domainwidedelegation.comStart free

Use cases → Email operations

Remove phishing emails across many inboxes fast

Sweep malicious messages from user mailboxes at scale after a phishing campaign is detected or reported.

Who it is forSecurity operations and IT teams responding to phishing attacks.
APIsGmail API, Admin SDK
Typical scopesgmail.modify, admin.directory.user.readonly

The problem

Once a phishing message is reported, copies often remain unread in dozens or hundreds of inboxes. Relying on users to delete or report is inconsistent, and every hour increases risk.

How it works

  1. Identify affected users using Admin SDK directory queries or Gmail search.
  2. For each user, impersonate via domain-wide delegation and search for the offending message by header or snippet.
  3. Use the Gmail API to move matching messages to the trash or permanently delete.
  4. Log actions and notify users when messages are removed.

What changes

Malicious emails are purged from all affected mailboxes in minutes, not days, reducing risk and limiting further spread.

The trap in this one. The Gmail API's message search can return stale results for up to several minutes after delivery. If you run the remediation too quickly after the initial mail delivery, the sweep can miss some copies, especially in high-volume tenants. Always re-check after a short delay and consider running a second pass to catch stragglers.

Questions people ask

Can this restore messages if removed in error?

If messages are only moved to trash, users can recover them within 30 days. Permanent deletion is irreversible, so verify matches before removing.

How do I find the right search criteria?

Use unique headers like Message-ID or consistent subject lines, but beware that some phishing campaigns randomise these fields per recipient.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Bulk update user email signatures with a service account

Set consistent Gmail signatures across many users using domain-wide delegation, while handling update limits and propagation quirks.

Automate onboarding welcome emails via service account

Send onboarding emails as new users are created, directly from a real mailbox, without human intervention or missed recipients.

Send onboarding welcome emails as a delegated service

Automate welcome emails for new users by sending from a delegated account, ensuring consistency and timely delivery for every new joiner.