I keep getting emails from an unknown person. In the header file, I see this:

authentication-results: spf=softfail (sender IP is
smtp.mailfrom=outlook.com; gmail.com; dkim=none (message not signed)
header.d=none;gmail.com; dmarc=fail action=none header.from=outlook.com;
received-spf: SoftFail (protection.outlook.com: domain of transitioning
outlook.com discourages use of as permitted sender)

Can I assume the email orginates from

  • No, because the IP might as well just refer to an SMTP server used by whoever sent you that message... – AdHominem Mar 3 '16 at 21:07

Can I assume the email orginates at

Not really. You can maybe assume that was somewhere in the path of the email, i.e. it could be the original sender but it could also some mail server in between forwarding the mail. And besides that the header could just be faked.

| improve this answer | |
  • I am in Eastern US. The person that the email comes from claims to be within a 50 mile radius, but this email address comes from the UK. Is it feasible that an email sent from 50 miles away would go to UK and back before it got to me? – firestar Mar 4 '16 at 13:34
  • sorry, I meant the ip address is from the UK – firestar Mar 4 '16 at 13:36
  • @firestar: yes, that is possible. For instance if somebody is using a VPN. And the GeoIP information are unreliable anyway. But like I said - most information in the header can be spoofed. – Steffen Ullrich Mar 4 '16 at 13:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.