Developer & DevOps

Detect spoofed email addresses by analyzing message headers

35 nodes 293 145 Webhook
Download

Workflow Description

An advanced security automation that receives emails via webhook, analyzes their headers to identify spoofing attempts and suspicious sources, classifies threat levels, and logs all findings for audit and incident response purposes.

How it works

  1. 1.Receive email data through webhook endpoint
  2. 2.Parse and analyze email headers using custom code logic
  3. 3.Verify sender source and declared domain authentication
  4. 4.Classify threat severity and document analysis results
  5. 5.Trigger alerts and reports when threats are detected

Use cases

  • Protect corporate email from phishing and spoofing attacks
  • Automatically assess incoming message security posture
  • Document suspicious attempts for security reviews and compliance
  • Alert security team immediately about malicious emails

Requirements

  • Understanding of RFC 5322 and sender authentication protocols (SPF, DKIM, DMARC)
  • Active webhook server configured to receive email message data
  • Access to domain reputation services or APIs for validation

Service Value

Ready-made workflow template for automation delivery and service execution.

Apps Used

Webhook Note Code Item Lists HTTP Request Set If Merge

Details

Trigger Webhook
Nodes 35
Apps 8
Views 293
Downloads 145

How to Use

  1. 1.Click "Download Template"
  2. 2.Open your n8n dashboard
  3. 3.Go to Workflows > Import from File
  4. 4.Select downloaded file and configure credentials

Nodes Used (35)

/

Receive Headers

Webhook

#1

Sticky Note

Sticky Note

#2

Fraud Score

Code

#3

Respond to Webhook

Webhook

#4

Sticky Note1

Sticky Note

#5

Explode Email Header

Code

#6

Split Out IPs

Item Lists

#7

Extract IPs from "received"

Code

#8

IP Quality Score

HTTP Request

#9

IP-API

HTTP Request

#10

Collect interesting data

Set

#11

SPF/DKIM/DMARC from "authentication-results"

Code

#12

SPF from "received-spf"

Code

#13

DKIM from "dkim-signature"

Code

#14

DMARC from "received-dmarc"

Code

#15

DKIM

Switch

#16

Sticky Note4

Sticky Note

#17

Extract Email Header from webhook

Set

#18

Sticky Note5

Sticky Note

#19

Sticky Note6

Sticky Note

#20

Sticky Note8

Sticky Note

#21

Sticky Note10

Sticky Note

#22

Received Headers Present?

If

#23

Authentication Results Present?

If

#24

Aggregate Authentication Data

Set

#25

Sticky Note2

Sticky Note

#26

IP Data Merge

Merge

#27

Merge Security Data

Merge

#28

Join IP Analysis into one JSON object

Item Lists

#29

Join results into one JSON object

Item Lists

#30

SPF Authentication Checker

Switch

#31

Set SPF Pass Status

Set

#32

Set SPF Fail Status

Set

#33

Set SPF Neutral Status

Set

#34

Set SPF UnknownStatus

Set

#35

Similar Templates

Trigger automated workflows on Bitbucket code changes

1 nodes

Trigger automated workflows based on scheduled or event-driven conditions

1 nodes

Capture Telegram Messages and Store in Google Sheets

5 nodes

Generate and publish WordPress posts automatically using AI keywords

37 nodes

Process Customer Data in Batches and Send HTTP Requests

6 nodes

Receive Telegram messages and trigger n8n workflows

12 nodes