phishing emails -- 2

I want a phishing email detection project. In this project, there are two machines used. One is a client machine and the other is the email server (postfix). The email server will have a sandbox (cuckoo sandbox) installed. So, a script is needed to ensure when an email comes in the postfix, the script checks if there is an attachment or link in the email. If there is no such thing, the email will be forwarded to the client but if there is an attachment or link, the script will extract those and forward them to the sandbox where they will be analysed. If the result of the analysis is fine, the email will be sent to the client otherwise it will be quarantined in postfix
we have ready vms one for postfix and cuckoo sandbox and other for client. we can provide these vms, i do belive there is a little error in configuration, we can send email manual but can not send automated linked with postfix.