
Had it registered as fail, it would have been rejected by Gmail's servers. In this case, the qualifier is pass, which means that the IP address was authorized to send from the domain. Here, it is good to note the line Received-SPF: SPF, or Sender Policy Framework, is a standard by which a sender's email server can declare itself to be the legitimate sender of the email. We can tell that it was received by mx., so the recipient has their email service with Google. Spf=pass (: domain of designates 81.171.26.235 as permitted sender) is the hop that takes it from LeaseWeb's server to the recipient's email server. Received-SPF: pass (: domain of designates 81.171.26.235 as permitted sender) client-ip=81.171.26.235 ĭkim=pass header.s=ms header.b=frJ635H2 In our example, the first hop takes the email from the sender to Google, from where it takes two more hops until it arrives at its final destination. These hops start at the server that most recently handled the email and go back to the server that originally handled it, in reverse chronological order. This can be added to the header to show the "hops" the email had to make to get to you. Along the Way to the Recipient's Email Serviceįrom there, the email may take any number of routes to end up at the recipient's email service.

In addition to the sender's IP address, the email header also reveals the time the email was sent by the sender's email service (Thu, 14:58:13 -0800 (PST)), and the Message-ID for that particular message as added by the email service.

Further inspection of the IP address reveals that the sender was using LeaseWeb, a Dutch cloud computing and web services company.
