Email Header Spoofing and IP Reputation Analysis - n8n Workflow

• System Administrators and IT Security Analysts needing automated email security monitoring.


• Developers integrating header analysis into anti-spam platforms using a customizable n8n API.


• Users looking for advanced examples of data parsing, regex, and API integration within an n8n workflow.


• Anyone requiring a robust n8n template for analyzing email spoofing attempts.

This advanced n8n workflow template provides a crucial layer of defense against email spoofing and phishing attacks. It automates the complex task of dissecting email headers to identify the true origin and security posture of an incoming message. By leveraging external IP reputation APIs and meticulously checking SPF, DKIM, and DMARC compliance, this n8n automation provides a comprehensive security report. This flexible n8n workflow can be triggered either directly by new Gmail messages or via a dedicated webhook, making it suitable for both personal security monitoring and large-scale application integration. Using this robust n8n node configuration saves countless hours of manual header analysis.

1. Trigger: The n8n workflow starts either when a new email arrives (using the disabled Gmail Trigger n8n node for testing) or upon receiving an external JSON payload via the active Gmail - Webhook n8n node.


2. Header Preparation: The initial set of n8n nodes extracts the raw headers from the incoming email data into a standardized JSON object.


3. IP Extraction: Specialized Code and Set n8n nodes sift through the "Received" headers, focusing on the most recent one, and use sophisticated regular expressions to isolate and extract the original, non-private IP address of the sender.


4. Reputation Check: An If n8n node checks if an IP was successfully found. If so, two HTTP Request n8n nodes query IP Quality Score API to determine the sender's fraud score and IP API for geolocation and organization details.


5. Authentication Parsing (Primary Path): The workflow checks for the powerful, combined Authentication-Results header using an If n8n node. If present, a subsequent Set n8n node (Gmail - Determine Auth Values) parses the single header string to extract separate SPF, DKIM, and DMARC pass/fail statuses.


6. Authentication Parsing (Fallback Path): If the combined header is missing, the n8n workflow branches out to check for and evaluate individual Received-SPF, DKIM-Signature, and DMARC headers separately.


7. Final Consolidation: A series of Merge and Aggregate n8n nodes (Gmail - Merge, Gmail - Aggregate) combine all gathered data—IP reputation, geographic info, and all authentication results—into one unified security report.


8. Response: The final Set n8n node formats the output, and the Gmail - Respond to Webhook n8n node sends the complete analysis back to the calling application, completing the n8n automation.

1. Import the n8n workflow: Copy the provided JSON data and paste it into your n8n instance using the "Import Workflow" function.


2. Configure Credentials:

1. Choose Trigger: The Gmail Trigger n8n node is disabled by default. If you intend to run this as a real-time service via a third party, activate the entire n8n workflow and use the URL provided by the Gmail - Webhook n8n node.


2. Activate: Save and activate the n8n workflow to begin monitoring or processing requests.

• Gmail Trigger / Gmail - Webhook (n8n node): Serves as the starting point, initiating the flow either based on new email arrival or an external POST request containing the email headers.


• Gmail - Extract Original From IP (Set n8n node): A critical n8n node that uses a complex regular expression to extract the first external IPv4 or IPv6 address found in the "Received" email headers, excluding internal IP ranges.


• Gmail - Query IP Quality Score API (HTTP Request n8n node): Queries the IP Quality Score external service using the extracted IP address to retrieve a sender fraud score and reputation data for this n8n workflow analysis.


• Gmail - Determine Auth Values (Set n8n node): Used when the comprehensive Authentication-Results header is present. This powerful n8n node parses the string using JavaScript expressions to quickly extract separate spfvalue, dkimvalue, and dmarcvalue statuses (pass/fail/unknown).


• Gmail - Authentication-Results Header? (If n8n node): Directs the flow based on the presence of the combined authentication header, streamlining the analysis process within this n8n template.


• Gmail - Merge & Aggregate (n8n nodes): These core logic n8n nodes are responsible for combining the results from the IP checks and the authentication status branches (Path 1 and Path 2) into one complete data item.


• Format Combined Auth Output1 (Set n8n node): The final formatting n8n node, structuring the output into a clear report including the initialIP, organization, ipSenderReputation, and authentication results, ready for external consumption via the webhook.