OS X Mail 10.3 - Locating the source of an e-mail

Aim of this article:

This article provides a guide to viewing e-mail message headers in OS X Mail 10.3, and locating the source of an e-mail.

Why would I need to do this?

If you have received unsolicited e-mail you may wish to report it to the ISP who hosts the sending machine, so they may take action to prevent further abuse.

You may also need to provide the message headers to Technical Support so as to help with diagnosing problems you may be experiencing with e-mail.

Locating the message headers:

Open OS X Mail, by clicking Go -> Applications -> OS X Mail.

Select the message from those listed in your Inbox by clicking it. From the program menu select  View -> Message -> Long Headers.

The body of the e-mail will now change to include the headers of that e-mail, see the example below:

These are the message headers, and can be copied from this section and passed elsewhere if required.

Note: E-mail addresses have been masked in the above image.  The black blocks would not appear in your message headers.

The part of the headers which identify the source are shown above.

This shows the logical chain of servers and hosts involved in the transfer of the e-mail. 

The first host is always listed on the same line as the last Received: heading.

A simplified version of this chain would be as follows:

212.23.9.64 -> heisenberg.zen.co.uk -> feynman.zen.co.uk

We would be interested in the IP: 212.23.9.64, as it is the verified source of the message.

If the IP listed on the last Received: line is a private IP, then the next Received: line above that should be examined to determine the IP which has passed the e-mail to the Internet.

Further reading:

See the link in Related Articles for details on identifying who is responsible for hosts on particular IP addresses.