Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -3 down vote favorite

Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.

share|improve this question
Please explain what exactly you are trying to do. – Ramhound Jun 28 '12 at 14:26
i got an email from example@gmail.com. i want find who send this email.i want his ip when sending this email for proof – messi fan Jun 28 '12 at 15:44
What you want is not possible. It could have sent by anyone in the world. Google does not keep track of who actually sent it, only which account, which is likely example@gmail.com unless it was spoofed of course. – Ramhound Jun 28 '12 at 18:31

3 Answers

up vote 1 down vote accepted

I'll try to answer to your second question: how to detect fake (spoofed) e-mails.

All you need is to take a look at your e-mail headers. Received will tell you about the route, which message took to get to you. You should read that headers in reverse orders. If Received headers consist of server-names not related to the e-mail domain, then you probably received spoofed e-mail. Let's assume that we got e-mail from test@stackexchange.com and we want to check if it's a fake or not. The easiest (and usually effective) method is checking MX records: host -t MX stackexchange.com and comparing them with Received headers.

Another method to avoid spoofed e-mails is using mail-serves which implemented Sender Policy Framework (you can read more about it here: http://tools.ietf.org/html/rfc4408) or DomainKeys Identified Mail.

By examining e-mail headers you can determine if sent e-mail is spoofed or not, but you cannot trace the sender's IP address. However, there are some exceptions. The stuff which you can find inside the e-mail headers depends on the e-mail facility used. Some web-email-servers implementations have additional headers. The example is X-Originator-IP which COULD store the IP address of the computer which sent e-mail.

share|improve this answer
"Some web-email-servers implementations have additional headers" -- which web mails are putting people ip into the headers? I found that Yahoo and Hotmail do this. – user11101 Aug 4 '12 at 9:59
up vote 2 down vote

You can't get the ip address of the sender but you can see the ip address of the server that was used to send the email. This is how to distinguish between fake and real email address. for example in gmail when you click on the small arrow in an email and select 'show original email' you can find information regarding the source of the email. I just got this email from linkedin: Received: from mailc-cd.linkedin.com (mailc-cd.linkedin.com. [199.101.160.48]) by mx.google.com with ESMTP id tj6si707840pbc.168.2012.06.27.19.13.01; Wed, 27 Jun 2012 19:13:01 -0700 (PDT). if it was a fake message you will see just an ip address or you can lookup the ip address to see if it was for the email provider.

share|improve this answer
Notice that mail headers are read bottom-up. New headers are always added to the top of the mail. Also notice that fakers are aware of this and often add fake headers to an email before sending it. – jippie Jun 28 '12 at 7:44
@jippie: A number of MTAs exhibit the behavior you describe, but RFC 2822 doesn't mandate it. – Blrfl Jun 28 '12 at 12:45
up vote 0 down vote

In gmail you have the option to view the message in it's original form. All the information provided there is all you can get (ok, short of reading a servers logs).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.