Record where incoming emails really came from
For the emails your Gmail search picks out, logs whether each passed the sender checks and which servers it really came through.
Apps it connects
Authenticate each one once and the workflow is ready to run.
What it does
Each integration step this workflow runs, in order, what it is for, and the conditions and loops that decide when it runs.
- 1GmailList emailsFinds the inbound mail matching your search that has not yet been given the 'Headers logged' label.
For each
message- 2GmailGet message headersReads each message's sender, subject, date, return path, authentication results and received headers, never the body.
If
relayAddressesis not empty- 3ip-api.comLocate ipsLooks up where each relay address in the headers resolves, which provider runs it and whether it is a data centre.
- 3
- 4AnthropicGenerate model responseAsks the AI to describe what the row's header fields record in plain English, without judging what the message is.
- 5Google SheetsAppend rowAppends one row per message with the sender, subject, date, SPF, DKIM and DMARC results, relay addresses, locations and note.
- 6GmailAdd label to messageApplies the 'Headers logged' label to each message after its row is written, so it is never logged again.
- 2
How it works
What happens on each run, in plain English.
Every six hours, the inbound mail matching a Gmail search you choose has its headers read, and one row per message is appended to your spreadsheet: what the receiving server logged for SPF, DKIM and DMARC, what the From and Return-Path headers say, which relay addresses appear, and where each of them resolves to.
It reports and does not conclude: no score, no rating, no verdict. Where a header records nothing, the row says so rather than reporting a failure, and a relay address in a data centre is flagged as exactly that, since much ordinary mail travels that way. Only headers are read; the body never reaches the spreadsheet or the AI. The last column is a short AI note describing the fields in that row; if it strays into judging the message it is set aside and the row says so. Each message is labelled 'Headers logged' once written, so nothing is logged twice.
Before the first run you need a spreadsheet tab headed for the columns each row fills.
You may also be interested in
Turn regulatory updates into tracked tasksReads the official sources you list each day, summarises every new or amended rule, and files a task for each one.
Look up an unfamiliar website before you deal with itGathers what public records, the web archive and search results say about a site you don't know, each with its source.
Watch your websites for downtimeChecks every site listed in a spreadsheet on a schedule and alerts you in Slack or by email when one goes down or recovers.Warn before SSL certificates expireChecks the certificate on every domain in your sheet each morning and emails the ones running out of time to renew.Start from a workflow that already works.
Add "Record where incoming emails really came from" to your workspace, connect its apps, and make it yours.
Free plan, no credit card