How do you track an email which has already been received by us?

Question

Is it possible to track an email sent to me already? I want to track the IP address of the person who sent me the email using the email just sent. Is it possible, or is email anonymous?

Answer 1

Email-headers contain all of this information.

However, email is an unsecure medium, as the sender can have next to full permission to modify these headers as they see fit. For example, it is very easy to modify the From: field to whatever you like. This is also one of the reasons spam filters are so strict. (The emails in your spam folder are but a small percentage of the actual spam sent to you)

It is also quite easy to change these headers on a relay server. Think of the relay servers as a chain, with the sender in one end and you in the other. In each of the links, the headers may be modified. For more information on this, click here. (Or do a search for mail-headers)

This again means that although you might be able to find an IP in the mail-headers, you can't be 100% sure that's the real location. Finding the mail-headers is different for different types of mail clients. If you use one of the most popular clients, you can probably find it using Google's How-To.

When you have the headers, here's an explanation on how to decipher them, if need be.

Answer 2

If someone sends you an email, you can access its headers to see where the email has been.

Although the client of the sender can try and change the header information, as soon as the email leaves his client, all following servers will add their ip address by adding a :Received-by: [hostname] ip-address.

Given that the person responsible for sending the spam is usually the last ip address, known spammers often add a fake Received-by entry in the header which does not resolve or resolve to a different person. Common sense is required to figure out which ip address belongs to the sender of the person who sent the email.

Here is an example of headers from an email:

Return-Path: <[e-mail]>
Envelope-to: <[e-mail]>
Delivery-date: Sat, 30 May 2015 15:28:16 +0200

Received: from #undisclosed hostname# ([11.11.11.11]:11626) by #undisclosed hostname from me# with esmtps (TLSv1.2:AES128-GCM-SHA256:128) (Exim 4.85) (envelope-from <[e-mail]>) id 1YygoB-003zZd-OL for [e-mail]>; Sat, 30 May 2015 15:28:16 +0200

received: from wwinf1j26 ([10.232.42.100]) by mwinf5d35 with ME id QKJl1q00U29gEru03KJla8; 
Tue, 05 May 2015 21:18:45 +0200

The above line is a fake Received-by entry added by a spammer. You can see the from are some random names, the by is not my name and the ip address is not an internet address

more headers that are not relevant to this example.