Developer & DevOps

Analyze email headers for spoofing addresses 3

35 nodes 212 115 Webhook
Download

Workflow Description

Advanced automation workflow that receives email headers via webhook, analyzes them using custom code to detect spoofed addresses and phishing indicators, processes results through conditional logic, merges findings, and returns a detailed security assessment response.

How it works

  1. 1.Receive email headers through Webhook trigger and prepare for analysis
  2. 2.Execute analytical code to verify header integrity, digital signatures, and suspicious patterns
  3. 3.Organize detected anomalies into structured item lists and apply conditional logic filters
  4. 4.Integrate analysis results with external verification HTTP requests for reputation checks
  5. 5.Store aggregated findings in workflow variables for comprehensive reporting
  6. 6.Send response containing risk score, suspicious indicators, and recommended actions

Use cases

  • Screen corporate email traffic to identify spoofing attempts and phishing campaigns before reaching users
  • Detect unauthorized senders impersonating trusted domains or executives
  • Generate security audit reports on unauthorized email injection attempts and domain abuse patterns

Requirements

  • Expertise in email header structure and SMTP authentication standards (SPF, DKIM, DMARC)
  • Access to email reputation databases and known malicious sender lists
  • Integration capability with SIEM systems and security logging infrastructure

Service Value

Ready-made workflow template for automation delivery and service execution.

Apps Used

Webhook Note Code Item Lists HTTP Request Set If Merge

Details

Trigger Webhook
Nodes 35
Apps 8
Views 212
Downloads 115

How to Use

  1. 1.Click "Download Template"
  2. 2.Open your n8n dashboard
  3. 3.Go to Workflows > Import from File
  4. 4.Select downloaded file and configure credentials

Nodes Used (35)

/

Receive Headers

Webhook

#1

Sticky Note

Sticky Note

#2

Fraud Score

Code

#3

Respond to Webhook

Webhook

#4

Sticky Note1

Sticky Note

#5

Explode Email Header

Code

#6

Split Out IPs

Item Lists

#7

Extract IPs from "received"

Code

#8

IP Quality Score

HTTP Request

#9

IP-API

HTTP Request

#10

Collect interesting data

Set

#11

SPF/DKIM/DMARC from "authentication-results"

Code

#12

SPF from "received-spf"

Code

#13

DKIM from "dkim-signature"

Code

#14

DMARC from "received-dmarc"

Code

#15

DKIM

Switch

#16

Sticky Note4

Sticky Note

#17

Extract Email Header from webhook

Set

#18

Sticky Note5

Sticky Note

#19

Sticky Note6

Sticky Note

#20

Sticky Note8

Sticky Note

#21

Sticky Note10

Sticky Note

#22

Received Headers Present?

If

#23

Authentication Results Present?

If

#24

Aggregate Authentication Data

Set

#25

Sticky Note2

Sticky Note

#26

IP Data Merge

Merge

#27

Merge Security Data

Merge

#28

Join IP Analysis into one JSON object

Item Lists

#29

Join results into one JSON object

Item Lists

#30

SPF Authentication Checker

Switch

#31

Set SPF Pass Status

Set

#32

Set SPF Fail Status

Set

#33

Set SPF Neutral Status

Set

#34

Set SPF UnknownStatus

Set

#35