Received: from lines such as the following:
Received: from cluster1.echolabs.net ([38.111.141.31]) by BAY0-MC3-F24.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Fri, 17 Feb 2012 17:38:51 -0800
Received: from [10.0.8.1] (HELO MX02.MAIL.ECHOLABS.NET)
by smtp01.cluster1.echolabs.net (CommuniGate Pro SMTP 5.4.1)
with ESMTP id 12878498 for someonesemail@hotmail.com; Fri, 17 Feb 2012 20:38:51 -0500
Received: from a.example.com ([10.42.13.242])
by MX02.MAIL.ECHOLABS.NET with Echo Labs
id bDep1i00D5Fw2Hk01Dep2f; Fri, 17 Feb 2012 20:38:50 -0500
In the case above the initial sending server would be a.example.com at
IP address 10.42.13.242 as that is the last Received: from
line. The top Received: from line shows the last email server that
received the email message, which is
BAY0-MC3-F24.Bay0.hotmail.com. There may be any number of
intermediate systems processing the email message between the sender and
receiver. E.g., a message might go through an intermediate server that scans
the message for viruses or to determine if it is spam.
You can also view the message headers while the message is open by
clicking on the downward pointing arrow head next to Reply
at the top right side of the message and selecting
View Message Source as shown below.
