How Can I Trace Where Email Came From?

You may not be able to, but there may be clues

I frequently get questions that boil down to “How can I trace where this email came from?” or “Can I determine the IP address of the sender of an email?”

The answer is both yes, maybe, and it may not do you any good. However there is a lot of interesting information in your email that you normally don’t see, and the trail of mail servers is part of that.

So let’s interpret some email headers.

Getting headers

First, there’s the challenge of even getting to the real email headers. Depending on your email program or interface, look for items like “Show Original” or “Show headers” or something similar.

Here’s a rather lengthy example:

Now yours may look a lot different. It may be longer or shorter, or have additional information, or less. But the basic idea is that there’s a lot of information in the headers that has to do with the administration of getting the email from the sender to the receiver.

Some Individual headers

A detailed reference is much more than I can present here, and quite honestly, probably more than you need. But let’s examine the headers above a little more closely, since it’s a good example of a “normal” email message. They are from a message I sent to my regular email account from my Hotmail account.

A good rule of thumb is to begin at the bottom and work your way up in the headers. That’ll make more sense in just a minute.

Note that headers that begin with “X-” are “non standard”, and may not be used by all mailers, and might even mean different things to different mailers. They’re often just informational.

Highlighting just a few of the headers, working from the bottom:

• X-MS-Exchange-: The message was sent from my Hotmail account, which is processed by Microsoft using the Exchange email server. These headers are a number of items added by Exchange to the message. The most interseting might be X-MS-Exchange-CrossTenant-originalarrivaltime, the time the message was submitted to Hotmail … in other words, the time I pressed “Send”. In this example the date/time is 28 May 2023 17:44:29.7764 (UTC). The “(UTC)” means that the time is recorded as “Universal Time Coordinated”, sometimes thought of as Greenwich Mean Time or GMT. Since I’m in the Pacific time zone, and daylight savings time is in effect, that means I sent it at roughly 10:44 AM PDT.
• Content-Type: is how the mailers tell each other what the format of the mail is: plain text, as this example is, or HTML, or something else.
• Mime-Version: “Mime” stands for Multipurpose Internet Mail Extensions, and is the formatting protocol most  often used to encode attachments and alternate representations in a single email. In this example the type is “multipart/alternative”, meaning that the message may be included more than once, typically once in HTML format, and once again in plain text.
• Date: This is the more common place you’ll find the date and time that the message was sent. This is added by the sending mailer or email program, and is commonly used by your email client as the “Sent Date”. Interestingly, it need not be accurate. Note that the time zone is specified as an offset (+0000 hours) from UTC. You can use this to calculate the time in the local zone.
• Subject: As you’d expect, the subject of the email as you typed it.
• To: Again, as you’d expect, the list of recipient email addresses that this message is addressed to. What most people don’t realize is that the To: line doesn’t define who the email actually goes to, but rather simply lists who the mailer claims it’s to go to. Spammers, for example, can easily create a mail message that has bogus addresses in the To: line, and then send the mail to someone else entirely. That’s known as “spoofing“.
• From: Just like To:, the “From:” address shows you from whom the mail was supposedly sent. And also like “To:”, it’s very easy for the spammers and virus writers to spoof the From: address to be pretty much anything they want.
• Received: Herein lies the gold. I’ll get into more detail on that below.
• Delivered-To: is added by the receiving mail server when it finally delivers the email to a specific email alias or mailbox.
• Return-Path: is the address that the email, if it fails to be delivered, should be bounced back to.
• Authentication-Results: and Received-SPF: are headers added that relate to spam detection. DKIM (mentioned within the first) and SPF are two approaches to confirming that the message is being sent by servers authorized to send from the source email address, and that the message has not been tampered with.
• Delivered-To: In my case I manage my leo@pugetsoundsoftware.com email (the To: address) using a Gmail account, and this logs which account is being used.

Received:

The series of “Received” headers are the trail that tells us from where the message was sent, and along what path or series of servers it  traveled across the internet. And this is why we started at the bottom, as each mail server adds a received header to the top.

The first “Received” header is:

Received: from MW4PR19MB7031.namprd19.prod.outlook.com ([fe80::9f2a:c282:3c86:681d]) by MW4PR19MB7031.namprd19.prod.outlook.com ([fe80::9f2a:c282:3c86:681d%4]) with mapi id 15.20.6455.012; Sun, 28 May 2023 17:44:29 +0000

Or, in something closer English, the email was “Received”:

• From a server namedMW4PR19MB7031.namprd19.prod.outlook.com
• At the IP(v6) address: fe80::9f2a:c282:3c86:681d
• By a server named MW4PR19MB7031.namprd19.prod.outlook.com
• At the IP(v6) address: fe80::9f2a:c282:3c86:681d
• With mapi id 15.20.6455.012
• At the UTC date/time: Sun, 28 May 2023 17:44:29

Some interesting things to note:

• It was sent from and received by the same server. It’s not that uncommon for email servers to do this for a variety of reasons.
• The servers don’t list a IPv4 address.
• “MAPI” is Messaging Application Programming Interface, which is a mail API used within some Microsoft email programs and servers.
• It was sent at Sun, 28 May 2023 17:44:29, or, in my local time zone, 10:44:29 AM.

Immediately above that is another “Received” line (showing only the relevant portions of the lines):

• from MW4PR19MB7031.namprd19.prod.outlook.com
• by SJ0PR19MB6678.namprd19.prod.outlook.com
• with Microsoft SMTP Server
• at Sun, 28 May 2023 17:44:29 +0000

This is a different email server, fractions of a second later. Of note in this Received line is that it includes the software used: Microsoft SMTP Server.

Six lines above that, another “Received” line:

• from NAM12-MW2-obe.outbound.protection.outlook.com
• by ip-172-31-17-218.us-west-2.compute.internal
• at Sun, 28 May 2023 10:44:31 -0700 (PDT)

This represents the transmission of the message from the Microsoft outgoing mail server, to my server, two seconds later. This line also includes additional information: different email server software running on my server (Postfix), and the email address for which the message is destined (leo@pugetsoundsoftware.com).

Six lines above that we find a received line that doesn’t include a “from”, only the server actually receiving the message:

• Received: by 2002:a05:6402:2883:b0:514:9bd6:ceb0
• with POP3
• at Sun, 28 May 2023 10:44:54 -0700 (PDT)

Note that it indicates the protocol used: POP3. I have my Gmail account configured to fetch email from my server. Also note that this happened a full 10 seconds after the prior Received. This means the message sat on my server for that amount of time prior to being picked up by Gmail.

By now you can see that Received lines are somewhat consistent, but also vary a great deal. They all include the “by” server and a date/time stamp, most include a “from” server, but they can include additional information as well.

Received in spam