Marketing & Advertising Automation

Analyze_email_headers_for_IPs_and_spoofing__3

Webhook

High

Nodes

Webhook

Trigger

High

Complexity

7/22/2025

Added

Workflow Overview

Total Nodes

Node Types

set

Set SPF Fail Status, Set SPF Neutral Status, Set SPF UnknownStatus, Collect interesting data, Extract Email Header from webhook, Aggregate Authentication Data, Set SPF Pass Status

7 nodes

webhook

Receive Headers

1 node

sticky Note

Sticky Note, Sticky Note1, Sticky Note4, Sticky Note5, Sticky Note6, Sticky Note8, Sticky Note10, Sticky Note2

8 nodes

code

Fraud Score, Explode Email Header, Extract IPs from "received", SPF/DKIM/DMARC from "authentication-results", SPF from "received-spf", DKIM from "dkim-signature", DMARC from "received-dmarc"

7 nodes

respond To Webhook

Respond to Webhook

1 node

item Lists

Split Out IPs, Join IP Analysis into one JSON object, Join results into one JSON object

3 nodes

http Request

IP Quality Score, IP-API

2 nodes

switch

DKIM, SPF Authentication Checker

2 nodes

Received Headers Present?, Authentication Results Present?

2 nodes

merge

IP Data Merge, Merge Security Data

2 nodes

Workflow JSON

44.8 KB

{
  "id": "3tJcVzt2OqeyjfnH",
  "meta": {
    "instanceId": "03e9d14e9196363fe7191ce21dc0bb17387a6e755dcc9acc4f5904752919dca8"
  },
  "name": "Analyze_email_headers_for_IPs_and_spoofing__3",
  "tags": [
    {
      "id": "GCHVocImoXoEVnzP",
      "name": "🛠️ In progress",
      "createdAt": "2023-10-31T02:17:21.618Z",
      "updatedAt": "2023-10-31T02:17:21.618Z"
    },
    {
      "id": "QPJKatvLSxxtrE8U",
      "name": "Secops",
      "createdAt": "2023-10-31T02:15:11.396Z",
      "updatedAt": "2023-10-31T02:15:11.396Z"
    }
  ],
  "nodes": [
    {
      "id": "a2dca82d-f2b4-41f7-942a-2713a5ae012e",
      "name": "Receive Headers",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -320,
        740
      ],
      "webhookId": "1bde44ab-1360-48b3-9b2f-260a82629bfa",
      "parameters": {
        "path": "90e9e395-1d40-4575-b2a0-fbf52c534167",
        "options": {},
        "httpMethod": "POST",
        "responseMode": "responseNode"
      },
      "typeVersion": 1
...

Showing first 1000 characters. Click "Expand" to view the full JSON.