What can an IP address in an email header actually represent?¶
title: "What can an IP address in an email header actually represent?" card_id: "IP-111" status: "complete" source_document: "https://docs.google.com/document/d/1TEzqUKkCGqhxIe1oPdNH_m1HPG9AFL4W7gGbjzJ6LLs/edit?usp=drivesdk"
What can an IP address in an email header actually represent?¶
An email header can contain several IP addresses. None is automatically “the sender’s IP”.
As an email travels, mail systems add `Received` header lines describing the servers that handled it. One address may belong to the sending organisation’s mail server, another to a filtering service, and another to the recipient’s provider. These are delivery hops, not necessarily the sender’s device or internet connection.
Read the route in context. `Received` lines are normally added at the top, so the earliest part of the apparent journey is lower down the header. But don’t rely on order alone. Lines created before a message reached a trusted mail system can be forged. The useful question is which system added each line and whether that system can be trusted to report the connection it received.
Some services insert fields such as `X-Originating-IP`, but their meaning depends on the provider and configuration. A value might represent the customer’s connection, an internal system or information supplied by software. It needs verification.
Webmail changes the picture. A user may connect to a web platform, and the platform then sends the email through its own servers. The normal mail-delivery header may show the provider’s infrastructure while the user’s login address is held separately in account or security logs.
VPNs, proxies, mobile networks, workplace connections and shared Wi-Fi can also affect any customer address that is recorded. Even a genuine originating public IP identifies a connection or intermediary at a time, not automatically the author of the message.
Preserve the complete original message with its full headers in a format that retains the raw data. A screenshot or pasted excerpt can remove lines, folding and metadata needed to understand the route. Compare message identifiers, timestamps and provider records before grouping messages together.
The defensible conclusion might be that an address was recorded as a mail-server hop, or that a provider recorded it when an account accessed webmail. State which system observed it and in what role. The mere presence of an IP address in a header doesn’t prove where the author was or who wrote the email.