Log what your mail's headers record about where it came from

Every six hours this workflow reads the headers of the mail you name and writes one row per message into your spreadsheet: what the receiving server recorded for SPF, DKIM and DMARC, what the From and Return-Path headers say, which relay addresses are named in the header block, and where each of those addresses resolves to.

It reports and it does not conclude. There is no score, no rating and no judgement anywhere in the output. A row tells you what the headers record so you can read them yourself; deciding what a message is remains yours to do.

Two things are worth knowing before you read a row:

- Where a relay address resolves to is weak evidence on its own. Mail routinely travels through relays in other countries - mailing lists, forwarding services, shared hosting and every large cloud provider all look foreign from the headers - and each row says when an address belongs to a data centre for exactly that reason. - An absent header is not a failed check. Where a field records nothing, the row says nothing was recorded rather than reporting a failure.

It reads headers only. The message body is never read, quoted, stored or sent anywhere: the workflow names the header fields it wants one by one, so there is no step at which the text of your mail could reach the spreadsheet or the model.

One limit worth setting expectations on. Gmail returns a message's headers as a set of named fields, so where a message carries several Received lines only one survives the fetch. The workflow reads the relay addresses named across the header fields it can see - the surviving Received line, the authentication results and X-Originating-IP - rather than walking a full delivery chain.

Each row's last column is a short note written by AI from the fields in that same row and nothing else. It is told to describe and not to decide, and its answer is checked before it is written: if it goes beyond describing the fields, the row says so and the note is not passed on.

To set it up, put the Gmail search naming which mail to read into the 'mailSearch' step (for example 'newer_than:1d'), paste your spreadsheet link into 'spreadsheetUrl', and name an existing tab in 'tabName'. Create that tab first with these twelve headings, in this order: Checked on, Subject, From, Date, SPF, DKIM, DMARC, Return-Path, From vs Return-Path, Relay addresses in the headers, Where those addresses resolve, What the headers record.

Each message is labelled once it has been logged and the search excludes that label, so nothing is written twice; the label is applied after the row, so an interrupted run repeats a message rather than skipping it. At most 10 messages a run and at most 10 relay addresses a message, both editable on their steps. Rows are only ever appended.