Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Today a Belgian MP claimed (backed up by a security expert) that her email headers show that her email was read during routing (text in Dutch).

The published screenshot of the headers highlights the final line in the extended headers:

message opened by mailclient

The IP resolves to a US DOD military base (Fort Huachuca).

Searching on "message opened by mailclient" gives thousands of emails with this line, with other IP-adresses also resolving to this particular military base, but also e.g. Japanese routing nodes(?).

The only thing I can find atm. is a vague comment:

I've seen this before. IIRC, the IPs resolving to Ft Huachuca are not actually IP's, they are just numbers within the header which the program picks up as an IP.

What is the technical interpretation of this header line? What can one conclude from it?

share|improve this question
a Belgian MP should not use foreign webmail to communicate about parliament work. – tomhermans Nov 2 '13 at 19:38
true. answer was given, nobody mentioned the obvious. that's why I did. – tomhermans Nov 2 '13 at 21:00
I initially read the title as "opened by malicient", as in "malicious client". Interesting.. – Thomas Nov 3 '13 at 7:29
@Thomas Same here. It wasn't until after 15 minutes that I found out it's mail client and not malicient. – Adi Nov 3 '13 at 10:38

3 Answers 3

I tried to filter Google results for "message opened by mailclient" as follows:

Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after mailclient becomes (on average). It goes like this:

  • (2008) message opened by mailclient
  • (2009) message opened by mailclient
  • (2010) message opened by mailclient
  • (2011) message opened by mailclient
  • (2012) message opened by mailclient
  • (2013) message opened by mailclient

As a result, it's safe to assume that those numbers are not IP addresses, but rather version numbers of the mail client. Looks like the Belgian MP is just jealous that the NSA are tapping Angela Merkel but not her.

Now, please send this answer's link to the news paper that published that article.

share|improve this answer
Thanks for the input and numbercrunching. I came to the same conclusion looking at the sourcecode of (the webservice used by the MP), that show shows that it is indeed the version number. I just tweeted this Stackoverflow-link to a journalist and IT-specialist that were sceptical about the story, we will if there is a retraction (to bad silly stories like this get so much attention, detracting from the real surveillance-issues). – mhermans Nov 2 '13 at 17:30
up vote 18 down vote accepted

After registering for (where the MP send her mail from), and looking to the source code of the web interface, "" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-

So, the message

message opened by mailclient

means exactly that: the mailclient (you as the user) opened the email through the webinterface.

Lesson of today: make sure the "IT-expert" you consult can differentiate between an IP-adres and a version number ;-).

share|improve this answer

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so.

Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid of me to configure my mail server to add a header to indicate that I had done so!

We would need more technical detail to know for certain what has happened here, but my money is on a poorly configured mail server, not snooping.

Edit: I'm wondering if it is a "feature" of whatever back-end is running the (and associated domains) mail server or webmail interface. I can reproduce the "header" line in question by sending email from to

I'm standing by my conclusion that the header is not indicative of snooping, and the mail server is poorly configured in the sense that it's adding a human-readable header line that has no obvious meaning.

Return-Path: [redacted]
Received:  from ([]) by
 (mxgmxus004) with ESMTPS (Nemesis) id 0LdpQ5-1W3Tig3xaN-00iyjP for
 <[redacted]>; Sat, 02 Nov 2013 16:47:58 +0100
Received: by with SMTP id lc6so3571661vcb.25
        for <[redacted]>; Sat, 02 Nov 2013 08:47:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113;
X-Received: by with SMTP id h5mr163046vep.25.1383407277299; Sat,
 02 Nov 2013 08:47:57 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Sat, 2 Nov 2013 08:47:27 -0700 (PDT)
From: <[redacted]>
Date: Sat, 2 Nov 2013 [redacted]
Message-ID: <CAMx+XZ0_O+OLEH5=6=NJeLRb[redacted]>
Subject: [redacted]
To: [redacted]
Content-Type: text/plain; charset=ISO-8859-1
Envelope-To: <[redacted]>
X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: notjunk:1;V01:K0:K9FP11uQyc8=:yWrrPx81cP9DKLPzL6aspyrja5
X-GMX-UID: NjUyOAUgSzg3M8ChcT4xpToxMekO3kko
X-Flags: 1401

MailID: NjUyOAUgSzg3M8ChcT4xpToxMekO3kko

message opened by mailclient (
share|improve this answer
There is no more info then the published headers. I'm guessing this header is not completely arbitrary, given the large number of emails you find on Google... – mhermans Nov 2 '13 at 15:44
The point it not that this header line itself is arbitrary. The point is that someone snooping on the email does not have to leave a header indicating that he has done so! He could leave no header at all, or leave an innocuous header like "No virus found" – scuzzy-delta Nov 2 '13 at 15:51
"arbitrary" here meaning that the mail server can write whatever it wants, so it would be silly for someone spying on email to write "This email has been spied upon", which is essentially what this accusation is. – scuzzy-delta Nov 2 '13 at 15:59
I'm in full agreement that adding/leaving such a header-line would make it a very clownish/unlikely attempt at snooping. I was mainly hoping for a technical reference on the message, e.g. if it was an addition of a standard software package, or not even an IP-adress, etc. But thanks for the input! – mhermans Nov 2 '13 at 16:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.