{
  "name": "Analyze email headers for IP reputation and spoofing detection - Gmail",
  "nodes": [
    {
      "id": "05096721-e15a-4d2a-83b3-3b31d6435c59",
      "name": "Gmail Trigger",
      "type": "n8n-nodes-base.gmailTrigger",
      "position": [
        -680,
        -140
      ]
    },
    {
      "id": "9eb59c41-fa15-45ee-b343-cf30ac058600",
      "name": "Gmail - Extract Received Headers",
      "type": "n8n-nodes-base.code",
      "position": [
        200,
        -80
      ]
    },
    {
      "id": "05ba1e0a-1f47-492b-b57c-c82b2b8af99d",
      "name": "Gmail - Extract Original From IP",
      "type": "n8n-nodes-base.set",
      "position": [
        620,
        -80
      ]
    },
    {
      "id": "86bdebd4-fa96-4622-bc9d-67cea96486a4",
      "name": "Gmail - Original IP Found?",
      "type": "n8n-nodes-base.if",
      "position": [
        840,
        -20
      ]
    },
    {
      "id": "18c23866-58fc-4cdb-9bea-961da75dbac5",
      "name": "Gmail - Query IP Quality Score API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1080,
        -160
      ]
    },
    {
      "id": "9b35ce2c-d382-41b2-8e31-3238cc7c83bc",
      "name": "Gmail - Query IP API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1280,
        -160
      ]
    },
    {
      "id": "dbd95b55-f54a-477e-bdfe-4fd564b71154",
      "name": "Gmail - Authentication-Results Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1480,
        -20
      ]
    },
    {
      "id": "972aee72-e5fd-4215-91d5-ea099b0ce379",
      "name": "Gmail - Received-SPF Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1820,
        620
      ]
    },
    {
      "id": "814810d9-46d4-4c4b-8b48-09504b39bab9",
      "name": "Gmail - Extract Authentication-Results Header",
      "type": "n8n-nodes-base.code",
      "position": [
        1840,
        -180
      ]
    },
    {
      "id": "98fd0bec-db8c-41bf-b5da-b485872366a5",
      "name": "Gmail - Extract Received-SPF Header",
      "type": "n8n-nodes-base.code",
      "position": [
        2160,
        460
      ]
    },
    {
      "id": "6c893235-19dd-40fb-860d-368de317907b",
      "name": "Gmail - Determine Auth Values",
      "type": "n8n-nodes-base.set",
      "position": [
        2560,
        -180
      ]
    },
    {
      "id": "66203758-da3b-499a-a95e-2e04f196fc30",
      "name": "Gmail - Set SPF Value",
      "type": "n8n-nodes-base.set",
      "position": [
        2600,
        460
      ]
    },
    {
      "id": "8393c205-673a-46d7-977e-9a60720b1c39",
      "name": "Gmail - No SPF Found",
      "type": "n8n-nodes-base.set",
      "position": [
        2600,
        640
      ]
    },
    {
      "id": "2d7c752a-32cf-4c2c-9e59-e703b0b22ee9",
      "name": "Gmail - Format Output",
      "type": "n8n-nodes-base.set",
      "position": [
        3520,
        100
      ]
    },
    {
      "id": "08b8b071-a94e-43d6-b7a0-85c101630a5c",
      "name": "Gmail - DKIM Signature Found",
      "type": "n8n-nodes-base.set",
      "position": [
        2600,
        820
      ]
    },
    {
      "id": "e90d4a39-7bd7-4475-a5fa-1a31077004d9",
      "name": "Gmail - DKIM-Signature Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1820,
        900
      ]
    },
    {
      "id": "c8136c1a-7fcd-4301-a36d-d27fb535c868",
      "name": "Gmail - No DKIM Signature Found",
      "type": "n8n-nodes-base.set",
      "position": [
        2600,
        1020
      ]
    },
    {
      "id": "84f3ddb5-9a52-45ed-bb98-c88145b69d9a",
      "name": "Gmail - Set DMARC Value",
      "type": "n8n-nodes-base.set",
      "position": [
        2600,
        1240
      ]
    },
    {
      "id": "4ac86848-09db-47a0-afed-20aa92e86ff8",
      "name": "Gmail - Extract DMARC Header",
      "type": "n8n-nodes-base.code",
      "position": [
        2260,
        1240
      ]
    },
    {
      "id": "9e80bfaf-c3f4-4ba9-acfd-c467ecf4563a",
      "name": "Gmail - DMARC Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1820,
        1340
      ]
    },
    {
      "id": "448095c0-5d26-4ab6-aae4-3a3ff568de62",
      "name": "Gmail - No DMARC Header",
      "type": "n8n-nodes-base.set",
      "position": [
        2600,
        1440
      ]
    },
    {
      "id": "a972ebae-67e6-4216-ae24-9db64906c523",
      "name": "Set Gmail Headers Here",
      "type": "n8n-nodes-base.set",
      "position": [
        -320,
        -140
      ]
    },
    {
      "id": "46b1e8fe-c564-49a7-b38b-22b267fb6fc5",
      "name": "Format Individual Auth Outputs1",
      "type": "n8n-nodes-base.set",
      "position": [
        3280,
        100
      ]
    },
    {
      "id": "8532b9d6-a4e2-4185-a624-26559a6449f4",
      "name": "Format Combined Auth Output1",
      "type": "n8n-nodes-base.set",
      "position": [
        3100,
        -80
      ]
    },
    {
      "id": "3e1323d4-a963-4a13-bbca-b6bb8ee5a9ce",
      "name": "Gmail - Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -673,
        541
      ]
    },
    {
      "id": "8938765f-c569-4935-91d7-15c555e9fb99",
      "name": "Gmail - Remove Extra Received Headers",
      "type": "n8n-nodes-base.limit",
      "position": [
        420,
        -80
      ]
    },
    {
      "id": "755b1716-5f63-4f5c-bc76-4bcaa7ffbb03",
      "name": "Gmail - Merge",
      "type": "n8n-nodes-base.merge",
      "position": [
        2880,
        100
      ]
    },
    {
      "id": "19bbc6ce-feb3-49f8-b8d6-a99538810555",
      "name": "Gmail - Aggregate",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        3100,
        100
      ]
    },
    {
      "id": "33625d80-1bb7-474c-935b-0878d9185a41",
      "name": "Gmail - Set Headers",
      "type": "n8n-nodes-base.set",
      "position": [
        0,
        -80
      ]
    },
    {
      "id": "db297206-5433-413b-8e78-dcf5f10dc41e",
      "name": "Gmail - Respond to Webhook",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        3800,
        100
      ]
    },
    {
      "id": "cd401445-2b7a-42c9-9bf9-b17cc12a817b",
      "name": "Aggregate Received-SPF Headers1",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        2380,
        460
      ]
    },
    {
      "id": "6863e527-bc58-438c-8c3c-87f43994ac61",
      "name": "Set Gmail Webhook Headers Here",
      "type": "n8n-nodes-base.set",
      "position": [
        -233,
        541
      ]
    },
    {
      "id": "8af99afc-538f-4e5b-9d69-e3c41ee3d300",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -722.5965764931168,
        -597.9994506078199
      ],
      "parameters": {
        "width": 630.8094744668451,
        "height": 645.5004204663932,
        "content": "![](https://uploads.n8n.io/templates/gmaillogo.png)  \n## **Testing Email Header Analysis Workflow**\n\nThis section of the workflow is designed for testing purposes to ensure that the setup functions co"
      }
    },
    {
      "id": "eeca8b68-8536-4131-a370-02822a8a13df",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -82,
        -524.2941123664101
      ],
      "parameters": {
        "width": 869.3564073187465,
        "height": 611.2507800793627,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)  \n## **Extract and Process Email Headers**\n\nThis section processes the headers from incoming email data to extract critical information, particularly focu"
      }
    },
    {
      "id": "bdabc308-6f17-413d-beb6-fde80d54140a",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        800,
        -599.6286292747894
      ],
      "parameters": {
        "width": 922.1859426288208,
        "height": 824.9161858198846,
        "content": "![](https://uploads.n8n.io/templates/ipqualityscoretemplate.png)  \n## **Analyze IP Address and Check Authentication Results**\n\nThis section analyzes the originating IP address and verifies the presenc"
      }
    },
    {
      "id": "164c6c86-582f-44a8-b866-8865c6d4c2e5",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1735,
        -551.4521798091497
      ],
      "parameters": {
        "width": 1016.1357697283069,
        "height": 541.7962991053803,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)  \n## **Extract and Evaluate Authentication Results**\n\nThe workflow continues with the `Gmail - Extract Authentication-Results Header` node, which isolates"
      }
    },
    {
      "id": "8019b817-c8f7-425a-b372-5ba3109f5b64",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2773,
        -500.1753788350808
      ],
      "parameters": {
        "width": 1285.8545784346588,
        "height": 759.649504764657,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Combine Results and Respond to Webhook**\n\nThe final section consolidates results from previous nodes into a cohesive output for the webhook response."
      }
    },
    {
      "id": "4d7e8d8f-bd8e-4152-b375-8561b6f2d3fb",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1733,
        -1
      ],
      "parameters": {
        "width": 1016.1357697283069,
        "height": 1666.528211982754,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Evaluate SPF, DKIM, and DMARC Compliance**\n\nThis section performs detailed analysis of SPF, DKIM, and DMARC headers. The `Gmail - Received-SPF Header"
      }
    },
    {
      "id": "544764a9-35f1-4a42-a9c7-b97f6c09314e",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -721.3492584351117,
        60
      ],
      "parameters": {
        "width": 625.8275790033185,
        "height": 660.0846008994936,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Webhook Integration for Production**\n\nThis section transitions the workflow into production, enabling it to function as an API for analyzing email he"
      }
    },
    {
      "id": "fe9bb5cc-8bbd-4929-9bbe-8a78adce5434",
      "name": "Skip IP Check",
      "type": "n8n-nodes-base.noOp",
      "position": [
        1160,
        80
      ]
    }
  ],
  "connections": {
    "Gmail - Merge": {
      "main": [
        [
          {
            "node": "Gmail - Aggregate",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail Trigger": {
      "main": [
        [
          {
            "node": "Set Gmail Headers Here",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Skip IP Check": {
      "main": [
        [
          {
            "node": "Gmail - Authentication-Results Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Webhook": {
      "main": [
        [
          {
            "node": "Set Gmail Webhook Headers Here",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Aggregate": {
      "main": [
        [
          {
            "node": "Format Individual Auth Outputs1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Set Headers": {
      "main": [
        [
          {
            "node": "Gmail - Extract Received Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - No SPF Found": {
      "main": [
        [
          {
            "node": "Gmail - Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Query IP API": {
      "main": [
        [
          {
            "node": "Gmail - Authentication-Results Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - DMARC Header?": {
      "main": [
        [
          {
            "node": "Gmail - Extract DMARC Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Gmail - No DMARC Header",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Format Output": {
      "main": [
        [
          {
            "node": "Gmail - Respond to Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Set SPF Value": {
      "main": [
        [
          {
            "node": "Gmail - Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Gmail Headers Here": {
      "main": [
        [
          {
            "node": "Gmail - Set Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - No DMARC Header": {
      "main": [
        [
          {
            "node": "Gmail - Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Gmail - Set DMARC Value": {
      "main": [
        [
          {
            "node": "Gmail - Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Gmail - Original IP Found?": {
      "main": [
        [
          {
            "node": "Gmail - Query IP Quality Score API",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Skip IP Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Combined Auth Output1": {
      "main": [
        [
          {
            "node": "Gmail - Format Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - DKIM Signature Found": {
      "main": [
        [
          {
            "node": "Gmail - Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Gmail - Extract DMARC Header": {
      "main": [
        [
          {
            "node": "Gmail - Set DMARC Value",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Received-SPF Header?": {
      "main": [
        [
          {
            "node": "Gmail - Extract Received-SPF Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Gmail - No SPF Found",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Determine Auth Values": {
      "main": [
        [
          {
            "node": "Format Combined Auth Output1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - DKIM-Signature Header?": {
      "main": [
        [
          {
            "node": "Gmail - DKIM Signature Found",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Gmail - No DKIM Signature Found",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Gmail Webhook Headers Here": {
      "main": [
        [
          {
            "node": "Gmail - Set Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate Received-SPF Headers1": {
      "main": [
        [
          {
            "node": "Gmail - Set SPF Value",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Individual Auth Outputs1": {
      "main": [
        [
          {
            "node": "Gmail - Format Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - No DKIM Signature Found": {
      "main": [
        [
          {
            "node": "Gmail - Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Gmail - Extract Original From IP": {
      "main": [
        [
          {
            "node": "Gmail - Original IP Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Extract Received Headers": {
      "main": [
        [
          {
            "node": "Gmail - Remove Extra Received Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Query IP Quality Score API": {
      "main": [
        [
          {
            "node": "Gmail - Query IP API",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Extract Received-SPF Header": {
      "main": [
        [
          {
            "node": "Aggregate Received-SPF Headers1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Remove Extra Received Headers": {
      "main": [
        [
          {
            "node": "Gmail - Extract Original From IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Authentication-Results Header?": {
      "main": [
        [
          {
            "node": "Gmail - Extract Authentication-Results Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Gmail - Received-SPF Header?",
            "type": "main",
            "index": 0
          },
          {
            "node": "Gmail - DKIM-Signature Header?",
            "type": "main",
            "index": 0
          },
          {
            "node": "Gmail - DMARC Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Extract Authentication-Results Header": {
      "main": [
        [
          {
            "node": "Gmail - Determine Auth Values",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}