Re: Tracking source of outbound SMTP messages

[Scott Klement <klemscot@xxxxxxxxxxxx>]

When e-mail travels through the internet, every SMTP server that handles
it should be adding a Received: header to the top of the message.   In
that header should be the address of the computer that it received the
message from, and it usually also contains the date & time and misc other
information.

For example, your message (which  I'm replying to) contained this:

Received: from main (162-32.9-67.se.rr.com [67.9.32.162])
        by ms-smtp-03.tampabay.rr.com (8.12.5/8.12.5) with SMTP id 
h4ELtqSB024144
        for <midrange-l@xxxxxxxxxxxx>; Wed, 14 May 2003 17:55:52 -0400 (EDT)

I don't run my e-mail on an iSeries system.  But, since that received:
header is a standard, it should exist everywhere.  Just look at the
messages, you should be able to see where it received it from.

Otherwise, I know that sendmail on my FreeBSD box creates logs that also
contain info about where the message came from and where it went to.  I
would assume that the iSeries SMTP server MUST have something similar
(unless it's just intended to be a toy) and you should be able to find the
info there as well.

On Wed, 14 May 2003, Douglas Handy wrote:
>
> Unless I'm mistaken, that appears to be the address of the destination, not 
> the
> sender.  The addresses I'm seeing are outside the LAN, and resolve to the 
> domain
> of a name in another journal entry close to the one with LIN TO SRVR.
>
> I'm looking for which machine(s) sent the emails, not where they are going.  
> But
> this may provide a hint if nothing else, if they can recognize who might have
> these names in an address book.
>
> I'll keep looking at more journal entries.
>