When a user sends an email from Yahoo, it shows up in the header as
Delivered-To
Received by 10.78.14.19 with SMTP id 19cs101316hun;
Fri, 5 Jan 2007 084845 -0800 (PST)
Received by 10.70.113.13 with SMTP id l13mr43527056wxc.1168015724560;
Fri, 05 Jan 2007 084844 -0800 (PST)
Return-Path <email address>
Received from web30711.mail.mud.yahoo.com (web30711.mail.mud.yahoo.com [68.142.201.249])
by mx.google.com with SMTP id h8si32347943wxd.2007.01.05.08.48.43;
Fri, 05 Jan 2007 084844 -0800 (PST)
Received-SPF pass (google.com domain of user@yahoo.com designates 68.142.201.249 as permitted sender)
DomainKey-Status good (test mode)
Received (qmail 42990 invoked by uid 60001); 5 Jan 2007 164843 -0000
DomainKey-Signature a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
Is there a way to tell WHAT the connected IP was to Yahoo? I'm trying to determine if this was sent from a job, or a home.
Thanks!
John
I found it. The last Received from shows the users IP that they connected from. This was sent from home. Thanks!
What about "X-Originating-IP"?
The header from Yahoo didn't show X-Originating-IP, only the last Received from had the ip address.
Thanks!