Decypering E-mail Headers

Factual Questions
1

I made an online posting last week for some web-dev work. One developer I quite like claims to be a university student from Canada, but has yet to provide any details to backup this fact (and uses no last name, doesn’t use the phone, and wants paypal transfers only). I’d like to try to look at e-mail headers to verify his country of origin. Does gmail include IP address info when sending messages? I know hotmail & yahoo do, and had always assumed gmail was the same. Here is an example of the header info from a message he sent me:

Delivered-To: anonyimized...@gmail.com
Received: by 10.142.100.17 with SMTP id x17cs478080wfb;
Fri, 20 Jul 2007 07:48:14 -0700 (PDT)
Received: by 10.143.33.19 with SMTP id l19mr39356wfj.1184942893971;
Fri, 20 Jul 2007 07:48:13 -0700 (PDT)
Received: by 10.143.13.2 with HTTP; Fri, 20 Jul 2007 07:48:13 -0700 (PDT)
Message-ID: <4b2b0780707200748u6a728c3esfdd714e34e071083@mail.gmail.com>
Date: Fri, 20 Jul 2007 10:48:13 -0400
From: “Waterloo University” <anonyimized…>
To: “DNP” <anonyimized…>
Subject: Re: Web Design Contract-Work
In-Reply-To: <b117d8c50707200712n9638d89kfb10e911bd29d32f@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=“----=_Part_30645_14311860.1184942893898”
References: <4b2b0780707111642o41609c4cy9fa7e90f2b221ad1@mail.gmail.com>
<4b2b0780707180850s425f4ef6h1e0b52f56362d26f@mail.gmail.com>
<b117d8c50707180902g6d9fffcbq8642f0c0571dfb57@mail.gmail.com>
<4b2b0780707180907g56c3b8ablb5d33141b7e23749@mail.gmail.com>
<4b2b0780707181247m16071ddfqe3cdbc3ed8314c02@mail.gmail.com>
<b117d8c50707181650q147052fer293fcbe834851fd2@mail.gmail.com>
<4b2b0780707190505t647bd6ceo14f79baa1e228fbd@mail.gmail.com>
<b117d8c50707190637v6cf0fc85raf39066c451649d8@mail.gmail.com>
<4b2b0780707190828r5e8c55efr542ed8d014a1ec8d@mail.gmail.com>
<b117d8c50707200712n9638d89kfb10e911bd29d32f@mail.gmail.com>

------=_Part_30645_14311860.1184942893898
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Is the sender’s IP revealed in that header? I can’t see it anywhere.

2

Nope.

FWIW, I wouldn’t give money to anyone who cannot be properly identified. Besides, if they do web work, I’ve yet to find someone who doesn’t have a web site to showcase their work and/or provide references. Big Red Flag on this one.

I would insist on specific references and if not forthcoming in a short period of time, go elsewhere. Something does not smell right here.

(On later preview I see you deleted the specific email addresses. Good for you. But before you did, it made no sense to use a gmail account and claim it’s a university account. Another red flag.)

3

Yeah I just did a test and the sender’s IP doesn’t seem to be anywhere in Gmail’s headers. Curious.

4

so is that unusual for gmail? or as a policy does google anonymize e-mails?

5

It’s not unusual for any webmail system. The email originates within gmail.com (not at the senders system), the SMTP email headers you see are generated partly at Google and partly at the receiving end (plus transitory systems if there are any) - so the sender ip address in the header will be filled in by the receiver, and will be the ip address of the sending SMTP gateway at google. Anything else is wrong.

Si

6

The 10.x.y.z address is part of a range reserved for intranets. Another is 192.168.x.y. I’ve just forwarded a gmail email to myself and I too see a 10 address in there. Nothing to worry about: it just means that Google runs a 10/8 network.

7

That would be a skimpy header for a true Internet email. Because the message is really just going from one gmail server address to another, complete headers aren’t needed. Gmail has no idea where that “email” is coming from, because it’s a web application, not a true email client.

8

Gmail could put a header along the lines of X-Originating-IP on if they wanted, I believe Hotmail does that, or did that.

9

I solved my problem by sending a link to a page containing a traceable image and watching server logs to see which IP downloaded it.

I am very surprised to find out that gmail doesn’t disclose sender IPs though.