How to Automate IMAP to Slack Email Security Alerts?
Description
Collect DMARC reports from an inbox, store the data in MySQL, and alert your team in Slack when DKIM or SPF fail. It helps IT and security teams track email authentication problems without manual downloads or copy and paste. Weekly review time drops while visibility goes up.
New emails with ZIP attachments arrive through IMAP. Files are unzipped, XML is read, and the content is converted to JSON. The flow splits multiple records inside one report, renames keys for consistency, maps fields, and formats start and end dates so the database accepts them. All records go into a MySQL table, and a check flags failed results and sends a Slack message and an email alert.
Use a postmaster mailbox that receives DMARC aggregate reports. Add MySQL and Slack credentials, and confirm the database has the needed columns for the mapped fields. Expect faster incident response, fewer manual steps, and a complete history of reports for trend analysis and audits.
Tools Required
What this workflow does?
- IMAP email listener downloads incoming attachments from the DMARC inbox
- Unzips compressed report files before reading content
- Extracts XML and converts it to JSON for easy mapping
- Splits multiple records inside one report into separate items
- Renames keys and maps fields to match the database schema
- Formats date range start and end into a MySQL friendly format
- Inserts each record into a MySQL table with detailed output
- Checks for DKIM or SPF issues and routes alerts
- Sends a Slack message to a channel when problems are found
- Sends an email notification for error or failure conditions
What are the benefits?
- Reduce manual review from hours per week to minutes by auto processing DMARC reports
- Automate up to 90% of repetitive parsing and data entry tasks
- Improve data accuracy by removing copy and paste errors from report handling
- Connect email, database, and Slack so teams see issues in real time
- Handle multi record reports at scale without extra manual sorting
How to set this up?
- Import the template into n8n: Create a new workflow in n8n > Click the three dots menu > Select 'Import from File' > Choose the downloaded JSON file.
- You'll need accounts with IMAP Email, MySQL, Slack and SMTP Email. See the Tools Required section above for links to create accounts with these services.
- Prepare a mailbox that receives DMARC aggregate reports. Verify that reports arrive with ZIP attachments from your email provider or DNS setup.
- Open the Email Trigger node. In the 'Credential to connect with' dropdown, click 'Create new credential' and follow the on screen steps to connect your IMAP account. Ensure attachment download is enabled.
- Check the Unzip File node. Confirm the binary property name matches the email attachment field such as attachment_0. If your mailbox sends multiple attachments, test with a known DMARC ZIP.
- Open the Extract XML data and Parse XML nodes. Ensure the binary property names line up, for example file_0. Run a single test email to confirm JSON output is produced.
- Review the Split Out and Rename Keys steps. Confirm that feedback.record is mapped to a simple key like fbr so the next mapping step reads it correctly.
- Open the Set and DateTime nodes. Verify field names for date_range_begin and date_range_end and confirm the date format matches your MySQL DATETIME setting.
- Open the MySQL node. In the credentials dropdown, click 'Create new credential' and add your MySQL host, database, user, and password. Point to the target table and align the columns with the mapped fields.
- Open the Slack node. Click 'Create new credential' and finish Slack OAuth. Choose the channel for alerts and set a clear message template.
- Open the Email Send node. Create a new SMTP credential or select an existing one. Add a recipient for error or failure notifications.
- Test end to end by sending a sample DMARC ZIP to the inbox. Check the execution log: you should see parsed items, database inserts, and alerts when DKIM or SPF fail.
- If you see empty output, confirm binary property names and that the ZIP actually contains an XML report. If dates fail to insert, adjust the date format to match your database settings.
Need help or want to customize this?
Ask in the Free Futurise Community.
Similar Templates
These templates were sourced from publicly available materials across the web, including n8n’s official website, YouTube and public GitHub repositories. We have consolidated and categorized them for easy search and filtering, and supplemented them with links to integrations, step-by-step setup instructions, and personalized support in the Futurise community. Content in this library is provided for education, evaluation and internal use. Users are responsible for checking and complying with the license terms with the author of the templates before commercial use or redistribution.Where an original author was identified, attribution has been provided. Some templates did not include author information. If you know who created this template, please let us know so we can add the appropriate credit and reference link. If you are the author and would like this template removed from the library, email us at info@futurise.com and we will remove it promptly.
