Judge whether a message is what it claims to be

A read result hands you a great deal of evidence about a message and no verdict at all. That is deliberate: auth, sender, sanitisation and the link flags are facts, and the judgement made from them belongs to a person. This skill is about making that judgement carefully, and about saying out loud how far the evidence actually reaches.

The failure that matters most is a small one: reporting "DMARC passed" as "this is genuine". DMARC passing says the From domain authorised the message. It says nothing about who typed it, whether their account was taken over last Tuesday, or whether the invoice attached to it is real. Every authentication check in this package answers a question about a domain, and the user is asking a question about a person.