tracking the e-mail sender

Question

Recently one of my friend facing a problem form an unknown person who is sending false and insulting e-mails to the office staff of my friend. Who ever that person might be some one who is in the company or someone who has worked in my friends' company before. Because that person has the e-mail addresses of most of the company staff. My friend asked me whether I can track that person. I have tried to trace the mails he has sent over the time but It was not success. And the other case is this person changes the e-mail address frequently. Sometime he uses a gmail address and sometime a yahoo address. What should be the better thing to track this person. Is it possible to track him by his e-mails?

Answer 1

The "From" address in email is easily forged. The header in an email message which is hardest to forge is the first "Received:" header. That should contain an IP address and a domain name; it's even possible to fake the domain name, but very hard to fake the IP address. If you do a reverse DNS lookup on that IP address, you'll find where it was sent from. It may then be possible to contact the provider that owns that domain and get them to take some kind of action.

Sometimes, though, the message is relayed through an obscure site in North Elbonia, in which case you have to look at the chain of Received headers and decide if they look trustworthy. The last site the message went through can put anything it wants there if it's not trustworthy.

Tracing harassing email can be very difficult, but it's also common for the people who send them to slip up stupidly and be easy to catch. Collecting as many of the messages as possible may help.