Comprehensive Email Header Analysis for IP and Spoofing Detection

The workflow is triggered by a webhook that receives email headers. It splits into two paths: one for analyzing IP addresses from 'received' headers and another for evaluating authentication results from 'authentication-results' headers. IP addresses are assessed for fraud and abuse using the IP Quality Score API, while geolocation data is obtained from the IP-API. Authentication results are checked for SPF, DKIM, and DMARC compliance. The workflow aggregates and merges results from both paths to provide a comprehensive analysis, which is then sent back through the webhook.