How to send emails with Thunderbird without revealing my internal and external IP address?

Question

I have noticed this issue while using Google's Gmail with Thunderbird. When I send an email from Gmail's web front end at https://mail.google.com/ my internal and external IP address are not included in the email header.

However, I would like to use Mozilla Thunderbird to send emails from my local machine via Gmail. I logged into Gmail from Thunderbird via the IMAP / SMTP option. But when I send an email with Thunderbird via Gmail, it always includes my internal and external IP address in the email header and therefore exposes / leaks them to the mail's recipient. I would like to prevent this.

Here is a section of an email header sent by Thunderbird via Gmail:

Received: from [INTERNAL_IP] (EXTERNAL_HOSTNAME [EXTERNAL_IP])
        by smtp.gmail.com with ESMTPSA id SOME_ID
        for <RECIPIENT_EMAIL_ADDRESS>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

• INTERNAL_IP is the IP that my computer uses inside my home network behind my router's NAT
• EXTERNAL_HOSTNAME is the hostname assigned to me by my ISP
• EXTERNAL_IP is the IP assigned to me by my ISP

I found these related posts, but they did not really help me:

• http://kb.mozillazine.org/Replace_IP_address_with_name_in_headers
• http://forums.mozillazine.org/viewtopic.php?f=39&t=586534

As far as I know the Received part of the email header (see code snippet above) where my IPs are included is not set by Thunderbird but by Google's SMTP server. Since I obviously do not have access to Google's servers, I cannot change their configuration.

My idea is to use a VPN provider (e.g. NordVPN or ExpressVPN) and to route my entire computer's traffic through the VPN tunnel. Then Google's SMTP server would not see my IP addresses but the IP address of my VPN provider's server. Do you think that's a viable solution? Would there be a higher risk of my emails being marked as spam because the IP of my VPN provider might be blacklisted?

Answer 1

Including the originating IP was standard practice until relatively recently. A number of WEB mail providers that also support IMAP/POP clients like Thunderbird have altered their handling to process client email as virtual web mail, replacing the originating IP with that of the Web server. As of 10 minutes ago, that does not seem to be the case with Gmail, it still includes the originating IP.

There are other email providers that don't do this. Since this is of interest to you, I'll remind you that Gmail clearly states that they scan your email content, in case you care.

Using a VPN will indeed show only the VPN IP and not yours. However you may run into problems with Google Security objecting to the VPN IP, particularly if it's from another country. It's easy enough to try, go ahead and test it.

As for recipient providers, I suspect some will blacklist/block/flag the VPN and some won't.

If this is a significant enough concern for you, I'd suggest changing providers.