How email automation works

Email comes in, is parsed to JSON and posted to your webhook; from there your own code, workflow tool or agent decides what happens. Here is the flow, what the payload holds, and where your logic runs.

By Xander Groesbeek, founder · Published September 2025 · Updated October 2026 · 6 min read

In brief

The issue. Your automation can't read an inbox the way a person does. It needs each email as data, delivered the moment it arrives.

What it means for you. An inbound email service receives the mail, parses it into JSON and posts it to a webhook. It doesn't decide what the email means; that is your automation's job, in your own code, a workflow tool or an AI agent.

What to do.

  • Give each kind of email its own address or +tag, so routing is decided before the content is read.
  • Build the receiving end: verify the signature, drop duplicates, skip bounces and auto-replies.
  • Start with one flow, then add the next.

The flow in four steps

Every email-triggered automation follows the same path: mail to an address, DNS to the service, JSON to your webhook.

  1. 1

    Email arrives at your address

    A customer writes to support@in.yourcompany.com, or you forward mail there.

  2. 2

    DNS routes it to the service

    The MX record of that subdomain points at the inbound email service.

  3. 3

    The email is parsed to JSON

    Sender, subject, bodies, attachments and checks become separate fields.

  4. 4

    A webhook delivers it to your endpoint

    Your app, workflow tool or agent receives a POST request and acts.

Setting up the address is covered in domain setup; you can also start on a system address with no DNS changes, as getting started shows.

What arrives at your webhook

One JSON document per email, with the same fields every time. A shortened example from EmailConnect (the payload reference lists every field):

{
  "id": "msg_9f8e7d6c5b4a",
  "message": {
    "sender": { "email": "sarah@example.com", "name": "Sarah Johnson" },
    "recipient": {
      "email": "inbox+support@in.yourcompany.com",
      "name": null,
      "tag": "support"
    },
    "subject": "Login issues with mobile app",
    "content": {
      "text": "Hi, I can't log in to the mobile app...",
      "html": "<p>Hi, I can't log in to the mobile app...</p>",
      "links": []
    },
    "date": "2026-10-27T10:30:00.000Z",
    "attachments": [
      {
        "filename": "error-report.pdf",
        "contentType": "application/pdf",
        "size": 3145728,
        "downloadUrl": "https://app.emailconnect.eu/attachments/9f8e7d6c5b4a3f2e/download",
        "status": "completed",
        "uploadType": "sync"
      }
    ]
  },
  "spam": {
    "score": -0.99,
    "engine": "rspamd",
    "authentication": {
      "dkim": { "result": "pass", "domain": "example.com" },
      "spf": { "result": "pass", "domain": "example.com" },
      "dmarc": { "result": "pass", "domain": "example.com" }
    }
  },
  "classification": { "type": "normal", "confidence": "definite", "signals": [] }
}

The fields that do the most work in an automation:

FieldUse it toPlan
message.recipient.tagRoute by the +tag the sender used (inbox+support@ → "support")All
classification.typeSkip bounces, auto-replies and mailing lists; read from headers, not contentAll
message.content.text / htmlGet the bodyAll
message.attachmentsFiles inline up to 128 KB (Free) or 2 MB (paid), larger ones as a downloadUrlAll
spam.score, spam.authenticationApply your own spam cut-off; check SPF, DKIM and DMARCMaker and above
message.content.markdown, message.content.replyHand clean text to an LLM; get a reply without the quoted thread (both off by default)Maker and above
security.virusScanSee that attachments were scanned; infected files are left outBusiness and above

Route different emails to different systems

Decide where an email goes by the address it was sent to, not by guessing from its content. Each alias has its own webhook, and a +tag lets one alias serve several purposes.

AddressGoes toWhat happens
support@in.company.comHelpdesk API (Zendesk, Freshdesk)A ticket is created with the email and its attachments
sales@in.company.comCRM (HubSpot, Pipedrive)A lead is created and assigned
billing@in.company.comAccounting (Xero, QuickBooks)The invoice PDF goes to bookkeeping

To filter before delivery, alias rules (Maker and above) accept, block or tag mail by sender, spam score and more.

Where your automation logic runs

The webhook is only the hand-off. What happens next runs wherever you choose: your own code, a workflow tool, or an AI agent.

WhereGood for
Direct to an APIOne email, one action: a ticket, a lead, a task in Asana or Trello
n8n, Zapier or MakeMulti-step workflows without writing a server
Your own applicationCustom logic, your own database, full control
An AI agentReading, classifying or answering the email with your own model

A minimal receiver in Node.js that skips automated mail and routes on the +tag:

// Verify the webhook signature first: see /help/webhook-signing/
app.post('/webhooks/emailconnect', (req, res) => {
  const email = req.body

  // Bounces, auto-replies and mailing lists don't need a ticket
  if (email.classification?.type !== 'normal') return res.sendStatus(200)

  switch (email.message.recipient.tag) {
    case 'support':
      createSupportTicket(email)
      break
    case 'sales':
      notifySalesTeam(email)
      break
  }

  res.sendStatus(200)
})

Signing follows Standard Webhooks; webhook signing shows how to verify it and how to drop duplicate deliveries with the webhook-id header.

What the email service does, and what it leaves to you

The inbound service handles the email; understanding it is your automation's job. That split keeps the content under your control and lets you pick your own tools, including your own AI.

The email serviceYour automation
Receives the mail and parses MIME, encodings and attachmentsDecides what the email is about and how urgent it is
Reports SPF, DKIM and DMARC results and a spam scoreSets the cut-off for what it trusts
Scans attachments for viruses and stores large ones for downloadReads the attachment: OCR, PDF extraction, spreadsheets
Signs each delivery and retries when your endpoint is downVerifies the signature and drops duplicates

Delivery and failures

Your endpoint will be down sometimes; the delivery should wait for it. EmailConnect retries a failed delivery up to 7 times over about 22 hours, within your retention window, so on Free and Maker (one hour) that means up to 4 attempts. Every retry carries the same webhook-id, and paid plans can replay or retry a delivery from the dashboard logs. See delivery and retries.

Start small, then grow

Most teams grow an email automation in three stages:

StageExampleResult
1. One flowContact-form emails into your CRMStructured data instead of copying by hand
2. Routing and attachmentsSeparate addresses or tags per team, files to storageEach email lands in the right system
3. Several systemsInvoices, support tickets and leads, with an agent where it helpsEmail-driven processes end to end

How EmailConnect fits

EmailConnect is the email service in this flow. Each item links to the page behind it.

  • Signed JSON to any HTTPS endpoint, with one ID per email across retries. Webhook signing →
  • Works with your tools: a community node for n8n, Zapier, Make, Supabase, and an MCP server for AI agents. Integrations →
  • No AI on your email. We parse and deliver; your own automations and agents read the content. For agents and automation →
  • Processed in the EU, at Hetzner in Germany, with optional attachment storage at Scaleway or in your own S3. Sub-processors →
  • Content kept only briefly: one hour on Free and Maker, 24 hours by default on Business and Platform. Data retention →

Choose where your automation runs: integrations →

Related

Need help designing your email automation? Contact hello@emailconnect.eu.