domainwidedelegation.comStart free

Use cases → Email operations

Remove phishing emails across many inboxes fast

Sweep malicious messages from user mailboxes at scale after a phishing campaign is detected or reported.

Who it is forSecurity operations and IT teams responding to phishing attacks.
APIsGmail API, Admin SDK
Typical scopesgmail.modify, admin.directory.user.readonly

The problem

Once a phishing message is reported, copies often remain unread in dozens or hundreds of inboxes. Relying on users to delete or report is inconsistent, and every hour increases risk.

How it works

  1. Identify affected users using Admin SDK directory queries or Gmail search.
  2. For each user, impersonate via domain-wide delegation and search for the offending message by header or snippet.
  3. Use the Gmail API to move matching messages to the trash or permanently delete.
  4. Log actions and notify users when messages are removed.

What changes

Malicious emails are purged from all affected mailboxes in minutes, not days, reducing risk and limiting further spread.

The trap in this one. The Gmail API's message search can return stale results for up to several minutes after delivery. If you run the remediation too quickly after the initial mail delivery, the sweep can miss some copies, especially in high-volume tenants. Always re-check after a short delay and consider running a second pass to catch stragglers.

Questions people ask

Can this restore messages if removed in error?

If messages are only moved to trash, users can recover them within 30 days. Permanent deletion is irreversible, so verify matches before removing.

How do I find the right search criteria?

Use unique headers like Message-ID or consistent subject lines, but beware that some phishing campaigns randomise these fields per recipient.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Manage domain-wide email allow and block lists centrally

Set, update, and audit email whitelist and blacklist rules across all users from one place, avoiding manual filter drift and inconsistent enforcement.

Automate signature updates for every user in Workspace

Apply a standard email signature across all mailboxes using a delegated service account and track which users have been updated.

Enforce standardised email footers domain-wide

Ensure every outbound message includes a compliant footer by injecting or replacing signatures at send-time across all users.