IP address leaked in email header?

Question

Can my IP address ever be included in the header of emails I send? Or do email servers never include my IP address in my emails' headers?

Answer 1

If you ask can an IP address of a sender ever be included in the email headers, the answer is obviously yes. What happens in your situation is easy enough to test by sending an email message as you usually do to an email address where you can investigate the full headers. The behaviour of the first-hop connection between your mail user agent MUA (or web browser in case of a webmail) and the email server doesn't change between two messages, so the results are generalizable for all the messages sent using the same method.

Here are some examples of the current situation, where 198.51.100.123 is the IP address:

• SMTP submission. By the specification in RFC 5321, 4.4 the SMTP protocol also used for message submission (RFC 6409) MUST record trace information:

  When an SMTP server receives a message for delivery or further processing, it MUST insert trace ("time stamp" or "Received") information at the beginning of the message content, as discussed in Section 4.1.1.4.

  This line MUST be structured as follows:

  • The FROM clause, which MUST be supplied in an SMTP environment, SHOULD contain both (1) the name of the source host as presented in the EHLO command and (2) an address literal containing the IP address of the source, determined from the TCP connection.

  E.g. both Postfix & Exim adds a Received header on submission just like every SMTP server that processes the message. This header contains the hostname the MUA introduced itself with (that could e.g. the computer name like User-PC or local IP address [192.168.1.100]), the reverse DNS hostname of the public IP address and the address from which the connection originated, possible TLS version and ciphersuite used etc., e.g. (Postfix):

  Received: from User-PC (198-51-100-123.dyn.example.com [198.51.100.123])
      (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
      by mail.example.com (Postfix) with ESMTPSA id 7890ABCDEF
      for <[email protected]>; Tue, 25 Aug 2020 15:00:00 +0000 (UTC)
  

  or (Exim):

  Received: from [198.51.100.123] (port=36031 helo=User-PC)
      by mail.example.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
      (Exim 4.94)
      (envelope-from <[email protected]>)
      id 1abcde-0002fG-HI
      for [email protected];  Tue, 25 Aug 2020 15:00:00 +0000
  

• MAPI. Messaging Application Programming Interface (MAPI) and MAPI over HTTP are used by Microsoft Exchange & Office 365 as a server and e.g. Outlook as a client. Currently with Office 365 the IP address gets recorded in the x-originating-ip header.

  x-originating-ip: [198.51.100.123]
  

  This header was originally used by Hotmail between 1999 and 2012, but was then replaced with encrypted X-EIP. Although the x-originating-ip header isn't standardized, it's used by some other services too, including e.g. GoDaddy Webmail Service.

• Gmail. Whether you use the webmail or SMTP, the first-hop connection isn't recorded in the Received headers and there's no x-originating-ip header, neither.

  However, there's an X-Google-Smtp-Source header containing 68 bytes of binary information encoded in base64. Although this doesn't seem to directly contain the IP address, Google probably has the missing piece of information and can use this header to track your original IP address.

• Webmails have different practices.

  • Squirrelmail webmail adds a Received header stating that the webmail client received the message using HTTP.

    Received: from 198.51.100.123
            (SquirrelMail authenticated user joe.bloggs)
            by webmail.example.com with HTTP;
            Tue, 25 Aug 2020 15:00:00 +0000
    

    This information can be encrypted with configuration parameter $encode_header_key, but the configuration section has a comment stating it's not bulletproof.

  • Roundcube has two configuration parameters and I think it defaults to not including this information in the messages.

    http_received_header_encrypt
    Whether or not to encrypt the IP address and the host name. These could, in some circles, be considered as sensitive information; however, for the administrator, these could be invaluable help when tracking down issues.

    http_received_header
    Add a received header to outgoing mails containing the creators IP and hostname.

Answer 2

Years ago, many webmail services (such as Hotmail and Yahoo Mail) used to include a X-Originating-Ip header in outgoing messages, which indicated IP address that the sender was using to connect to the webmail service to send the message. But, most of those services either encode this header now, or no longer include it. See https://en.wikipedia.org/wiki/X-Originating-IP for more info.