Tracing an Email

Yesterday I posted an article about tracing an hacker. today I give you one about tracing an email. The first thing you have to do is to enable email headers. The site shows you how to do so using Gmail, yahoo and msn. All desktop clients should support this feature as well. Email Headers show you additional information about the email, for example the first server that received the email from the sender or IP addresses.

After configuring your mail software to display those email headers the site explains important headers in detail.This is necessary to understand how to use them to trace an email message back to its original sender. Finally the last part of the article shows you how to trace the sender looking for the senders ip. Its again only helpful if the email was not send using cracked servers or an anonymous mailer.

Update: You can enable all email headers in Mozilla Thunderbird the following way: Click on View > Headers > All. This should enable detailed headers that you can use to analyze where the email is coming from.

Once you have configured email headers, you need a basic understanding of what you should be looking for to use them effectively. What you basically need to understand is that the sender of an email is not sending it directly to you. The email instead is first send to the sender’s email provider from where it is usually send through a number of servers before it reaches your email provider’s server from where you can retrieve it in your email client.

To find the sender’s IP address, you need to look for the header X-Originating-IP. If that header is not displayed, you need to look at the first received server to find the IP address of the sender. Keep in mind that the IP can still be fake, e.g. if a proxy was used.

Related Articles:

Author: Martin Brinkmann, Saturday January 21, 2006 -
Tags:Email, emails tracking, tracing emails