I have an email header which is showing the following information, which i believe is faked.

The mail purports to be from a gmail account but I'm not sure if this is the case. Ordinarily you read the headers from the bottom up, which suggests the email came from mail-am1.bigfish.com (a Microsoft server) but then, bizarrely, the top line of the mail looks like there's a parallel journey in from Google.

What could cause the pattern I'm seeing (could be spam as the Google server doesn't seem to exist)?

Received: from mail-yi0-f41.google.com ( by AM1EHSMHS013.bigfish.com ( 

Received: from AM1EHSMHS013.bigfish.com (unknown []) by mail60-am1.bigfish.com (Postfix) 

Received: from mail60-am1 (localhost.localdomain []) by mail60-am1 (MessageSwitch) 

Received: by 
Received: by 
Received: by abc25 

Received: from mail60-am1 (localhost.localdomain [])   by mail60-am1-R.bigfish.com (Postfix) 

Received: from mycompanyrelay.gmessaging.net ( by mymail.mycompany.com ( 

Received: from mycompanyrelay.gmessaging.net (localhost.localdomain  [])   by localhost.gmessaging.net (Postfix) 

Received: from mail60-am1-R.bigfish.com (mail-am1.bigfish.com [])    by  mycompanyrelay.gmessaging.net

migrated from stackoverflow.com Feb 15 '12 at 22:14

This question came from our site for professional and enthusiast programmers.


While the headers look odd for a variety of reasons, not the least of which is that they're partial headers. It's entirely possible that the e-mail was originally from Microsoft, to a g-mail account, which is forwarded to another e-mail account. This will cause the e-mail to have headers from Microsoft, receiving headers from GMail, sending headers from GMail, and receiving headers for your Organization.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy