Disclosure: we build OutlookDog, an AI add-in for Outlook — this post is the engineering lessons, not a pitch.
After a year of building email-safety features on the Office add-in platform, here are five lessons that might help anyone working in this space.
Users don't act on "SPF fail" — they act on "this sender looks like your vendor but isn't." We demoted every protocol term to a footnote and warnings started working.
An add-in that can't send, delete, or move mail can't be tricked into doing any of those things — by a user mistake, a prompt injection, or a malicious email pretending to be a rule. It's also the difference between "please approve this add-in" going well or badly with an IT team.
A message that fails identity checks gets warned about even if the user marked that sender safe — the spoof of a trusted sender is exactly the mail the safelist would otherwise wave through.
We tuned toward warn-and-explain: every flag shows its specific red flags so the user can judge in seconds. False-positive complaints dropped when the reason became visible, not when the warnings got rarer.
For a title company, a closing practice, a property manager — one caught "updated wiring instructions" email pays for a decade of any tool. That's the email to design for, not the lottery-scam strawman. Happy to go deeper on any of these in the comments. We build OutlookDog and launched it on Product Hunt this week.