Can identify that an idevice was used in email headers?

patent10021

macrumors 68030
Original poster
Apr 23, 2004
2,927
402
Can the desktop OSX mail headers show that a device and not PC was used?

Or can I only compare IPs to determine that it's the same device or PC I've been contacted with previously etc.
 

emir

macrumors 6502a
Apr 5, 2008
610
4
Istanbul
I am not being a 100% sure but I don't think there are ways to tell which device the mail was sent from, unless the sender ended the mail with a sort of "Sent from my iPhone" thing.

p.s. Remember when "Sent from my iPhone" signatures on e-mails were thought of as being rude? haha.
 

Weaselboy

Moderator
Staff member
Jan 23, 2005
29,306
8,950
California
Can the desktop OSX mail headers show that a device and not PC was used?

Or can I only compare IPs to determine that it's the same device or PC I've been contacted with previously etc.
Code:
X-Mailer: Microsoft Outlook Express 6.00.2900.5931
Look at this header to see what client was used and that should give you a clue what device was used.
 

patent10021

macrumors 68030
Original poster
Apr 23, 2004
2,927
402
Code:
X-Mailer: Microsoft Outlook Express 6.00.2900.5931
Look at this header to see what client was used and that should give you a clue what device was used.
That's the obvious but I'm looking at a gmail header that seems to be encrypted.


Received: by 10.112.199.66 with SMTP id ji2csp5342lbc; Wed, 26 Mar 2014 18:49:36 -0700 (PDT)
Received: by 10.58.137.229 with HTTP; Wed, 26 Mar 2014 18:49:35 -0700 (PDT)
Return-Path: <xxx@gmail.com>
Received-Spf: pass (google.com: domain of xxx@gmail.com designates 10.58.154.10 as permitted sender) client-ip=10.58.154.10
Authentication-Results: mr.google.com; spf=pass (google.com: domain of xxx@gmail.com designates 10.58.154.10 as permitted sender) smtp.mail=xxx@gmail.com; dkim=pass header.i=@gmail.com
X-Received: from mr.google.com ([10.58.154.10]) by 10.58.154.10 with SMTP id vk10mr63162607veb.18.1395884975137 (num_hops = 1); Wed, 26 Mar 2014 18:49:35 -0700 (PDT)
X-Received: by 10.58.154.10 with SMTP id vk10mr63162607veb.18.1395884975133; Wed, 26 Mar 2014 18:49:35 -0700 (PDT)
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=FhWiCIrYJedqYkjfS+o+5XdQRuaao0xv4WnrANI5Q4k=; b=z9budi0lhhvct5wVlGsV51OqizTbV5sSj0qPehEsFXU0LkGZKKp64JlQ8NGLPSYchS mfreY7SK2baxbIFtz8zB7DdTXDMePkhDHCBhlO62C+AVA5mu48ZRu5j0kUF/N74YlHzl vj7CK72GvvOo/eq9U0mD67R+8wl2+fesIqRvnjYYLH0iTbXj8D9BbKXM0n57MPl+pbLh ZYrKhykGQhO+cxfQbCuLWvYgQtw3+NVbHMGR5Bn1zvU+83N4F25uLg9+gVXLditsd8hP /sg32IbGbttPCVKHYnqMoF7/D1Hvyp88KKZXc8K9wM1VwDW86YIBLUOHyuWo7Uw5962h /Bjg==
Mime-Version: 1.0
In-Reply-To: <CAKJZnhzGQimCj9DCWLcxnYG38D+KNtq6ihDwiiYrEv0=do4URQ@mail.gmail.com>
References: <B0C8C63A-A2B1-4C8D-86CB-BBF0F6DBCFA2@gmail.com> <CAKJZnhzGQimCj9DCWLcxnYG38D+KNtq6ihDwiiYrEv0=do4URQ@mail.gmail.com>
Message-Id: <CAKJZnhw-+DzWyv1A72RwhFVzJ4ZXX17Ree19g0SGsj4zo37NQQ@mail.gmail.com>
Content-Type: multipart/alternative; boundary=047d7b5d84ef17194804f58ccc0a
Re:
But...iDevice IPs usually look like 10.xx.xxx.xx right? A normal IP from any country would always start with some larger number like 174, 139 etc.
 

ElectronGuru

macrumors 65816
Sep 5, 2013
1,493
363
Oregon, USA
There are few standards for email header lines, often it's what a given link in the chain volunteers to add as it passes by. If there isn't an x mailer line, you likely won't find it.

But how you view the headers is also important. Web viewers are stingy or confusing, best to use a real mail app first.
 

Weaselboy

Moderator
Staff member
Jan 23, 2005
29,306
8,950
California
But...iDevice IPs usually look like 10.xx.xxx.xx right? A normal IP from any country would always start with some larger number like 174, 139 etc.
It is not necessarily an iOS device at 10.xx, but just a locally assigned IP address. Your "real" IP address would be 174.xx like you said, then that goes to a local router that hands out those 10.xx series addresses to any device in the house.
 

Dark Dragoon

macrumors 6502a
Jul 28, 2006
843
3
UK
But...iDevice IPs usually look like 10.xx.xxx.xx right?
No.

The private IP address ranges which can be used on internal networks are:-
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

If you are looking at an IP address in one of those ranges then it is simply an IP address from an internal network.
These addresses can be used by anything and because they are private ranges are not unique.


A normal IP from any country would always start with some larger number like 174, 139 etc.
No.

Normal IP address can be almost (there are some other ranges which aren't used, and some special ones like 127.0.0.1) any other address, there isn't really any reason that you wouldn't see someone using an address starting with a low number. You can see who owns what at: http://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks


But regardless an IP address on its own will not tell you what device or kind or device was used to send an email.
 

patent10021

macrumors 68030
Original poster
Apr 23, 2004
2,927
402
ok so we have determined that there is no way to tell if someone is using a desktop or iOS device in the headers. Too bad.

Thanks