Phishing detection

[ChristophWurst]

Is your feature request related to a problem? Please describe.

As a Nextcloud Mail user, I want the app to help me detect phishing emails. Some of these phishing emails are not easy to spot.

Describe the solution you'd like

Run some sanity checks on the email (to be brainstormed) and

1. Show a warning
2. Disable external links
3. Offer to move the message to spam

Work packages

• Research, brainstorming and goal definition
  • Compare sender with sender label
  • Trusted domains
  • DKIM
  • BIMI add BIMI as source for avatars #5784
• Implementation
  • anchor tag text vs link checking Feat: link checking for phishing detection #9994
  • Highlighting messages with a different reply-to Feat: phishing detection #9610
  • check full name address against contacts Feat: phishing detection #9610
• feat: add internal addresses #9891
• Unit test for link checking feat: unit tests for link checking #10075
• Admin docs if applicable (Not applicable)
• feat: [User Manual] Phishing detection documentation#12152

Follow-up

• Add a setting to disable HTML emails by default
• Add quick actions (example: add email address to contact)
• Check emails for selectively applied CSS on forwards
  context : https://www.schneier.com/blog/archives/2024/04/security-vulnerability-of-html-emails.html

Suggestion

• Add a hint if a mail comes from an address that is neither in "contacts" nor has send any mails before. @kaffeeringe

Out of scope

• resolving domain names
• Build a process to integrate against configurable Lists
• SPF
• Preconfigured trust custom header tags

Describe alternatives you've considered

N/a

Additional context

#7864

[kaffeeringe]

Really important topic. I personally would like to get rid off all the fake DHL-notifications. But this is an essential feature for organisations.

[kaffeeringe]

Maybe add a hint if a mail comes from an address that is neither in "contacts" nor has send any mails before.