Skip to content
FlowHubFluxonLab
C
General Automationfree

Analyze Email Headers for IP Reputation and Spoofing Detection - Gmail

by Angel Menendezadapted from n8n official workflow galleryUpdated Aug 2026
RequiresCCodeHTTP RequestHTTP Request
Share Post Share
Gmail TriggerCoGmail - Extract Received HeadersGmail - Extract…SeGmail - Extract Original From IPGmail - Extract…IfGmail - Original IP Found?Gmail - Origina…HRGmail - Query IP Quality Score APIGmail - Query I…HRGmail - Query IP APIGmail - Query I…IfGmail - Authentication-Results Header?Gmail - Authent…IfGmail - Received-SPF Header?Gmail - Receive…CoGmail - Extract Authentication-Results HeaderGmail - Extract…CoGmail - Extract Received-SPF HeaderGmail - Extract…SeGmail - Determine Auth ValuesGmail - Determi…SeGmail - Set SPF ValueGmail - Set SPF…SeGmail - No SPF FoundGmail - No SPF …SeGmail - Format OutputGmail - Format …SeGmail - DKIM Signature FoundGmail - DKIM Si…IfGmail - DKIM-Signature Header?Gmail - DKIM-Si…SeGmail - No DKIM Signature FoundGmail - No DKIM…SeGmail - Set DMARC ValueGmail - Set DMA…CoGmail - Extract DMARC HeaderGmail - Extract…IfGmail - DMARC Header?Gmail - DMARC H…SeGmail - No DMARC HeaderGmail - No DMAR…SeSet Gmail Headers HereSet Gmail Heade…SeFormat Individual Auth Outputs1Format Individu…SeFormat Combined Auth Output1Format Combined…WeGmail - WebhookLiGmail - Remove Extra Received HeadersGmail - Remove …MeGmail - MergeAgGmail - AggregateGmail - Aggrega…SeGmail - Set HeadersGmail - Set Hea…RTGmail - Respond to WebhookGmail - Respond…AgAggregate Received-SPF Headers1Aggregate Recei…SeSet Gmail Webhook Headers HereSet Gmail Webho…NOSkip IP Check123456789101112131415161718192021222324252627282930313233343536373839
1/5
STEPS · 39
Starts on a Gmail event

Analyze Emails for Security Insights Who is this for? This workflow is ideal for IT professionals, security analysts, and organizations looking to enhance their email security practices. It is particularly useful for those who need to analyze Gmail email headers for IP tracking, spoofing detection, and sender reputation assessment. What problem is this workflow solving? Email spoofing and phishing attacks are significant cybersecurity threats. By analyzing email headers, this workflow provides detailed insights into the email's origin, authentication status, and the reputation of the sending IP address. It helps detect potential spoofing attempts and assess the trustworthiness of incoming emails. What this workflow does This n8n workflow automates the process of analyzing email headers received in Gmail. It performs the following key functions: Triggering and Email Header Extraction: It monitors Gmail inboxes for new emails and extracts their headers for analysis. Authentication Analysis: It validates SPF, DKIM, and DMARC authentication results to ensure the email adheres to industry-standard security protocols.

Tags

n8nreference-only
Connects
CCodeWHTTP Request
CategoryGeneral Automation
Triggermanual
Complexityadvanced
Nodes33
AddedDec 27, 2024
CW
free

Draft bookkeeping entries from Trello cards with OpenRouter and Xero

Quick overview This workflow triggers from Trello card activity to draft bookkeeping entries by extracting transaction details with OpenRouter and enriching them with live Xero chart-of-accounts, tax rates, contacts, and bill context, then posts a review-ready summary and embedded JSON back to the Trello card. How it works Triggers from Trello when a card is moved to the Ready list or when the Retry AI label is added. Fetches the current Xero chart of accounts, bank accounts, and tax rates to use as live reference data. Loads the Trello card details, recent comments, and attachment metadata and stops with an error note if the text lacks enough detail for extraction. Sends the card title/description/comments to OpenRouter to extract a structured bookkeeping draft and normalizes key fields like dates, line items, and payment reference. Uses Xero Contacts (and, for bill payments, Xero Invoices) to resolve the vendor and refine PAY_BILL vs SPEND_MONEY before optionally asking OpenRouter to classify expense line items to Xero account codes. Validates and maps any suggested account codes against the live Xero chart of accounts, embeds Xero configuration needed for posting later, and reco

by Kristian
CW
free

Post approved Trello bookkeeping drafts to Xero with receipt attachments

Quick overview This workflow listens for an “Approved” label on a Trello card, reads the AI draft bookkeeping JSON from card comments, and posts the corresponding transaction to Xero. It then adds a Xero deep link back to Trello, uploads receipt images as Xero attachments, and moves the card to Done. How it works Triggers in Trello when a user adds the configured Approved label to a card on the target board. Fetches the card’s comments, extracts the ` payload, validates required fields, and skips processing if a ` sentinel comment already exists. For SPEND_MONEY and PAY_BILL entries, pulls active Xero bank accounts and resolves the bank account and payment reference from the draft and any reviewer comments, pausing to request confirmation on the Trello card if values are ambiguous. For PAY_BILL entries, fetches open supplier bills from Xero and either matches the payment to a single ACCPAY invoice or asks the reviewer to confirm the bill in a Trello comment. Builds and posts the appropriate Xero record (Bank Transaction, Bill, Payment, or Manual Journal) via the Xero API and generates a Xero deep link for the created entity. Immediately writes the `` deep link back to Trello, then

by Kristian
CW
free

Upload CSV test cases to Qase and send completion alerts to Slack

Quick overview This workflow upload test cases from a CSV file into Qase App and sends a confirmation message to your Slack channel. How it works Receives a form submission containing a public CSV URL and a selected Qase project option. Downloads the CSV file from the provided URL and extracts its rows into individual test-case items. Maps each row into the JSON payload Qase expects (including project code, fields like severity/priority/type, and optional parsed steps). Creates the test cases in Qase by sending a POST request per item to the Qase Cases API for the mapped project. Aggregates the upload responses into a single result. Sends a Slack incoming-webhook message confirming the test case upload is complete. Setup Create a Qase API token and add it to the Qase HTTP Header Auth credentials used for the Qase API request. Create a Slack Incoming Webhook, paste the webhook URL into the Slack notification HTTP request node, and customize the message text if needed. Ensure the uploaded CSV is publicly accessible via URL and uses the expected columns (for example: title, description, preconditions, postconditions, severity, priority, type, layer, behavior, automation, and optional

by Viktor Mikeska