Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Workflow blueprintBrowse workflows
ETL PipelineIntermediate

Email Header IP & Spoofing Analyzer

Email Header IP & Spoofing Analyzer is a 27-node automation blueprint connecting IP Quality Score, IP-API. Inspect its trigger, execution graph, branches, and implementation requirements.

IP Quality ScoreIP-API

Interactive system map

Follow the runtime. Inspect what supports it.

Solid horizontal paths show main-channel execution. Violet dependencies sit beneath the exact step they configure or empower.

27

Nodes

32

Links

1

Run groups

Connected tools

2 integrations

  • IP Quality Score
  • IP-API

Canvas controls

Fit wide systems, then zoom into any run group.

Email Header IP & Spoofing Analyzer execution lanes1 run groups containing 27 workflow nodes and 32 visible links. Solid horizontal lines are main-channel runtime links. Violet dashed lines connect typed dependencies beneath the runtime step they support. Focus any node to inspect its immediate path.Receive Headers. trigger node, webhook. 0 incoming and 1 outgoing connections.STARTReceive HeadersTRIGGERWEBHOOK0 IN / 1 OUTExtract Email Header from webhook. transform node, set. 1 incoming and 1 outgoing connections.STEP 02Extract Email Header from…TRANSFORMSET1 IN / 1 OUTExplode Email Header. transform node, code. 1 incoming and 2 outgoing connections.STEP 03Explode Email HeaderTRANSFORMCODE1 IN / 2 OUTReceived Headers Present?. decision node, if. 1 incoming and 2 outgoing connections.STEP 04Received Headers Present?DECISIONIF1 IN / 2 OUTAuthentication Results Present?. decision node, if. 1 incoming and 3 outgoing connections.STEP 04Authentication Results Pr…DECISIONIF1 IN / 3 OUTExtract IPs from "received". transform node, code. 1 incoming and 1 outgoing connections.STEP 05Extract IPs from "received"TRANSFORMCODE1 IN / 1 OUTSPF/DKIM/DMARC from "authentication-results". transform node, code. 1 incoming and 1 outgoing connections.STEP 05SPF/DKIM/DMARC from "auth…TRANSFORMCODE1 IN / 1 OUTSPF from "received-spf". transform node, code. 1 incoming and 1 outgoing connections.STEP 05SPF from "received-spf"TRANSFORMCODE1 IN / 1 OUTSPF Authentication Checker. decision node, switch. 1 incoming and 4 outgoing connections.STEP 05SPF Authentication CheckerDECISIONSWITCH1 IN / 4 OUTSplit Out IPs. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 06Split Out IPsTRANSFORMITEMLISTS1 IN / 1 OUTDKIM from "dkim-signature". transform node, code. 1 incoming and 1 outgoing connections.STEP 06DKIM from "dkim-signature"TRANSFORMCODE1 IN / 1 OUTSet SPF Pass Status. transform node, set. 1 incoming and 1 outgoing connections.STEP 06Set SPF Pass StatusTRANSFORMSET1 IN / 1 OUTSet SPF Fail Status. transform node, set. 1 incoming and 1 outgoing connections.STEP 06Set SPF Fail StatusTRANSFORMSET1 IN / 1 OUTSet SPF Neutral Status. transform node, set. 1 incoming and 1 outgoing connections.STEP 06Set SPF Neutral StatusTRANSFORMSET1 IN / 1 OUTSet SPF UnknownStatus. transform node, set. 1 incoming and 1 outgoing connections.STEP 06Set SPF UnknownStatusTRANSFORMSET1 IN / 1 OUTIP Quality Score. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 07IP Quality ScoreINTEGRATIONHTTPREQUEST1 IN / 1 OUTDMARC from "received-dmarc". transform node, code. 1 incoming and 1 outgoing connections.STEP 07DMARC from "received-dmarc"TRANSFORMCODE1 IN / 1 OUTDKIM. decision node, switch. 4 incoming and 0 outgoing connections.STEP 07DKIMDECISIONSWITCH4 IN / 0 OUTIP-API. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 08IP-APIINTEGRATIONHTTPREQUEST1 IN / 1 OUTAggregate Authentication Data. transform node, set. 1 incoming and 1 outgoing connections.STEP 08Aggregate Authentication …TRANSFORMSET1 IN / 1 OUTFraud Score. transform node, code. 1 incoming and 1 outgoing connections.STEP 09Fraud ScoreTRANSFORMCODE1 IN / 1 OUTCollect interesting data. transform node, set. 1 incoming and 1 outgoing connections.STEP 10Collect interesting dataTRANSFORMSET1 IN / 1 OUTIP Data Merge. decision node, merge. 2 incoming and 1 outgoing connections.STEP 11IP Data MergeDECISIONMERGE2 IN / 1 OUTJoin IP Analysis into one JSON object. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 12Join IP Analysis into one…TRANSFORMITEMLISTS1 IN / 1 OUTMerge Security Data. decision node, merge. 3 incoming and 1 outgoing connections.STEP 13Merge Security DataDECISIONMERGE3 IN / 1 OUTJoin results into one JSON object. transform node, itemLists. 1 incoming and 1 outgoing connections.STEP 14Join results into one JSO…TRANSFORMITEMLISTS1 IN / 1 OUTRespond to Webhook. trigger node, respondToWebhook. 1 incoming and 0 outgoing connections.OUTCOMERespond to WebhookTRIGGERRESPONDTOWEBHOOK1 IN / 0 OUT

Signal inspector

Focus, hover, or select a step to isolate its runtime and support links.

Main-channel runtimeTyped dependencytriggeraidecisiontransformintegration
Scroll horizontally to follow every connected flow.27 connected nodesEnter or click to lock · Escape to clear

Runtime breakdown

Read the execution spine before its dependencies.

Each run group separates main-channel steps from the models, tools, retrievers, and data services that support them. Start and outcome labels apply only to runtime nodes.

01

Run Group

Receive Headers

32 Execution Links

  1. Start

    Receive Headers

    Trigger

  2. Step 2

    Extract Email Header from webhook

    Transform

  3. Step 3

    Explode Email Header

    Transform

  4. Step 4

    Received Headers Present?

    Decision

    Authentication Results Present?

    Decision

  5. Step 5

    Extract IPs from "received"

    Transform

    SPF/DKIM/DMARC from "authentication-results"

    Transform

    SPF from "received-spf"

    Transform

    SPF Authentication Checker

    Decision

  6. Step 6

    Split Out IPs

    Transform

    DKIM from "dkim-signature"

    Transform

    Set SPF Pass Status

    Transform

    Set SPF Fail Status

    Transform

    Set SPF Neutral Status

    Transform

    Set SPF UnknownStatus

    Transform

  7. Step 7

    IP Quality Score

    Integration

    DMARC from "received-dmarc"

    Transform

    DKIM

    Decision

  8. Step 8

    IP-API

    Integration

    Aggregate Authentication Data

    Transform

  9. Step 9

    Fraud Score

    Transform

  10. Step 10

    Collect interesting data

    Transform

  11. Step 11

    IP Data Merge

    Decision

  12. Step 12

    Join IP Analysis into one JSON object

    Transform

  13. Step 13

    Merge Security Data

    Decision

  14. Step 14

    Join results into one JSON object

    Transform

  15. Outcome

    Respond to Webhook

    Trigger

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas