Analyze email headers for spoofing addresses 3
Workflow Description
Advanced automation workflow that receives email headers via webhook, analyzes them using custom code to detect spoofed addresses and phishing indicators, processes results through conditional logic, merges findings, and returns a detailed security assessment response.
How it works
- 1.Receive email headers through Webhook trigger and prepare for analysis
- 2.Execute analytical code to verify header integrity, digital signatures, and suspicious patterns
- 3.Organize detected anomalies into structured item lists and apply conditional logic filters
- 4.Integrate analysis results with external verification HTTP requests for reputation checks
- 5.Store aggregated findings in workflow variables for comprehensive reporting
- 6.Send response containing risk score, suspicious indicators, and recommended actions
Use cases
- Screen corporate email traffic to identify spoofing attempts and phishing campaigns before reaching users
- Detect unauthorized senders impersonating trusted domains or executives
- Generate security audit reports on unauthorized email injection attempts and domain abuse patterns
Requirements
- Expertise in email header structure and SMTP authentication standards (SPF, DKIM, DMARC)
- Access to email reputation databases and known malicious sender lists
- Integration capability with SIEM systems and security logging infrastructure
Service Value
Ready-made workflow template for automation delivery and service execution.
Apps Used
Details
How to Use
- 1.Click "Download Template"
- 2.Open your n8n dashboard
- 3.Go to Workflows > Import from File
- 4.Select downloaded file and configure credentials
Nodes Used (35)
Receive Headers
Webhook
Sticky Note
Sticky Note
Fraud Score
Code
Respond to Webhook
Webhook
Sticky Note1
Sticky Note
Explode Email Header
Code
Split Out IPs
Item Lists
Extract IPs from "received"
Code
IP Quality Score
HTTP Request
IP-API
HTTP Request
Collect interesting data
Set
SPF/DKIM/DMARC from "authentication-results"
Code
SPF from "received-spf"
Code
DKIM from "dkim-signature"
Code
DMARC from "received-dmarc"
Code
DKIM
Switch
Sticky Note4
Sticky Note
Extract Email Header from webhook
Set
Sticky Note5
Sticky Note
Sticky Note6
Sticky Note
Sticky Note8
Sticky Note
Sticky Note10
Sticky Note
Received Headers Present?
If
Authentication Results Present?
If
Aggregate Authentication Data
Set
Sticky Note2
Sticky Note
IP Data Merge
Merge
Merge Security Data
Merge
Join IP Analysis into one JSON object
Item Lists
Join results into one JSON object
Item Lists
SPF Authentication Checker
Switch
Set SPF Pass Status
Set
Set SPF Fail Status
Set
Set SPF Neutral Status
Set
Set SPF UnknownStatus
Set