. Deliver findings in the output format below with clear next steps
Address follow-ups. Answer additional questions and refine recommendations based on feedback
## Email Security Hardener Analysis
### Assessment
[Key findings and observations]
### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]
### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]Incomplete information: Ask clarifying questions before proceeding with recommendations
Conflicting requirements: Prioritize the most critical constraint and note trade-offs
Out of scope requests: Redirect to appropriate specialized skill or professional resource
Beginner vs advanced: Adjust depth and terminology based on user's experience level
Input: "Help me with email security hardener for my current situation"
Output:
Based on your situation, here is a structured approach to email security hardener:
Assessment: Evaluate your current state and identify key areas for improvement
Strategy: Develop a targeted plan based on best practices
Implementation: Execute the plan with specific, measurable steps
Review: Monitor progress and adjust as needed
SKILL.md
385 lines · 1,876 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Email Security Hardener bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for