0

When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender's email server in the email headers.

But do the email headers also contain the IP address of the desktop (client) computer used by the person who sent the email?

Would it be the case if they use something like Thunderbird instead of webmail?

Notes:

8

1 Answer 1

3

The Received headers in an email track every SMTP conversation an email has.

If you're using Thunderbird or another MUA (mail user agent), you're almost certainly speaking SMTP and therefore your IP address will be logged in a Received header as per RFC 5321 §3.7.2 (though a rare few outbound SMTP relays violate the spec and actually omit your IP address).

If you're using web mail, the SMTP connection is controlled by the web mail server. Many web mail servers will add the client IP either in a Received header (typically saying with HTTP) or another header such as X-Originating-IP. A number of web mail providers removed this data in the mid 2010s in anticipation of privacy laws like GDPR and the speculation that IP addresses are personally identifiable information (which is a debated topic), so this is not as available as it once was.

IIRC, Google never had client IP information in its web mail headers.

Arguably, with a responsible web mail provider using authentication for outbound mail, tracking the client IP is unnecessary since abuse reports can pin content on the sending account, which is more telling. This unfortunately limits what third party analysts can do since an attacker may be cycling through multiple accounts from multiple providers using the same pool of IPs.

4
  • 1
    The referenced RFC 5321 does not say the IP address will be logged. Granted it was near universally done in the past, but I just checked a Thunderbird client through two different email providers and there is no originating IP in either one now. Commented Sep 19, 2020 at 3:47
  • I suspect that with the vast majority of users using Web Mail now, the SMTP servers are implementing a virtual Web Mail handler for commonality. Instead of my client originating IP like I used to see, I now see the IP block of the email provider exactly the same as if I'd used the web interface. Commented Sep 19, 2020 at 3:53
  • RFC 5321 says you can't modify Received headers, which are defined as "Trace Fields" in RFC 5322 §3.6.7, but you're right: IPs in Received headers are not strictly mandatory according to the specs (which aren't ever fully respected anyway), though their use is the de facto behavior for SMTP and is no longer common for HTTP clients before initiating SMTP.
    – Adam Katz
    Commented Sep 20, 2020 at 22:44
  • In practice, Google is the only major mail provider I know of that still tacks on a Received header containing the original sender's IP address. Every other provider omits this entirely, or masks the IP address in the header. Commented Mar 2, 2023 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .