Email header IP address

Question

Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?

Answer 1

Usually, each machine on which the mail transits:

• adds a Received: header stating from where the email seems to come;
• announces its name (which could be an IP address) to the next machine, which may or may not include that information in its own Received: header.

Here is an example in one of the 100+ spams that I daily receive:

X-Original-To: pornin@bolet.org
Delivered-To: pornin@bolet.org
Received: from davisandsons.net (213-238-65-230.adsl.inetia.pl [213.238.65.230])
        by arges.bolet.org (Postfix) with ESMTP id 7951068C0D4
        for <pornin@bolet.org>; Fri,  7 Oct 2011 21:49:22 +0200 (CEST)
Received: from apache by davisandsons.net with local (Exim 4.67)
        (envelope-from <minusculesxdl3@kurdogluholding.com.tr>)
        id XD1AV6-73T5L6-H9
        for <pornin@bolet.org>; Fri, 7 Oct 2011 20:46:35 +0100
To: <pornin@bolet.org>;
Subject: Re:web site 
(...)

Header lines are added in "reverse order": each mail server adds its line at the beginning of the header. So here my mail server (arges.bolet.org) received a connection for a mail which, at the SMTP level, was destined to me (over the connection, the other machine sent: RCPT TO: pornin@bolet.org). As part of the SMTP protocol, that machine first sent an HELO command in which it claimed to be "davisandsons.net"; my mail server looked at the source IP address (213.238.65.230) and did a reverse DNS resolution on it, yielding "213-238-65-230.adsl.inetia.pl" (from an ISP in Poland). It turns out that "davisandsons.net" can be resolved to a quite different IP address, nominally from England.

This first Received: header was added by my mail server, so it is trustworthy. The next line, and all subsequent lines, however, were sent as is by that Polish machine which began the conversation by claiming it was in England, a blatant lie, thus not the greatest way to build mutual trust. That header could be completely phony. Assuming it is not bogus, it would indicate that the mail originated from the local machine, by a user called "apache". The probable scenario is then: the home PC of some poor guy in Poland is an infected zombie, which relays spam. The infection might have began through a poorly configured Apache Web server on that machine.

(Spamassassin rated that specific spam with a whooping 20.5 score, and I automatically zap incoming emails with a score of 5.0 or more.)

Answer 2

It will include the ip address of your device (more particularly, the address of the router that forwards packets from your work station), and all the mail servers through which it is forwarded from.

Answer 3

It is common that every mail servers in the delivery chain add a line similar to

Received: from [sender-name] ([sender-ip]) 
          by [server-name] ([server-ip]);
          with SMPT; Fri, 7 Oct 2011 03:15:30 +0200

The format is not specified and varies.

Exposing the previous mail server during transit is common because it helps a lot in fighting spam.

But exposing the very first sender is often undesirable for privacy and security reasons. Some mail provider therefore omit it from the header and other mail providers treat the original sender just like any other source.

As a side note: "Received" headers can be forged, so you always have to start reading them from the top and carefully validate them.

Answer 4

That choice is completely up to the server the device talks to. It could include a Received header that contains information to identify the device such as its IP address. But it can also include no such header at all. It is completely an implementation option.

Logically speaking, it depends on whether you consider the device or the server to have originated the email. For example, web-based services such as GMail generally consider the server to have originated the email, so no information to identify the device is included. More traditional email services accessed by IMAP and POP often do consider the end device to have originated the email.