I noticed that some mail header contact a field called
received : from and it contains an ip address.
Does this address refer to the sender machine even if he is using a web interface or to the server ?
Mail starts at a client, this client sends it to the server. If the server has to hand it over to another server (because itself is not serving mail for the domain where the mail needs to go), it forwards it to the server that does. This server then adds
firstname.lastname@example.org wants to send an email to email@example.com.
Bart creates an email and hands it to the mail server for mydomain.com. This server looks at the destination-address and sees it is
When the mail server for
Example of such a chain:
You should read these bottom to top.
In addition to what @Bart De Vos is saying even the first mail server that receives the message ie the home server of your organization will add a Received: from header indicating the client that is sending the message. In the case of a web interface into mail (webmail) the client sending the message is the server hosting the WebMail application. Usually both the IP address and the name of the client are recorded but it is possible to only record the IP address if the name (DNS) cannot be discovered. For example my server (postfix) records this like this
Essentially, as a result of the above a message can be traced back to its source this way and the route (relays) that it has traversed. Mind you though that there are ways to modify these records.
I just did the test for you:
I first sent an email from my outlook to my gmail and then from the hotmail webinterface. This is the result:
From my outlook:
As you can see when I'm sending the email from the hotmail webinterface, the IP from my computer is not included.