Hide sender IP address

sleepycat · 18 Feb 2017, 09:20 AM

Is it possible to hide sender IP address so that it doesn't show up in mail header?

I kept meaning to find a solution to this, but was too lazy to deal with it and use VPN instead to mask it.

Basically, I don't really want my mail recipients to know my IP address, especially when I travel.

I just tested it. If I send email directly using web interface, it doesn't show my IP. But if I send it use Thunderbird, it does. Oddly enough, if I send using Fastmail app on Android phone, it doesn't show IP either.

Wonder if it's something that's configurable on my end.

BritTim · 18 Feb 2017, 10:26 AM

If your email client adds headers that include your IP address (most do) then FastMail will not remove those headers. I also dislike the privacy implications, and this is one reason I generally stick to the web interface. IMHO, Thunderbird (while a good email client) has few advantages over FastMail's own interface, except offline access.

n5bb · 18 Feb 2017, 11:05 AM

Welcome to the EMD Forums!

Email started with a very simple system where you could actually log into a receiving mail server manually and type the message directly into the server. In order to allow troubleshooting and discover the source of early spam, the system evolved to the current system made up of several agents:

Email user client: The user enters the message into the email system using a client. The client then connects to a MTA (message transfer agent) and sends the message using SMTP protocol on a submittal port.
The MTA logs the IP address of the client and places this in the message headers. Early MTA's didn't need authentication (username and password) or a secure connection. So the IP address was important for maintaining a small degree of system security.
Each subsequent transfer of the message over the public internet also causes the IP address of the sending agent (MTA) to be logged into the headers.
Webmail changed this relationship. All users had to supply a username and password, and nearly all systems eventually required use of a secure connection. So now you weren't really creating the message locally on a client, but we're creating it using a web connection directly at the server. So the IP address which is logged into the headers is now the address of the MTA, not the end user.
The FastMail app for iOS or Android devices is just a modified version of the webmail system. It's supplied by FastMail and requires your master password so it's easier to trust.
Each message has a Message-Id header. This is a unique identifier which is different for each message, and among other uses allows email loops to be detected. The Message-Id is assigned by the submittal agent. In the case of an email client, the client generates this ID, while with webmail it is generated by the webmail server. So, in general, the first IP address you will see in the headers is the agent which generated the Message-Id.
No, you can't change this behavior. Use webmail or the FastMail iOS/Android app if you don't want the recipient to be able to track your IP. FastMail logs your IP internally, as they have to be able to discover the source if you do something against their terms of service, but they don't put your IP in the headers unless you use a conventional email client.

Bill

TheJapanese · 18 Feb 2017, 01:17 PM

Quote:

Originally Posted by BritTim

If your email client adds headers that include your IP address (most do) then FastMail will not remove those headers. ...

Hi,

you're wrong.

Fastmail does strip the IP. You have to use another port.

http://www.emaildiscussions.com/showthread.php?t=70204

n5bb · 18 Feb 2017, 02:23 PM

Thanks for finding that! I just tested this and here is what I found:

If you can set the SMTP port to port 565 in your email client, both the IP address and User-Agent headers are not inserted in the headers.

Some clients may not allow that port to be used. I just checked and it works great in Thunderbird.

Bill

TheJapanese · 18 Feb 2017, 08:31 PM

iOS Mail and OS X Mail.app also work.

sleepycat · 19 Feb 2017, 01:29 AM

Sweeeeet! Thank you both!

Jacinto · 23 Feb 2017, 09:56 PM

Hello.

Noticed that when using Port 565, the "IP =" part of the "X-Spam-source:" header is now the localhost ("IP='127.0.0.1'"), rather than the IP address of the submitting MUA.

I have my own SMTP servers on two micro VPS instances with proper and clean (not listed in any of the Spam rating services) forward and reverse dns records and seldom use Fastmail for sending mail.

I'm tempted to start using FM for outgoing mail as well. The only problem would be that, by carefully managing my own servers, it is unlikely that I would ever be listed as a source of Spam. Because Fastmail is a shared service, I would no longer control my own destiny and could have my mail rejected for Spam when one or more of FM's IP addresses becomes compromised. Of course, all E-Mail hosts experience this problem. Some deal with it better than others. I believe, but don't know from my own experience, that FM does a good job.

At least now I can use FM when the VPS host is down (once in a blue moon) and for sending from K-9 Mail with my Android phone.

--
Jacinto

DumbGuy · 24 Feb 2017, 11:45 AM

Thank you much for the port-565 tip! (And thank you, FM, for this handy little feature).

I just tested in Outlook and it seems to work.

Side-question: While adjusting my client settings, I tried TLS, but it didn't connect. So, back to the SSL option, which worked fine. Why not TLS on these connections? I thought TLS was superior to SSL.

n5bb · 24 Feb 2017, 11:50 AM

Quote:

Originally Posted by DumbGuy

...Side-question: While adjusting my client settings, I tried TLS, but it didn't connect. So, back to the SSL option, which worked fine. Why not TLS on these connections? I thought TLS was superior to SSL.

You will get a headache trying to keep track of how SSL, TLS, and STARTTLS and various ports have been used by clients and email systems:
https://www.fastmail.com/help/techni...sstarttls.html

Bill

sleepycat · 24 Feb 2017, 12:14 PM

I wholeheartedly agree. The thing about SSL/TLS version number is a mess..

Sometimes it's better not to know how the sausage is made

About Jacinto's point of IP gets blacklisted, there is also a flipside.
I'd imagine FM has more resource to deal with ISP's to get IPs unblocked than you do time/patience for.

BritTim · 24 Feb 2017, 12:38 PM

Quote:

Originally Posted by sleepycat

I wholeheartedly agree. The thing about SSL/TLS version number is a mess..

Sometimes it's better not to know how the sausage is made

About Jacinto's point of IP gets blacklisted, there is also a flipside.
I'd imagine FM has more resource to deal with ISP's to get IPs unblocked than you do time/patience for.

Further, FastMail has a standard procedure in place to monitor the important blacklists and change any IP address that appears on a blacklist.

DumbGuy · 24 Feb 2017, 01:48 PM

Quote:

Originally Posted by sleepycat

Sometimes it's better not to know how the sausage is made

Ahh, that gave me a good laugh, thank you.

And thank you, Bill, for the link. (My bad for not doing my own homework beforehand.) Kudos to FM for detailing the SSL/TLS history there.

Jacinto · 24 Feb 2017, 08:29 PM

Quote:

Originally Posted by sleepycat

. . .

About Jacinto's point of IP gets blacklisted, there is also a flipside.
I'd imagine FM has more resource to deal with ISP's to get IPs unblocked than you do time/patience for.

Quote:

Originally Posted by BritTim

Further, FastMail has a standard procedure in place to monitor the important blacklists and change any IP address that appears on a blacklist.

Both are good and true observations.

From experience, I've learned that you can't run a mail server with the "popular" ($5.00 a month or less with millions of subscribers) VPS hosts such as AWS, Digital Ocean, Vultur, etc. They either can't or won't help when blocks of their IP addresses are blacklisted.

I now run my VPS instances with a small host where the owner is active in day to day operations. I've been lucky in that my IP addresses with this host have never been blacklisted.

Hopefully, my luck won't run out for a while longer.

--
Jacinto

digp · 13 Oct 2023, 10:08 PM

Quote:

Originally Posted by n5bb

Thanks for finding that! I just tested this and here is what I found:

If you can set the SMTP port to port 565 in your email client, both the IP address and User-Agent headers are not inserted in the headers.

Some clients may not allow that port to be used. I just checked and it works great in Thunderbird.

Bill

Does not work any more?

18 Feb 2017, 09:20 AM	#1
sleepycat Junior Member Join Date: Feb 2017 Posts: 6	Hide sender IP address Is it possible to hide sender IP address so that it doesn't show up in mail header? I kept meaning to find a solution to this, but was too lazy to deal with it and use VPN instead to mask it. Basically, I don't really want my mail recipients to know my IP address, especially when I travel. I just tested it. If I send email directly using web interface, it doesn't show my IP. But if I send it use Thunderbird, it does. Oddly enough, if I send using Fastmail app on Android phone, it doesn't show IP either. Wonder if it's something that's configurable on my end.

18 Feb 2017, 11:05 AM	#3
n5bb Intergalactic Postmaster Join Date: May 2004 Location: Irving, Texas Posts: 8,926	Welcome to the EMD Forums! Email started with a very simple system where you could actually log into a receiving mail server manually and type the message directly into the server. In order to allow troubleshooting and discover the source of early spam, the system evolved to the current system made up of several agents: Email user client: The user enters the message into the email system using a client. The client then connects to a MTA (message transfer agent) and sends the message using SMTP protocol on a submittal port. The MTA logs the IP address of the client and places this in the message headers. Early MTA's didn't need authentication (username and password) or a secure connection. So the IP address was important for maintaining a small degree of system security. Each subsequent transfer of the message over the public internet also causes the IP address of the sending agent (MTA) to be logged into the headers. Webmail changed this relationship. All users had to supply a username and password, and nearly all systems eventually required use of a secure connection. So now you weren't really creating the message locally on a client, but we're creating it using a web connection directly at the server. So the IP address which is logged into the headers is now the address of the MTA, not the end user. The FastMail app for iOS or Android devices is just a modified version of the webmail system. It's supplied by FastMail and requires your master password so it's easier to trust. Each message has a Message-Id header. This is a unique identifier which is different for each message, and among other uses allows email loops to be detected. The Message-Id is assigned by the submittal agent. In the case of an email client, the client generates this ID, while with webmail it is generated by the webmail server. So, in general, the first IP address you will see in the headers is the agent which generated the Message-Id. No, you can't change this behavior. Use webmail or the FastMail iOS/Android app if you don't want the recipient to be able to track your IP. FastMail logs your IP internally, as they have to be able to discover the source if you do something against their terms of service, but they don't put your IP in the headers unless you use a conventional email client. Bill

18 Feb 2017, 10:26 AM	#2
BritTim The "e" in e-mail Join Date: May 2003 Location: mostly in Thailand Posts: 3,090	If your email client adds headers that include your IP address (most do) then FastMail will not remove those headers. I also dislike the privacy implications, and this is one reason I generally stick to the web interface. IMHO, Thunderbird (while a good email client) has few advantages over FastMail's own interface, except offline access.

18 Feb 2017, 02:23 PM	#5
n5bb Intergalactic Postmaster Join Date: May 2004 Location: Irving, Texas Posts: 8,926	Thanks for finding that! I just tested this and here is what I found: If you can set the SMTP port to port 565 in your email client, both the IP address and User-Agent headers are not inserted in the headers. Some clients may not allow that port to be used. I just checked and it works great in Thunderbird. Bill

18 Feb 2017, 08:31 PM	#6
TheJapanese Member Join Date: Apr 2016 Posts: 79	iOS Mail and OS X Mail.app also work.

19 Feb 2017, 01:29 AM	#7
sleepycat Junior Member Join Date: Feb 2017 Posts: 6	Sweeeeet! Thank you both!

23 Feb 2017, 09:56 PM	#8
Jacinto Essential Contributor Join Date: Jun 2009 Posts: 395	Hello. Noticed that when using Port 565, the "IP =" part of the "X-Spam-source:" header is now the localhost ("IP='127.0.0.1'"), rather than the IP address of the submitting MUA. I have my own SMTP servers on two micro VPS instances with proper and clean (not listed in any of the Spam rating services) forward and reverse dns records and seldom use Fastmail for sending mail. I'm tempted to start using FM for outgoing mail as well. The only problem would be that, by carefully managing my own servers, it is unlikely that I would ever be listed as a source of Spam. Because Fastmail is a shared service, I would no longer control my own destiny and could have my mail rejected for Spam when one or more of FM's IP addresses becomes compromised. Of course, all E-Mail hosts experience this problem. Some deal with it better than others. I believe, but don't know from my own experience, that FM does a good job. At least now I can use FM when the VPS host is down (once in a blue moon) and for sending from K-9 Mail with my Android phone. -- Jacinto

24 Feb 2017, 11:45 AM	#9
DumbGuy Essential Contributor Join Date: Oct 2008 Posts: 212	Thank you much for the port-565 tip! (And thank you, FM, for this handy little feature). I just tested in Outlook and it seems to work. Side-question: While adjusting my client settings, I tried TLS, but it didn't connect. So, back to the SSL option, which worked fine. Why not TLS on these connections? I thought TLS was superior to SSL.

24 Feb 2017, 12:14 PM	#11
sleepycat Junior Member Join Date: Feb 2017 Posts: 6	I wholeheartedly agree. The thing about SSL/TLS version number is a mess.. Sometimes it's better not to know how the sausage is made About Jacinto's point of IP gets blacklisted, there is also a flipside. I'd imagine FM has more resource to deal with ISP's to get IPs unblocked than you do time/patience for.