1

I have noticed this issue while using Google's Gmail with Thunderbird. When I send an email from Gmail's web front end at https://mail.google.com/ my internal and external IP address are not included in the email header.

However, I would like to use Mozilla Thunderbird to send emails from my local machine via Gmail. I logged into Gmail from Thunderbird via the IMAP / SMTP option. But when I send an email with Thunderbird via Gmail, it always includes my internal and external IP address in the email header and therefore exposes / leaks them to the mail's recipient. I would like to prevent this.

Here is a section of an email header sent by Thunderbird via Gmail:

Received: from [INTERNAL_IP] (EXTERNAL_HOSTNAME [EXTERNAL_IP])
        by smtp.gmail.com with ESMTPSA id SOME_ID
        for <RECIPIENT_EMAIL_ADDRESS>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
  • INTERNAL_IP is the IP that my computer uses inside my home network behind my router's NAT
  • EXTERNAL_HOSTNAME is the hostname assigned to me by my ISP
  • EXTERNAL_IP is the IP assigned to me by my ISP

I found these related posts, but they did not really help me:

As far as I know the Received part of the email header (see code snippet above) where my IPs are included is not set by Thunderbird but by Google's SMTP server. Since I obviously do not have access to Google's servers, I cannot change their configuration.

My idea is to use a VPN provider (e.g. NordVPN or ExpressVPN) and to route my entire computer's traffic through the VPN tunnel. Then Google's SMTP server would not see my IP addresses but the IP address of my VPN provider's server. Do you think that's a viable solution? Would there be a higher risk of my emails being marked as spam because the IP of my VPN provider might be blacklisted?

1

Including the originating IP was standard practice until relatively recently. A number of WEB mail providers that also support IMAP/POP clients like Thunderbird have altered their handling to process client email as virtual web mail, replacing the originating IP with that of the Web server. As of 10 minutes ago, that does not seem to be the case with Gmail, it still includes the originating IP.

There are other email providers that don't do this. Since this is of interest to you, I'll remind you that Gmail clearly states that they scan your email content, in case you care.

Using a VPN will indeed show only the VPN IP and not yours. However you may run into problems with Google Security objecting to the VPN IP, particularly if it's from another country. It's easy enough to try, go ahead and test it.

As for recipient providers, I suspect some will blacklist/block/flag the VPN and some won't.

If this is a significant enough concern for you, I'd suggest changing providers.

4
  • Thanks @user10216038 ! Can you recommend me some providers?
    – luke359
    Jan 26 at 19:50
  • @luke359 - I use a small local provider and I'm afraid they would be crushed if I mentioned them here, plus your profile says you are in Germany. A little googling should find you many options. Keep in mind that with FREE Providers, you're not the customer, you're the product. Consider using a paid service. Jan 26 at 22:01
  • I know some email hosting providers in Germany @user10216038 and am I am willing to pay for the service but I am not sure how to check whether they support the virtual web mail feature you mentioned. Is Protonmail's Bridge similar to this virtual web mail feature? They are the only one I found.
    – luke359
    Jan 28 at 7:47
  • @luke359 - I haven't used Proton Bridge. Just have someone, or yourself, send an email from the provider and look at the headers. Or post a question here, there's probably someone who can check Proton Bridge. Try asking at bridge@protonmail.com Jan 28 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.