0

Can someone trace the MAC address of an email to the point of origin if the email address has been deleted? I received an email from an unknown sender regarding an issue at my work, and when I tried to reply to it, I got a "message send: failure" email from my email provider. This tells me that whoever sent me this message deleted the email account to prevent being discovered. The message contained a some statements to my boss from some of my co-workers. I had never seen them until I got this email. Is there a way to find out where it came from?

  • I think you mean IP address. – pgs Jul 20 '15 at 2:24
  • 1
    The sender's e-mail address could have been easily been spoofed. No need to create en account to send an e-mail. – A. Hersean Oct 17 '18 at 11:34
  • A MAC address, versus IP, would be useful to trace the sender if it was suspected the message was sent at a place where computers were behind NAT/PAT, such as in many workplaces or public Wi-Fi. – user71659 Oct 17 '18 at 17:58
4

Short answer: no

Long(er) answer:

Up until some time ago you could see(in both yahoo and gmail) the network address of the sender by looking at the full headers of the e-mail message. Currently, this option is no longer available in gmail.

An attacker can use a service like this to send an e-mail with custom headers(meaning that the source address can be anything(i.e. b.obama@whitehouse.gov)) in conjunction with an anonymizing service such as a VPN, TOR, or both, in order to conceal his actual network address.

The MAC serves as an identifier within a subnet and is stripped and replaced once the packets leave that subnet(by the station that acts as the gateway). So, there is no way to tell the MAC address at it's not specified in the headers of the e-mail.

2

No, you can't. THe MAC address acts as address parameter only in subnet (till Data Link Layer). But there is a way to find the Network Address using this. As the sender email account is longer there, as you told, then you can't even do the above thing either.
Moreover spammers use services like this and generally they use known reputed company mails.
But Gmail has blacklisted the site so it is automatically flushed to the spam folder.

1

If they are using IPv6 without privacy extension or if their ISP embed the MAC address in the reverse DNS name, then you can deduce their MAC address from their IP address.

The IP address is usually found inside the mail headers. But be aware that if they are using webmail, then the email originates from a webserver rather than from the sender's own computer.

Also be aware that an email provider can change which information about the users, which they will include in the headers of outgoing mails. Thus it is possible for email sent using webmail to include the IP address and it is possible for email send using a mail client not to include the IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.