domainwidedelegation.comStart free

Use cases → Email operations

Remove phishing emails across many inboxes fast

Sweep malicious messages from user mailboxes at scale after a phishing campaign is detected or reported.

Who it is forSecurity operations and IT teams responding to phishing attacks.
APIsGmail API, Admin SDK
Typical scopesgmail.modify, admin.directory.user.readonly

The problem

Once a phishing message is reported, copies often remain unread in dozens or hundreds of inboxes. Relying on users to delete or report is inconsistent, and every hour increases risk.

How it works

  1. Identify affected users using Admin SDK directory queries or Gmail search.
  2. For each user, impersonate via domain-wide delegation and search for the offending message by header or snippet.
  3. Use the Gmail API to move matching messages to the trash or permanently delete.
  4. Log actions and notify users when messages are removed.

What changes

Malicious emails are purged from all affected mailboxes in minutes, not days, reducing risk and limiting further spread.

The trap in this one. The Gmail API's message search can return stale results for up to several minutes after delivery. If you run the remediation too quickly after the initial mail delivery, the sweep can miss some copies, especially in high-volume tenants. Always re-check after a short delay and consider running a second pass to catch stragglers.

Questions people ask

Can this restore messages if removed in error?

If messages are only moved to trash, users can recover them within 30 days. Permanent deletion is irreversible, so verify matches before removing.

How do I find the right search criteria?

Use unique headers like Message-ID or consistent subject lines, but beware that some phishing campaigns randomise these fields per recipient.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Standardise email signatures for all users in bulk

Set consistent signatures across the domain by updating each user's Gmail settings via a delegated service account.

Enforce encryption for sensitive email content automatically

Detect sensitive data in outbound mail and apply encryption or block sending using a delegated service account.

Send a survey to every employee by mail merge

Deliver a company-wide survey by generating individual emails to all users via a delegated service account, avoiding mass recipient limits.