Knowledge Base

Understanding Email Headers and IP Tracing

The email header is a section of code that contains information about where the email came from and how the message reached its destination. Headers will contain the email address of the originator and/or the computer the sender was using.

This article will cover the following topics:

How Email Headers Look Like ⤵
Which IP Address Above Is Relevant for Tracing? ⤵
Why Email Headers Matter ⤵
Full and Partial Email Headers Explained ⤵

How Email Headers Look Like

Below is an example of what the typical email header looks like. What you are looking for in the header is the IP address, sometimes conveniently identified as the "Originating IP." We can trace the internet service provider (ISP), along with the date and time of the offending email, using the IP address of the sender's computer. The IP addresses in the example below are shown in bold.

Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=NTSUn5Bd+VSwoO7O2QDhm8Ut5KyAaQKdkEVT8pQ8wjZuag+Z3d/MTj2+NVrZVakqEB /1jOSCwyCurMMid14L4CVSF7dfCJkvla666BfdCYgLShKEK3nPec3Ap9YN2mlHPw/aRG rcYIJh1n60/BePZNJx6+YiQWIOgIYqoxtZXkk= MIME-Version: 1.0
Date: Thu, 12 Nov 2009 08:14:02 -0700
Message-ID: <[email protected]>
Subject: blah
From: Hostgator Tech <[email protected]>
To: [email protected] 
Content-Type: text/plain; charset=ISO-8859-1 X-pstn-neptune: 0/0/0.00/0 X-pstn-levels: (S:72.19780/99.90000 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )

Which IP Address Above Is Relevant for Tracing?

Usually, the originating IP (in this case, 209.85.210.177) is either called that, or is closer to the bottom of the stack, closer to the body of the message.

It is important to note that this source IP address (209.85.210.177) will not resolve on the Internet as it is within a block of IP addresses that are "reserved" private IP addresses. They are used behind corporate firewalls and proxy servers. They access the outside world through a NAT service, which stands for Network Address Translation. To find where this IP address is located, you will have to contact the network administrator responsible for the IP address 64.18.2.187, which is a legitimate internet IP address and through which this private IP address passes on its way to the internet.

RFC 1918 describes IP addressing guidelines for private networks, which IANA (Internet Assigned Numbers Authority) has reserved for private networks. There are three sets of reserved private numbers, one for each IP network Class A, B & C. They are:

10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.00 to 192.168.255.255

Why Email Headers Matter

Here are a few reasons it may be necessary to review the headers:

To investigate possible spoofing and determine the source of the message
To analyze timestamps along the delivery route and identify the source of any delay
To check whether any mail server in the delivery path is listed on a blacklist
To review the Spam Assassin score
To determine if the message was routed through a filtering server prior to arrival

While reviewing email header information may seem very technical, internet investigations are NOT rocket science. If you know what has happened and to whom, the next step is to find out why by reviewing the contents of the email header.

Full and Partial Email Headers Explained

Every email has a header, which is a block of information about the message and where it came from. Most email programs show only a few header fields by default. This short view is called the partial header. The complete set of technical details is called the full header.

Partial Headers

This is what you normally look at in your emails. The partial headers are the most important for your daily tasks. Common partial header fields include the From address, To address, Subject, Date and Time, Reply-To address, CC, and BCC fields.

It covers the basics you need which includes:

From: Who sent the email
To: The main recipient(s)
CC: Other recipients who were copied, visible to everyone
Subject: The topic of the email
Date: When the email was sent
Reply-To: Where your reply goes, if it's different from the From address

Full Headers

The full headers are simply more technical information than what you normally see when you check your email. Sometimes we need those extra headers to solve a problem.

A full header includes:

Received: each mail server the email passed through, with timestamps and IP addresses. Read these lines from the bottom up to follow the email's path.
Return-Path: where bounce messages (undeliverable notices) are sent
Message-ID: a unique ID for that specific email
Authentication-Results: the results of SPF, DKIM, and DMARC checks, which show whether the email really came from the domain it claims to be from
Spam scores or filter tags: notes added by spam filters explaining how the email was rated

The article below will guide you in accessing the full headers for whichever mail program you use:

How to View Email Headers in Webmail

How can we help you? Please contact us via phone or chat if you need assistance.

Did you find this article helpful?