# Decypering E-mail Headers

**URL:** <https://boards.straightdope.com/t/decypering-e-mail-headers/412555>\
**Category:** Factual Questions\
**Created:** [July 20, 2007, 4:47pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555 "2007-07-20T16:47:46Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![xiix](https://avatars.discourse-cdn.com/v4/letter/x/d6d6ee/32.png) [@xiix](https://boards.straightdope.com/u/xiix)\
**Post date:** [July 20, 2007, 4:47pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/1 "2007-07-20T16:47:46Z")

</div>

I made an online posting last week for some web-dev work. One developer I quite like claims to be a university student from Canada, but has yet to provide any details to backup this fact (and uses no last name, doesn’t use the phone, and wants paypal transfers only). I’d like to try to look at e-mail headers to verify his country of origin. Does gmail include IP address info when sending messages? I know hotmail & yahoo do, and had always assumed gmail was the same. Here is an example of the header info from a message he sent me:

Delivered-To: [anonyimized...@gmail.com](mailto:anonyimized...@gmail.com)  
Received: by 10.142.100.17 with SMTP id x17cs478080wfb;  
Fri, 20 Jul 2007 07:48:14 -0700 (PDT)  
Received: by 10.143.33.19 with SMTP id l19mr39356wfj.1184942893971;  
Fri, 20 Jul 2007 07:48:13 -0700 (PDT)  
Received: by 10.143.13.2 with HTTP; Fri, 20 Jul 2007 07:48:13 -0700 (PDT)  
Message-ID: \<4b2b0780707200748u6a728c3esfdd714e34e071083@mail.gmail.com\>  
Date: Fri, 20 Jul 2007 10:48:13 -0400  
From: “Waterloo University” \<anonyimized…\>  
To: “DNP” \<anonyimized…\>  
Subject: Re: Web Design Contract-Work  
In-Reply-To: \<b117d8c50707200712n9638d89kfb10e911bd29d32f@mail.gmail.com\>  
MIME-Version: 1.0  
Content-Type: multipart/alternative;  
boundary=“----=\_Part\_30645\_14311860.1184942893898”  
References: \<4b2b0780707111642o41609c4cy9fa7e90f2b221ad1@mail.gmail.com\>  
\<4b2b0780707180850s425f4ef6h1e0b52f56362d26f@mail.gmail.com\>  
\<b117d8c50707180902g6d9fffcbq8642f0c0571dfb57@mail.gmail.com\>  
\<4b2b0780707180907g56c3b8ablb5d33141b7e23749@mail.gmail.com\>  
\<4b2b0780707181247m16071ddfqe3cdbc3ed8314c02@mail.gmail.com\>  
\<b117d8c50707181650q147052fer293fcbe834851fd2@mail.gmail.com\>  
\<4b2b0780707190505t647bd6ceo14f79baa1e228fbd@mail.gmail.com\>  
\<b117d8c50707190637v6cf0fc85raf39066c451649d8@mail.gmail.com\>  
\<4b2b0780707190828r5e8c55efr542ed8d014a1ec8d@mail.gmail.com\>  
\<b117d8c50707200712n9638d89kfb10e911bd29d32f@mail.gmail.com\>

## ------=\_Part\_30645\_14311860.1184942893898 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline

Is the sender’s IP revealed in that header? I can’t see it anywhere.

---

<div class="post-metadata">

**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\
**Post date:** [July 20, 2007, 4:56pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/2 "2007-07-20T16:56:09Z")

</div>

[QUOTE=xiix]  
Is the sender’s IP revealed in that header? I can’t see it anywhere.  
[/QUOTE]

Nope.

FWIW, I wouldn’t give money to anyone who cannot be properly identified. Besides, if they do web work, I’ve yet to find someone who doesn’t have a web site to showcase their work and/or provide references. **Big Red Flag on this one.**

I would insist on specific references and if not forthcoming in a short period of time, go elsewhere. Something does not smell right here.

(On later preview I see you deleted the specific email addresses. Good for you. But before you did, it made no sense to use a gmail account and claim it’s a university account. **Another red flag.** )

---

<div class="post-metadata">

**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\
**Post date:** [July 20, 2007, 6:26pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/3 "2007-07-20T18:26:17Z")

</div>

Yeah I just did a test and the sender’s IP doesn’t seem to be anywhere in Gmail’s headers. Curious.

---

<div class="post-metadata">

**Author:** ![xiix](https://avatars.discourse-cdn.com/v4/letter/x/d6d6ee/32.png) [@xiix](https://boards.straightdope.com/u/xiix)\
**Post date:** [July 20, 2007, 9:29pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/4 "2007-07-20T21:29:18Z")

</div>

so is that unusual for gmail? or as a policy does google anonymize e-mails?

---

<div class="post-metadata">

**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\
**Post date:** [July 20, 2007, 9:59pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/5 "2007-07-20T21:59:57Z")

</div>

[QUOTE=xiix]  
so is that unusual for gmail? or as a policy does google anonymize e-mails?  
[/QUOTE]  
It’s not unusual for any webmail system. The email originates within [gmail.com](http://gmail.com) (not at the senders system), the SMTP email headers you see are generated partly at Google and partly at the receiving end (plus transitory systems if there are any) - so the sender ip address in the header will be filled in by the receiver, and will be the ip address of the sending SMTP gateway at google. Anything else is wrong.

Si

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [July 20, 2007, 10:27pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/6 "2007-07-20T22:27:09Z")

</div>

The 10.x.y.z address is part of a range reserved for intranets. Another is 192.168.x.y. I’ve just forwarded a gmail email to myself and I too see a 10 address in there. Nothing to worry about: it just means that Google runs a 10/8 network.

---

<div class="post-metadata">

**Author:** ![Nametag](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/nametag/32/406_2.png) [@Nametag](https://boards.straightdope.com/u/Nametag)\
**Post date:** [July 21, 2007, 12:59am UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/7 "2007-07-21T00:59:58Z")

</div>

That would be a skimpy header for a true Internet email. Because the message is really just going from one gmail server address to another, complete headers aren’t needed. Gmail has no idea where that “email” is coming from, because it’s a web application, not a true email client.

---

<div class="post-metadata">

**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\
**Post date:** [July 21, 2007, 6:32pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/8 "2007-07-21T18:32:06Z")

</div>

Gmail could put a header along the lines of X-Originating-IP on if they wanted, I believe Hotmail does that, or did that.

---

<div class="post-metadata">

**Author:** ![xiix](https://avatars.discourse-cdn.com/v4/letter/x/d6d6ee/32.png) [@xiix](https://boards.straightdope.com/u/xiix)\
**Post date:** [July 21, 2007, 6:58pm UTC](https://boards.straightdope.com/t/decypering-e-mail-headers/412555/9 "2007-07-21T18:58:57Z")

</div>

I solved my problem by sending a link to a page containing a traceable image and watching server logs to see which IP downloaded it.

I am very surprised to find out that gmail doesn’t disclose sender IPs though.