Analyze email headers for IPs and spoofing
Needs changesNeeds changes. This template uses 1 thing(s) that n8n 3.0 removes: Item Lists (legacy). 1 breaking item(s) found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 27 nodes and runs when an HTTP POST request hits its webhook URL. It uses only n8n's built-in nodes.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Extract Email Header from webhook (Edit Fields (Set)): sets or maps fields
- Explode Email Header (Code): runs custom JavaScript code
- Received Headers Present? (If): checks a condition and branches into true / false
- Authentication Results Present? (If): checks a condition and branches into true / false
- Extract IPs from "received" (Code): runs custom JavaScript code
- IP Data Merge (Merge): merges the data from its input branches
- SPF/DKIM/DMARC from "authentication-results" (Code): runs custom JavaScript code
- SPF Authentication Checker (Switch): routes items into 3 branches
- SPF from "received-spf" (Code): runs custom JavaScript code
- Split Out IPs (Item Lists): reshapes item lists (legacy Item Lists node)
…plus 16 more steps. See the full node list below.
Before you upgrade to n8n 3.0
1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:
- Item Lists (legacy) in Split Out IPs, Join IP Analysis into one JSON object, Join results into one JSON object: replace with Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used).
Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).
| Removed in 3.0 | Replace with |
|---|---|
| Item Lists (legacy) Split Out IPs, Join IP Analysis into one JSON object, Join results into one JSON object | Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used) |
Nodes used (9)
- Webhook
n8n-nodes-base.webhook - Code
n8n-nodes-base.code - Respond to Webhook
n8n-nodes-base.respondToWebhook - Item Lists
n8n-nodes-base.itemLists - HTTP Request
n8n-nodes-base.httpRequest - Edit Fields (Set)
n8n-nodes-base.set - Switch
n8n-nodes-base.switch - If
n8n-nodes-base.if - Merge
n8n-nodes-base.merge
From the author
This n8n workflow is designed to analyze email headers received via a webhook. The workflow splits into two main paths based on the presence of the received and authentication results headers. In the first path, if received headers are present, the workflow…