Where is email hosted

What is an email header?

Forward article
E-mail was sent successfully.
Edit article
Print preview
FAQ # 1366

An email consists of Headers and the actual content of the Message (body). The sending process of an email can be traced with the header. It forms the letterhead, from which you can find the following information:

  • the sender
  • the recipient
  • the date
  • the subject

the servers that were involved in the transmission from sender to recipient

Most e-mail programs do not display the headers at all or only in excerpts in the standard configuration. How to view the header in various e-mail programs and webmail services can be found here.

Content:
How can I view the header in email programs?
How can I view the header in the webmail service?
How do I find out the actual sender of an email?

 

 

How can I view the header in email programs?

 Thunderbird (and other Mozilla clients)
Open the email, click the button on the right More and then select the action from the menu Show source text.

Outlook 365 and 2010/2013/2016
Open the email with a double click and click on in the menu file > properties. Now navigate to the area Internet headers.

 

Apple Mail (on Mac)
Open the email and press the keys on the keyboard at the same time Shift + cmd + H (⇧ + ⌘ + H).

 

How can I view the header in the webmail service?

Gmail
Open the email and click on the right Drop down menu (Down arrow, next to the date and the answer button). Choose in the next selection originalShow. Another window opens with all header lines (under the button Download the original message).

STRATO webmail
Open e-mail and on the right the Menu icon click with the three horizontal lines. Select the option in the following menu Show source data.

Web.de / GMX Mail
Open the email and right click on the Info symbol (i). A window with the header information opens.

Outlook Web App (new version)
Open e-mail and click the in the top right corner Down arrow button Click (v, to the right of "Reply"). Please select the option in the context menu View news source choose.

Outlook Web App (old version)
Open e-mail and click on the in the top right corner Menu icon with the three dots [...] click. Please select the option in the context menu View message details choose.


How do I find out the actual sender of an email?

The actual sender of an email can be found out from the header information.

You should get the bottom one Received block look at that not localhost includes. The sending server (from) is i. d. R. the originator of the spam, the receiving server (by) the misused email server of a provider.

Also note that resourceful spammers intentionally receive their own: - Insert lines and falsify sender addresses.

Important
If your e-mail account is forwarded to multiple Received: lines, not every line shows who the sender is, but only which e-mail server was used to send the e-mail.

example:
Your email address is: [email protected] However, you can forward this e-mailbox to another e-mail account (e.g. [email protected]). for example, the full header of this email is:

X-Envelope-From:
X-Envelope-To: [email protected]
X delivery time: 1064940906

(1) Received:
from mail.sul.freenet.de ([123.456.78.9]) by smtp.strato.de .....; Wed, Sep 3, 2003 12:22:50 PM +0200 (MEST)
(2) Received:
from pop3.strato.de ([987.65.4.32]) by fwd10.egal.spam.abc with Microsoft SMTPSVC (5.0.2258.6454); Wed, Sep 3, 2003 12:12:22 PM +0200
(3) Received:
from mailout.de.bone.net (mailout.de.bone.net [111.222.333.4]) by fwd10.egal.spam.abc with smtp id 1A4-0p80; Tue, Sep 2, 2003 18:58:36 +0200
Message ID: <.........>
From: [email protected]
To:

The “Received” lines have the following meaning:

(1) Received: indicates that the e-mail came from "smtp.strato.de" and was delivered to "mail.sul.freenet.de".


(2) Received: means that the e-mail from "fwd10.egal.spam.abc" was delivered to "pop3.strato.de".


(3) Received: means that the e-mail was sent from a computer with the name "mailout.de.bone.net" via "fwd10.egal.spam.abc".


Please note that it is not the names that provide information about the original spam sender, as these can also be falsified, but rather the IP number in square brackets (mailout.de.bone.net [111.222.333.4]). Using this number, you can use the Ripe database to find the actual server from which the e-mail was sent.
 
All other information provides information about the time, the IP addresses and various other information.

With the help of this header you can see that someone with the sender address "[email protected]" has sent an email to your email address "yourname @ desired name" via the email server "fwd10.egal.spam.abc". de "has sent. This was also correctly delivered to the STRATO mail server (pop3.strato.de).

However, since a forwarder has been configured, our e-mail server (pop3.strato.de) has correctly sent this e-mail to the Freenet server (mail.sul.freenet.de) and accordingly your forwarder address (name @ freenet .de) forwarded.

tip:
Further information can be found e.g. https://abuse.net/ or https://de.wikipedia.org/wiki/Header_(E-Mail). These provide information about the true origin.

When you have found out which server the email was sent from, you can send an email to postmaster @ and abuse @. Compose this email in English and attach the spam email with all headers.


 

The actual sender of an email can be found out from the header information.

You should look at the bottom "Received block" that does not contain "localhost". The sending server (from) is i. d. Usually the originator of the spam, the receiving server (by) the misused email server of a provider.

Also note that resourceful spammers intentionally insert their own "received:" lines and forge sender addresses.

Important
If your e-mail account has been forwarded to several "Received:" lines, not every one gives information about who the sender is, but only about which e-mail server the e-mail was sent via.

Example:
Your email address is: "[email protected]". However, you can forward this e-mailbox to another e-mail account (e.g. [email protected]). for example, the full header of this email is:

X-Envelope-From:
X-Envelope-To: [email protected]
X delivery time: 1064940906

(1) Received:
from mail.sul.freenet.de ([123.456.78.9]) by smtp.strato.de .....; Wed, Sep 3, 2003 12:22:50 PM +0200 (MEST)
(2) Received:
from pop3.strato.de ([987.65.4.32]) by fwd10.egal.spam.abc with Microsoft SMTPSVC (5.0.2258.6454); Wed, Sep 3 2003 12:12:22 +0200
(3) Received:
from mailout.de.bone.net (mailout.de.bone.net [111.222.333.4]) by fwd10.egal.spam.abc with smtp id 1A4-0p80; Tue, Sep 2, 2003 18:58:36 +0200
Message ID: <.........>
From: [email protected]
To:

The “Received” lines have the following meaning:

(1) Received: indicates that the email came from "smtp.strato.de" and was delivered to "mail.sul.freenet.de".


(2) Received: means that the email was delivered from "fwd10.egal.spam.abc" to "pop3.strato.de".


(3) Received: means that the email was sent from a computer with the name "mailout.de.bone.net" via "fwd10.egal.spam.abc".


Note: Please note that it is not the names that provide information about the original "spam sender", as these can also be falsified, but rather the IP number in square brackets (mailout.de.bone.net [111.222.333.4 ]). Using this number, you can use the Ripe database to find the actual server from which the e-mail was sent.
 
All other information provides information about the time, the IP addresses and various other information.

With the help of this header you can see that someone with the sender address "[email protected]" has sent an email to your email address "yourname @ desired name" via the email server "fwd10.egal.spam.abc". de "has sent. This was also correctly delivered to the STRATO mail server (pop3.strato.de).

However, since a forwarder has been configured, our e-mail server (pop3.strato.de) has correctly sent this e-mail to the Freenet server (mail.sul.freenet.de) and accordingly your forwarder address (name @ freenet .de) forwarded.

Tip:
Further information can be found e.g. https://abuse.net/ or https://de.wikipedia.org/wiki/Header_(E-Mail). These provide information about the true origin.

When you have found out which server the email was sent from, you can send an email to "postmaster @" and "abuse @". Compose this email in English and attach the spam email with all headers.




Was this text helpful to you?