Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I noticed that some mail header contact a field called received : from and it contains an ip address.

Does this address refer to the sender machine even if he is using a web interface or to the server ?

share|improve this question

4 Answers 4

up vote 9 down vote accepted

Mail starts at a client, this client sends it to the server. If the server has to hand it over to another server (because itself is not serving mail for the domain where the mail needs to go), it forwards it to the server that does. This server then adds received : from to the header.

Example:

bart@mydomain.com wants to send an email to sohaibafifi@yourdomain.com.

Bart creates an email and hands it to the mail server for mydomain.com. This server looks at the destination-address and sees it is yourdomain.com. This server does not provide mail for yourdomain.com. It has to look up the server that does via the MX Records for yourdomain.com and then forward the mail to it.

When the mail server for yourdomain.com has received the mail, he adds received : from mail.mydomain.com and delivers it to sohaibafifi's mailbox or gives it to another server if this would be needed.

Example of such a chain:

Received: by 10.42.195.134 with SMTP id ec6csp80279icb;
        Tue, 19 Jun 2012 00:45:09 -0700 (PDT)
Received: by 10.180.103.42 with SMTP id ft10mr929660wib.18.1340091908492;
        Tue, 19 Jun 2012 00:45:08 -0700 (PDT)
Received: from barracuda2.infraxnet.be (mail2.infraxnet.be. [78.24.168.38])
        by mx.google.com with ESMTP id c73si24136496wec.20.2012.06.19.00.45.07;
        Tue, 19 Jun 2012 00:45:08 -0700 (PDT)

You should read these bottom to top.

share|improve this answer
    
To be specific about one of his questions: no, the user's PC will not be in those headers if he's using webmail. And, beware that e-mail providers might not include the header. Gmail for instance is such a provider. –  Halfgaar Jun 19 '12 at 7:49
    
@Halfgaar: Are you sure Google does not includes these headers? Just had a look and they where there :) –  Bart De Vos Jun 19 '12 at 7:50
    
Hmm, I can't find anything about it now. I could have sworn that was the case. –  Halfgaar Jun 19 '12 at 8:26
    
Of course, those headers can be easily faked, suggesting a provenance that didn't really exist. –  David Schmitt Jun 19 '12 at 11:37

In addition to what @Bart De Vos is saying even the first mail server that receives the message ie the home server of your organization will add a Received: from header indicating the client that is sending the message. In the case of a web interface into mail (webmail) the client sending the message is the server hosting the WebMail application. Usually both the IP address and the name of the client are recorded but it is possible to only record the IP address if the name (DNS) cannot be discovered. For example my server (postfix) records this like this

Received: from [10.16.16.63] (client.inmydomain [10.16.16.63]) .....

Essentially, as a result of the above a message can be traced back to its source this way and the route (relays) that it has traversed. Mind you though that there are ways to modify these records.

share|improve this answer

These are the IP addresses of the mailservers where the mail went through.

I found an easy and detailed explanation here: http://www.visualware.com/resources/tutorials/email.html

share|improve this answer
1  
It's considered good practice to include the relevant parts of the link in the answer, as one day this link might die and your answer will become useless for feature visitors. –  Lucas Kauffman Jun 19 '12 at 7:52
    
I see. Thank you. –  Taucher Jun 19 '12 at 8:02

I just did the test for you:

I first sent an email from my outlook to my gmail and then from the hotmail webinterface. This is the result:

From my outlook:

Received: from 20.20-200-80.adsl-dyn.isp.belgacom.be (HELO jameson) ([80.200.20.20])
  by relay.skynet.be with ESMTP; 19 Jun 2012 09:45:24 +0200

From hotmail:

Received: from BAY162-W38 ([65.54.190.201]) by bay0-omc4-s7.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);

As you can see when I'm sending the email from the hotmail webinterface, the IP from my computer is not included.

share|improve this answer
    
can you please test it with yahoo ? it seems that even using the webmail, yahoo send the machine ip ! –  sohaibafifi Jun 19 '12 at 10:36
    
you can just test that yourself, you are a student, you need to learn how to explore :) –  Lucas Kauffman Jun 19 '12 at 11:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.