Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question already has an answer here:

Is there anyway I can trace the sender profile through email headers?

We have received spam emails as undeliverable sent from our mail id. We would like to find out where they are originating from

Thank you

share|improve this question

marked as duplicate by Scott, Tog, Kevin Panko, David, Shakehar Feb 9 at 1:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
The header contains this information but is mostly useless to be honest except if you want to blacklist the server –  Ramhound Feb 4 at 23:09
    
Very often the "from" headers on spam are fake. The "received" headers can also be faked. The emails can also be sent out from an ever changing array of bots (infected computers) through the victims personal or corporate email server. –  John1024 Feb 4 at 23:26
    
@John1024 - I don't agree that the headers can be faked. While you can claim its from X the actual headers will contain who its actually from. Of course as you point out, even blocking the actual sender, is sort of useless because they have endless supplies of victims and these really bad people send email on their behalf –  Ramhound Feb 4 at 23:59
    
@Ramhound While the newest "received" headers will be genuine, the oldest received headers are readily faked. You can read more about it here and here –  John1024 Feb 5 at 0:08
    
@Ramhound The problem is that you don't know where the fake headers end and the genuine ones begin, which is what you need to know to identify the source of the spam. It can require significant expertise. –  David Schwartz Feb 5 at 0:25

1 Answer 1

Your ability to do this is limited by the amount of time you would like to invest and the cooperative spirit of server administrators.

Frankly, you cannot trust any email header that appears in the message headers regarding the delivery route that is beyond a server that you control. For most people, this means that you can only trust that your server received it from the server that it identifies by address and name.

To determine whether or not this is the actual source, you would have to contact the owner of that system that most immediately delivered the mail to your server with the relevant time and information about that message from your mail delivery logs. Using that information, if he is so willing, he can extract data from his server log to tell you which server gave it to him. You probably begin to see the issue here.

If he is unwilling, that is no indication that his server was the origin of the spam. However, if he is unwilling, your trail also immediately turns cold.

Hope this helps!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.