Received: fromlines such as the following:
Received: from cluster1.echolabs.net ([220.127.116.11]) by BAY0-MC3-F24.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900); Fri, 17 Feb 2012 17:38:51 -0800 Received: from [10.0.8.1] (HELO MX02.MAIL.ECHOLABS.NET) by smtp01.cluster1.echolabs.net (CommuniGate Pro SMTP 5.4.1) with ESMTP id 12878498 for email@example.com; Fri, 17 Feb 2012 20:38:51 -0500 Received: from a.example.com ([10.42.13.242]) by MX02.MAIL.ECHOLABS.NET with Echo Labs id bDep1i00D5Fw2Hk01Dep2f; Fri, 17 Feb 2012 20:38:50 -0500
In the case above the initial sending server would be a.example.com at
IP address 10.42.13.242 as that is the last
line. The top
Received: from line shows the last email server that
received the email message, which is
BAY0-MC3-F24.Bay0.hotmail.com. There may be any number of
intermediate systems processing the email message between the sender and
receiver. E.g., a message might go through an intermediate server that scans
the message for viruses or to determine if it is spam.
You can also view the message headers while the message is open by
clicking on the downward pointing arrow head next to
at the top right side of the message and selecting
View Message Source as shown below.