When I send a message on protonmail, does my IP address show up in the header or any other place? Will I need a VPN to be completely anonymous?


This is essentially a duplicate of Email Client STMP Personal IP Leak

Sending an email from the web interface:

Return-Path: _____________@protonmail.com
Received: from mail1.protonmail.ch (mail1.protonmail.ch [])
    by _____________.darkst3alth.ca with ESMTPS
    (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256)
    ; Tue, 24 Jan 2017 20:20:00 -0500
Received: from B09B-1 (localhost [])
    by mail1.protonmail.ch (Postfix) with ESMTP id CD92D8392A
    for <_____________@darkst3alth.ca>; Tue, 24 Jan 2017 20:19:46 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com;
    s=default; t=1485307186;
Date: Tue, 24 Jan 2017 20:19:41 -0500
To: "_____________@darkst3alth.ca" <_____________@darkst3alth.ca>
From: _____________ <_____________@protonmail.com>
Reply-To: _____________ <_____________@protonmail.com>
Subject: test
Message-ID: <_____________=@protonmail.com>
Feedback-ID: _____________:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: multipart/alternative;
X-Spam-Status: No, score=-3.0 required=4.0 tests=ALL_TRUSTED,BAYES_00,
    MIME_BASE64_BLANKS,URIBL_BLOCKED autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail1.protonmail.ch

This is a multi-part message in MIME format.

Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64


Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64





  • 1
    It's hard to tell from all this whether the answer is "yes" or "no". Can you connect some dots? – schroeder Dec 24 '17 at 8:47

No. No user IP information is included in the message, ever. Source: I work for ProtonMail and am deeply familiar with this code.

  • Simply answering "No. I've seen the code" is of little usefulness. Can you provide anything to help support your answer? Traces, examples? – schroeder Dec 24 '17 at 8:48
  • Agreed in principle, but considering that ProtonMail is free, anyone who wants to verify can do it themselves rather than trusting me. The server does not add any client IP information to outgoing emails. There are no 'Received' headers added for the original client. – Bart Butler Dec 25 '17 at 20:00
  • The code is publicly available? Got a link? – schroeder Dec 25 '17 at 20:02
  • No, it's not publicly available, and even if it were, there's no guarantee other than me saying so that said code is running on the servers. What can be verified is that if you send a mail from ProtonMail, and look at the headers in the received message, you won't find anything about the client IP. – Bart Butler Dec 26 '17 at 22:59
  • 1
    1. Send a message from a ProtonMail account to an external account that you control 2. Check the headers for any client-identifying information. You will not find any such information. – Bart Butler Dec 28 '17 at 1:30

Just run it through TOR and you will not have to worry about IP leakage. Almost all email message servers will leak whatever IP you provide them. To get security and anonymity, you need both encryption and some sort of anonymizing service that you can trust. I certainly would err on the side of caution and perhaps use a VPN and a bridge with TOR if you are this concerned about IP leakage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.