Analyze email headers for IP reputation and spoofing detection - Outlook
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 34 nodes and runs on Microsoft Outlook events (plus 1 other trigger). Along the way it connects Microsoft Outlook.
How it runs
Trigger: On Microsoft Outlook events (plus 1 other trigger).
- Retrieve Headers of Email (HTTP Request): calls an HTTP API
- Set Webhook Headers Here (Edit Fields (Set)): sets 1 field: headers
- Set Headers Here (Edit Fields (Set)): sets 1 field: headers
- Set Headers (Edit Fields (Set)): sets or maps fields
- Extract Received Headers (Code): runs custom JavaScript code
- Remove Extra Received Headers (Limit): keeps the first few items
- Extract Original From IP (Edit Fields (Set)): sets 1 field: extractedfromip
- Original IP Found? (If): checks a condition and branches into true / false
- Query IP Quality Score API (HTTP Request): calls an HTTP API
- Query IP API (HTTP Request): calls an HTTP API
…plus 21 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (11)
- Microsoft Outlook Trigger
n8n-nodes-base.microsoftOutlookTrigger - HTTP Request
n8n-nodes-base.httpRequest - Code
n8n-nodes-base.code - Limit
n8n-nodes-base.limit - Edit Fields (Set)
n8n-nodes-base.set - If
n8n-nodes-base.if - Merge
n8n-nodes-base.merge - Aggregate
n8n-nodes-base.aggregate - No Operation, do nothing
n8n-nodes-base.noOp - Respond to Webhook
n8n-nodes-base.respondToWebhook - Webhook
n8n-nodes-base.webhook
From the author
Analyze Emails for Security Insights Who is this for? This workflow is ideal for security teams, IT Ops professionals, and managed service providers (MSPs) responsible for monitoring and validating email traffic. It’s especially useful for organizations that…