{
  "name": "Analyze email headers for IP reputation and spoofing detection - Outlook",
  "nodes": [
    {
      "id": "363be6de-5e8d-46b2-a31f-6f7bc204c986",
      "name": "Trigger on New Email",
      "type": "n8n-nodes-base.microsoftOutlookTrigger",
      "position": [
        -760,
        1400
      ]
    },
    {
      "id": "0da8b1ab-6dbe-41b7-92f1-6e8637d082cb",
      "name": "Retrieve Headers of Email",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -560,
        1400
      ]
    },
    {
      "id": "2f28e47d-f010-4f0b-bbe4-074bbdf39a45",
      "name": "Extract Received Headers",
      "type": "n8n-nodes-base.code",
      "position": [
        80,
        1460
      ]
    },
    {
      "id": "530fd9c3-94c2-4d5e-a686-57738cc10ae6",
      "name": "Remove Extra Received Headers",
      "type": "n8n-nodes-base.limit",
      "position": [
        300,
        1460
      ]
    },
    {
      "id": "9942704e-e0ac-42e9-b714-b2bdb3117c02",
      "name": "Extract Original From IP",
      "type": "n8n-nodes-base.set",
      "position": [
        500,
        1460
      ]
    },
    {
      "id": "6093bcd2-1101-4685-8d2c-751dd451afc4",
      "name": "Query IP Quality Score API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        980,
        1360
      ]
    },
    {
      "id": "feb4203c-4f9b-456c-9640-82ce8f6f550f",
      "name": "Query IP API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1180,
        1360
      ]
    },
    {
      "id": "f628e421-4cb5-4612-83c2-bde0f4f57367",
      "name": "Authentication-Results Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1440,
        1600
      ]
    },
    {
      "id": "8616ecd3-1c71-49ff-a32c-4b09f3214edb",
      "name": "Extract Authentication-Results Header",
      "type": "n8n-nodes-base.code",
      "position": [
        1720,
        1360
      ]
    },
    {
      "id": "7d3a37dc-6bbe-4c3b-9c2c-c9d2c1c24213",
      "name": "Received-SPF Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1700,
        2220
      ]
    },
    {
      "id": "f1ca55fb-07d8-4825-8850-f5a3c58e358a",
      "name": "DKIM-Signature Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1700,
        2620
      ]
    },
    {
      "id": "df19f38c-b263-4b97-bd22-adc8ff44f631",
      "name": "Set SPF Value",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2140
      ]
    },
    {
      "id": "1613d276-3ec4-44b2-91ca-f76985e1b4c2",
      "name": "Extract Received-SPF Header",
      "type": "n8n-nodes-base.code",
      "position": [
        1940,
        2140
      ]
    },
    {
      "id": "47697f60-99e7-4c91-ab7c-7f966b1b5307",
      "name": "DKIM Signature Found",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2520
      ]
    },
    {
      "id": "2383e7b4-fe13-4c36-80a3-67ba3f02ce1d",
      "name": "DMARC Header?",
      "type": "n8n-nodes-base.if",
      "position": [
        1700,
        3060
      ]
    },
    {
      "id": "2c41e06d-0dc1-474e-a13f-302fc3e4d4ad",
      "name": "No DMARC Header",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        3160
      ]
    },
    {
      "id": "81bd5082-634b-4f0e-951f-1374573fc6c0",
      "name": "Extract DMARC Header",
      "type": "n8n-nodes-base.code",
      "position": [
        2120,
        2960
      ]
    },
    {
      "id": "55a5745c-2c73-492c-b63c-20936043b0b6",
      "name": "Set DMARC Value",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2960
      ]
    },
    {
      "id": "48a5b283-7aa4-4e10-b784-fcce25465fc0",
      "name": "Original IP Found?",
      "type": "n8n-nodes-base.if",
      "position": [
        700,
        1460
      ]
    },
    {
      "id": "75818bdc-3ffb-42a7-a0a3-93fc413b757f",
      "name": "No DKIM Signature Found",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2720
      ]
    },
    {
      "id": "17bc160b-618f-4893-80c8-4e4c2638adc3",
      "name": "Determine Auth Values",
      "type": "n8n-nodes-base.set",
      "position": [
        2040,
        1360
      ]
    },
    {
      "id": "8ee70aff-0907-44f5-b675-1de26660c2e3",
      "name": "No SPF Found",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2320
      ]
    },
    {
      "id": "a658b7d1-ec0e-40c9-a6c6-1f81e776fcfb",
      "name": "Merge",
      "type": "n8n-nodes-base.merge",
      "position": [
        2840,
        1600
      ]
    },
    {
      "id": "bb688aec-d7ae-4e5a-ac38-a8d9554966bd",
      "name": "Aggregate",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        3000,
        1600
      ]
    },
    {
      "id": "e393c3b1-b756-44a8-ac3c-b2d9e15f4f47",
      "name": "No Operation, do nothing",
      "type": "n8n-nodes-base.noOp",
      "position": [
        980,
        1600
      ]
    },
    {
      "id": "d651412c-9e58-4ef6-a6eb-6556647a7223",
      "name": "Format Webhook Output",
      "type": "n8n-nodes-base.set",
      "position": [
        3400,
        1460
      ]
    },
    {
      "id": "03c70339-8e92-4d62-b346-7e669c83d338",
      "name": "Format Individual Auth Outputs",
      "type": "n8n-nodes-base.set",
      "position": [
        3180,
        1600
      ]
    },
    {
      "id": "762153b7-0364-498f-9dba-547d676b9d74",
      "name": "Format Combined Auth Output",
      "type": "n8n-nodes-base.set",
      "position": [
        2400,
        1360
      ]
    },
    {
      "id": "391615b6-4996-4687-a07c-3f9af1246840",
      "name": "Respond to Webhook",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        3620,
        1460
      ]
    },
    {
      "id": "ff28eb77-d095-440e-a95f-9f3727a3c219",
      "name": "Webhook1",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -780,
        2140
      ]
    },
    {
      "id": "80d4ce98-c26b-4f14-9058-6dda098f4f14",
      "name": "Set Headers",
      "type": "n8n-nodes-base.set",
      "position": [
        -100,
        1460
      ]
    },
    {
      "id": "fddadcd8-ecaf-4fb3-bd38-12d6e48124be",
      "name": "Aggregate Received-SPF Headers",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        2140,
        2140
      ]
    },
    {
      "id": "175f81f1-f5ff-4170-9496-7adae5351ff4",
      "name": "Set Headers Here",
      "type": "n8n-nodes-base.set",
      "position": [
        -360,
        1400
      ]
    },
    {
      "id": "6aa1040e-1c57-4ef3-9a06-9e25ca66247f",
      "name": "Set Webhook Headers Here",
      "type": "n8n-nodes-base.set",
      "position": [
        -380,
        2140
      ]
    },
    {
      "id": "6d177ff6-333f-40af-87ee-28f5808b90b6",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -840,
        849.3566000559811
      ],
      "parameters": {
        "width": 635.6437587743126,
        "height": 738.7992581051316,
        "content": "![](https://uploads.n8n.io/templates/outlook.png)\n## **Testing Email Header Analysis Workflow**\n\nThis section of the workflow is designed for testing purposes to ensure that the setup functions correc"
      }
    },
    {
      "id": "4347e3ac-6268-4f47-9ffa-d6cfdb9db6fe",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -840,
        1597.2834217449708
      ],
      "parameters": {
        "width": 635.6437587743126,
        "height": 722.658386273084,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Webhook Integration for Production**\n\nThis section transitions the workflow into production, enabling it to function as an API for analyzing email he"
      }
    },
    {
      "id": "166afae1-13f7-4c61-b605-751e2692f272",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -195.35026277953466,
        1001.1991904481583
      ],
      "parameters": {
        "width": 869.3564073187465,
        "height": 626.9566677129526,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Extract and Process Email Headers**\n\nThis section processes the headers from incoming email data to extract critical information, particularly focusi"
      }
    },
    {
      "id": "a676cc11-c48d-4160-a60f-5a2cce1ecc94",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        686.9090848322476,
        800.8639469405958
      ],
      "parameters": {
        "width": 922.1859426288208,
        "height": 965.2875565450952,
        "content": "![](https://uploads.n8n.io/templates/ipqualityscoretemplate.png)\n## **Analyze IP Address and Check Authentication Results**\n\nThis section focuses on analyzing the originating IP address and verifying "
      }
    },
    {
      "id": "999b7855-b515-45b7-a560-55882555a2c2",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1622.1779104636253,
        911.7549500344078
      ],
      "parameters": {
        "width": 1016.1357697283069,
        "height": 619.3441192962306,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Extract and Evaluate Authentication Results**\n\nIf the header is found, the workflow proceeds to the `Extract Authentication-Results Header` node, whi"
      }
    },
    {
      "id": "f2fefb66-8325-4d00-932b-292b353f7b2f",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2660,
        890.7472796133279
      ],
      "parameters": {
        "width": 1285.8545784346588,
        "height": 909.4741259295762,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Combine Results and Respond to Webhook**\n\nThis final section consolidates the results from previous nodes and prepares the data for delivery via a we"
      }
    },
    {
      "id": "4c2592a3-3550-428c-9622-b1e95ad28d4f",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1620,
        1540
      ],
      "parameters": {
        "width": 1016.1357697283069,
        "height": 1788.2607166792513,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)\n## **Evaluate SPF, DKIM, and DMARC Compliance**\n\nThis section focuses on detailed analysis and validation of SPF, DKIM, and DMARC headers. Each authentica"
      }
    }
  ],
  "connections": {
    "Merge": {
      "main": [
        [
          {
            "node": "Aggregate",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook1": {
      "main": [
        [
          {
            "node": "Set Webhook Headers Here",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate": {
      "main": [
        [
          {
            "node": "Format Individual Auth Outputs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Headers": {
      "main": [
        [
          {
            "node": "Extract Received Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No SPF Found": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query IP API": {
      "main": [
        [
          {
            "node": "Authentication-Results Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DMARC Header?": {
      "main": [
        [
          {
            "node": "Extract DMARC Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No DMARC Header",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set SPF Value": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No DMARC Header": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Set DMARC Value": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Set Headers Here": {
      "main": [
        [
          {
            "node": "Set Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Original IP Found?": {
      "main": [
        [
          {
            "node": "Query IP Quality Score API",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No Operation, do nothing",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DKIM Signature Found": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Extract DMARC Header": {
      "main": [
        [
          {
            "node": "Set DMARC Value",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Received-SPF Header?": {
      "main": [
        [
          {
            "node": "Extract Received-SPF Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No SPF Found",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Trigger on New Email": {
      "main": [
        [
          {
            "node": "Retrieve Headers of Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Determine Auth Values": {
      "main": [
        [
          {
            "node": "Format Combined Auth Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Webhook Output": {
      "main": [
        [
          {
            "node": "Respond to Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DKIM-Signature Header?": {
      "main": [
        [
          {
            "node": "DKIM Signature Found",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No DKIM Signature Found",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No DKIM Signature Found": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Extract Original From IP": {
      "main": [
        [
          {
            "node": "Original IP Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Received Headers": {
      "main": [
        [
          {
            "node": "Remove Extra Received Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No Operation, do nothing": {
      "main": [
        [
          {
            "node": "Authentication-Results Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Webhook Headers Here": {
      "main": [
        [
          {
            "node": "Set Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Retrieve Headers of Email": {
      "main": [
        [
          {
            "node": "Set Headers Here",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query IP Quality Score API": {
      "main": [
        [
          {
            "node": "Query IP API",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Received-SPF Header": {
      "main": [
        [
          {
            "node": "Aggregate Received-SPF Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Combined Auth Output": {
      "main": [
        [
          {
            "node": "Format Webhook Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Remove Extra Received Headers": {
      "main": [
        [
          {
            "node": "Extract Original From IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate Received-SPF Headers": {
      "main": [
        [
          {
            "node": "Set SPF Value",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Authentication-Results Header?": {
      "main": [
        [
          {
            "node": "Extract Authentication-Results Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Received-SPF Header?",
            "type": "main",
            "index": 0
          },
          {
            "node": "DKIM-Signature Header?",
            "type": "main",
            "index": 0
          },
          {
            "node": "DMARC Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Individual Auth Outputs": {
      "main": [
        [
          {
            "node": "Format Webhook Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Authentication-Results Header": {
      "main": [
        [
          {
            "node": "Determine Auth Values",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}