3

I noticed K-9 Mail (Android), Geary, Sylpheed and Thunderbird are leaking my personal and private IP in the email headers.

I know web clients like gmail don't suffer from this problem. But what can I do to avoid my IP leaking while using desktop/mobile apps. Are there any options/configurations available to protect this information? Any clients that implement this by default or have a option in the settings.

Received: from [192.168.0.XXX] (dhcp-255-255-64-255.my.isp.com [255.255.64.255])
        by smtp.gmail.com with ESMTPSA id xxxxxxxxxxxxxxxxxxxxxxxxx
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Sun, 22 Jan 2017 20:13:49 -0800 (PST)
Improve this question

3 Answers 3

Reset to default
4

You have to differentiate between email clients and web based email.

Email clients request that the server sends an email that was composed remotely. This is the case with Thunderbird and others. You logon to the destination SMTP (Send Mail Transfer Protocol) server and issue commands to send the email you desire.

With a web based solution, such as Gmail, Hotmail (Outlook), and so on, you are effectively logging in on the destination server. Because the server itself is issuing the commands to itself, there is no "client" in this case.

As dictated by RFC 882 (and it's parent standards documents), all emails are to have "email headers". You can read more about them using the two links below.

To remove the "client" headers use a web based email service, or create your own web based email service.

Web Links:

https://www.rfc-editor.org/rfc/rfc822

https://www.rfc-editor.org/rfc/rfc5322

Improve this answer
2
  • Thanks for the insight. Anyway I can add some privacy while still using a client?
    – francium
    Jan 23, 2017 at 5:25
  • 1
    @francium You would either have to setup some kind of forwarding address, or "relay", that would break the chain. I'm not aware of any kind of service that does this for the public, so you would have to build your own.
    – dark_st3alth
    Jan 23, 2017 at 7:24
3

You should not worry about that. That is the way SMTP was designed and as far as I am concerned, when I receive a mail that I found suspect, the first thing I do is to look for the various Received fields. If what I read is not conformant with what I expect I throw the mail to bin.

The rationale behind that is that the mail is in its first intention an exchange between two entities that know about each other: if you want that your message ends in my mailbox, you should identify yourself (sender email and IP address). And in SMTP protocol, the sender email address is written by the client so it is too easy to fake it.

Another rationale for that is that anonymous SMTP relay were heavily used by spammers. Unfortunately, gmail decided that provided they know everything about a mail, nobody else including the recipient has to - but anyway, they only to that when they have authenticated the sender, and write the correct email address in the headers.

That being said, and if you have an acceptable reason for doing so (I assume not spamming...) a google search for smtp hiding relay or smtp anonymous relay list could give you some solutions. But prepare to see your messages rejected as SPAM because open relays have bad reputation. Just look here for the reason why.

Improve this answer
1

Hotmail/outlook smtp does strip your IP from the header. There are at least some other companies that usually offer (sometimes at a cost) an additional SMTP server that also hides your IP from the emails. Google/Gmail does not.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .