Testing Email Header Analysis Workflow

This section of the workflow is designed for testing purposes to ensure that the setup functions correctly with your Gmail email client before deploying it as an API for third-party platforms. The process begins with the Gmail Trigger node, which monitors your Gmail inbox and triggers the workflow whenever a new email arrives.

Once an email is detected, the Set Gmail Headers Here node extracts the email headers from the detected email and organizes them into a standardized format as an object called headers. This prepares the email data for further processing in subsequent sections of the workflow. By validating these steps, you can confirm the workflow is functioning correctly before integrating it into broader use cases.

Extract and Process Email Headers

This section processes the headers from incoming email data to extract critical information, particularly focusing on the originating IP address. The workflow begins with the Gmail - Set Headers node, which prepares the headers for analysis.

The Gmail - Extract Received Headers node filters through the headers and isolates those labeled as "Received." These headers document the servers through which the email has passed, providing a traceable path of its journey. Next, the Gmail - Remove Extra Received Headers node narrows the focus to the most recent "Received" header, typically containing the originating IP address of the email sender.

Using the Gmail - Extract Original From IP node, the workflow applies a regular expression to extract the IP address from the retained header, removing internal or private IP addresses. This ensures that only the relevant external IP address is identified.

Analyze IP Address and Check Authentication Results

This section analyzes the originating IP address and verifies the presence of essential email authentication headers. The Gmail - Original IP Found? node determines whether the extracted IP address is valid and non-empty. If valid, the workflow proceeds; otherwise, it triggers the Skip IP Check node to move on to the next steps.

The Gmail - Query IP Quality Score API node evaluates the IP’s reputation, identifying associations with spam, fraud, or other malicious activities. The Gmail - Query IP API node enriches the analysis by providing additional details such as geographic location and organizational affiliation of the IP.

Finally, the Gmail - Authentication-Results Header? node checks for the presence of the "Authentication-Results" header, which indicates SPF, DKIM, and DMARC checks performed by the receiving email server. If present, the header is further analyzed in subsequent sections.

Extract and Evaluate Authentication Results

The workflow continues with the Gmail - Extract Authentication-Results Header node, which isolates and parses the authentication results header. The Gmail - Determine Auth Values node processes the extracted data, categorizing the SPF, DKIM, and DMARC results as pass, fail, neutral, error, or unknown.

The Gmail - Format Combined Auth Output node consolidates the authentication results with metadata from previous nodes, including the originating IP, geographic details, organization, IP reputation, and spam activity. This structured output provides a comprehensive overview of the email's legitimacy, ready for external integration or reporting.

Combine Results and Respond to Webhook

The final section consolidates results from previous nodes into a cohesive output for the webhook response. The Gmail - Merge node combines data streams from SPF, DKIM, and DMARC evaluations. The Gmail - Aggregate node structures the data into a unified format.

The Gmail - Format Individual Auth Outputs1 and Gmail - Format Combined Auth Output1 nodes prepare the data as a structured JSON object, including all authentication results and metadata such as IP reputation and geographic information. The Gmail - Format Output node finalizes the response structure, and the Gmail - Respond to Webhook node sends the response to the requesting system.

This ensures seamless integration and delivers actionable insights to external platforms, completing the email analysis pipeline.

Evaluate SPF, DKIM, and DMARC Compliance

This section performs detailed analysis of SPF, DKIM, and DMARC headers. The Gmail - Received-SPF Header? node identifies the presence of the "Received-SPF" header, while the Gmail - Extract Received-SPF Header and Aggregate Received-SPF Headers1 nodes extract and analyze SPF validation results. The Gmail - Set SPF Value node records the SPF status, and the Gmail - No SPF Found node handles cases where the header is absent.

Similarly, the Gmail - DKIM-Signature Header? node checks for a DKIM signature. If found, the Gmail - DKIM Signature Found node records its presence; otherwise, the Gmail - No DKIM Signature Found node handles its absence.

The Gmail - DMARC Header? node evaluates the DMARC policy header, with results extracted by Gmail - Extract DMARC Header or noted as absent by the Gmail - No DMARC Header node.

Webhook Integration for Production

This section transitions the workflow into production, enabling it to function as an API for analyzing email headers received from third-party platforms. To utilize this webhook functionality, it is essential to activate the workflow, as the webhook will only respond when the workflow is live.

The Gmail - Webhook node listens for incoming HTTP POST requests at the specified path. When the webhook is triggered, it receives and processes the payload containing email data, including headers sent by the third-party platform. The Set Gmail Webhook Headers Here node extracts the headers array from the payload's body, ensuring the incoming data is formatted correctly and ready for further processing in subsequent steps.

By activating the workflow and integrating it with external systems, users can automate the analysis of email headers seamlessly in a production environment.

Testing Email Header Analysis Workflow

Purpose and structure

This folder contains the Testing Email Header Analysis Workflow workflow. Its executable nodes use aggregate, code, gmailTrigger, httpRequest, if, limit, merge, noOp, respondToWebhook, set, webhook. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

Gmail Trigger, Gmail - Webhook

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Limit/0674_Limit_Webhook_Automation_Webhook.json MIT; preserve source notices.