Email Header Analysis for Spoofing and IP Reputation Checks - n8n Workflow

Security Analysts and IT Professionals needing automated email security monitoring.
System Administrators who want to validate email authenticity using SPF, DKIM, and DMARC.
Developers looking for a robust n8n template to build security APIs from incoming email data.
Users who require deep insight into the origin and reputation of emails received via Microsoft Outlook.

Email spoofing and phishing attacks are major security threats. Manually analyzing email headers to find the true origin and validate authentication results (SPF, DKIM, DMARC) is tedious and error-prone. This comprehensive n8n workflow automates the entire process.

This robust n8n template can be triggered either by a new email received in Microsoft Outlook or via a custom webhook acting as an API endpoint. The n8n workflow expertly parses complex headers, isolates the true originating IP address (bypassing internal relays), and queries two external APIs (IP Quality Score and IP API) for reputation and geolocation data. Finally, it provides a clear, structured JSON output detailing the authentication status and IP risk score, making this n8n automation an essential tool for proactive security defense.

This n8n workflow is designed with two primary starting points: a native Outlook n8n trigger for monitoring new emails, and a Webhook n8n node for API consumption.

1. Trigger & Retrieval: The workflow starts either by detecting a new email (Outlook trigger) or receiving a header payload (Webhook). For Outlook, the Retrieve Headers of Email node fetches the complete message headers via the Microsoft Graph API.


2. IP Extraction: The core logic uses Code and Limit n8n nodes to filter for the last 'Received' header, which usually contains the initial sender IP. The Extract Original From IP n8n node then uses a regular expression to cleanly extract the IP address, excluding private network IPs.


3. IP Reputation Check: If an IP is found, the workflow executes two parallel HTTP Request n8n node calls: one to the IP Quality Score API for a fraud score (reputation) and another to the IP API for geographic and organizational context.


4. Authentication Analysis: The flow checks for the presence of the composite 'Authentication-Results' header first. If present, the Determine Auth Values n8n node extracts SPF, DKIM, and DMARC statuses simultaneously.


5. Granular Auth Check (Fallback): If the composite header is missing, the n8n workflow falls back to individual If n8n node checks for 'Received-SPF', 'DKIM-Signature', and 'DMARC' headers. This uses complex branching, Code nodes for extraction, and Set nodes to define the security status (pass/fail/unknown).


6. Consolidation and Output: The Merge and Aggregate n8n node steps combine all authentication results with the IP reputation and geolocation data. The Format Individual Auth Outputs n8n node prepares the final structured JSON, which is then sent back via the Respond to Webhook n8n node, completing the security analysis pipeline.

To deploy this powerful n8n workflow, follow these steps:

1. Import: Copy the provided JSON and import it into your self-hosted or cloud n8n instance using the 'New' menu option.


2. Credentials: You will need credentials for the two third-party APIs (IP Quality Score and an IP lookup service) and optionally, Microsoft Outlook OAuth2 credentials if using the native email trigger.

1. Webhook Setup: If using the Webhook as an API, save the n8n workflow and click 'Activate'. The URL provided by the Webhook1 n8n node is the endpoint you will send raw email headers to (typically within a JSON object containing a body.headers array).


2. Testing: Execute the n8n workflow manually or test the webhook endpoint to verify that the IP extraction and API queries are functioning correctly.

Microsoft Outlook Trigger (Trigger on New Email): The primary n8n trigger for monitoring a specific Outlook mailbox folder for new emails (currently disabled for API use).
HTTP Request (Retrieve Headers of Email): Uses the Microsoft Outlook credential to fetch the full message headers ($select=internetMessageHeaders) of the triggered email using the Graph API.
Code (Extract Received Headers): A custom JavaScript n8n node that filters the large header array down to only the 'Received' headers, crucial for tracing the email path.
Set (Extract Original From IP): A critical n8n node using a complex regex expression to identify and extract the first non-private IPv4 or IPv6 address from the final 'Received' header.
HTTP Request (Query IP Quality Score API): Sends the extracted IP to a reputation service to determine its risk score (fraud_score) and categorize its trustworthiness (e.g., Good, Suspicious, Bad).
If (Authentication-Results Header?): A key flow control n8n node that checks if the receiving server has compiled the SPF, DKIM, and DMARC results into one convenient header. This simplifies processing if true.
Set (Determine Auth Values / Format Combined Auth Output): If the combined header is found, this n8n node parses the results to output structured spf, dkim, and dmarc status fields, merging this with the IP data.
Merge & Aggregate: These n8n node steps are used to combine the results when the SPF, DKIM, and DMARC results must be checked individually across separate branches, ensuring a unified data item for the final response.

• Respond to Webhook: The final n8n node that delivers the comprehensive security analysis output back to the external system that initiated the webhook request.