Overview
Report suspicious emails from Gmail or Outlook so that Phishing Triage can analyze them with the original sender's authentication intact. Accurate verdicts depend on the email reaching the connector mailbox with its original headers.
A standard forward sends the email from the reporter's address. This removes the original SPF, DKIM, and DMARC results. Phishing Triage uses those results to detect spoofing and impersonation.
This article explains how to report an email from Gmail and from Outlook.
For best results, avoid the standard Forward button. Some email clients also drop the original attachments. Phishing Triage still analyzes a forwarded email, but with less information. Use the methods in this article instead.
Prerequisites
A configured Gmail data connector or Microsoft Outlook data connector.
The address of the connector mailbox from the data connector instance settings.
Outlook only: access to the Microsoft Defender portal with permission to change user-reported settings, such as the Security Administrator role.
Outlook only: a reporting mailbox that is an Exchange Online mailbox. You cannot use a distribution group or an external mailbox.
How to use
Send a suspicious email from Gmail as an attachment
These steps apply to Gmail on the web. They preserve the original email headers.
Attach one suspicious email per message. Torq treats a message as a report only when it has exactly one attached email. Torq does not treat a message with two or more attached emails as a report.
In your inbox, select the checkbox next to one suspicious email.
At the top, click More(three dots) and select Forward as attachment. A new message opens with the email attached as an .eml file.
In the To field, enter the connector mailbox address.
Click Send.
Phishing Triage receives the email with its original headers and begins analysis.
Gmail can send reported emails to spam. Create a Gmail spam setting that bypasses spam filters for the organizational unit that contains the connector mailbox. For steps, see Google Workspace Help: Add custom spam filters to Gmail.
Report a suspicious email from Outlook
Outlook's built-in Report button sends the email to a reporting mailbox. Point the button at the connector mailbox so Phishing Triage receives each report. Steps 1 to 5 configure the button and require admin access. Steps 6 and 7 are what users do to report an email.
Step 4 changes the reporting destination for the whole tenant. Removing an existing mailbox stops reports from reaching it. Confirm that no other team relies on the current reporting mailbox before you continue.
In the Microsoft Defender portal, go to Settings > Email & collaboration > User reported settings.
In the Outlook section, select Monitor reported messages in Outlook and Use the built-in Report button in Outlook.
Under Reported item destinations, in Send reported items to, select My reporting mailbox only.
In Add an Exchange Online mailbox to Send reported items to, remove any existing mailbox. Click the field and select the connector mailbox.
Click Save.
In Outlook, select the suspicious email. You do not need to open it.
In the toolbar, click Report and select Report phishing. Outlook sends the email to the connector mailbox with its original headers.
Microsoft requires the reporting mailbox to be a SecOps mailbox so Microsoft does not filter reported emails. For steps, see Microsoft Learn: Configure SecOps mailboxes in the advanced delivery policy.