Hotmail X-Originating-IP

The previous tutorial explained how to view Hotmail email headers, what these were, and went over the most common email header fields: we also briefly eluded to "X-Originating-IP" - this tutorial is dedicated to the X-Originating-IP email header field. We will start with a brief overview, and then explain both how to find the X-Originating-IP field in email headers, and discuss the reliability, limitations, and typical usages you will find for this particular email header field.

X-Originating-IP: how do I know where an email came from?

As mentioned in the previous tutorial, Hotmail email headers contain a number of standard mandatory and optional email header fields, like From, To, Date, Subject, etc. — sent alongside the content of any email (the "email body"). Many email programs and webmail services (like Hotmail, Yahoo! Mail, or Gmail) append custom email headers for various purposes. "X-Originating-IP" is a custom email header currently used by both Hotmail and Gmail to capture the IP address of the computer from which the email originated:

Quick reminder from the previous tutorial: to view email headers in Hotmail, right-click on the email in question, and choose View message source: this opens a new window containing both email headers and the "HTML" source code behind the email body (which may be unformatted text if the email was sent as "plain text").

The screenshot above displayed custom email headers including X-Originating-IP and X-Originating-Email. The IP address displayed represents the current external IP address of the computer the person used to send the email through Hotmail.

Why isn't X-Originating-IP always in the email headers?

If the person sent an email to your Hotmail account using another email service, the X-Originating-IP field may not appear in the email's headers. This is simply because, as a non-standard email header field, X-Originating-IP is not needed for an email to find its proper destination. In the case of Windows Live Hotmail, Microsoft uses X-Originating-IP to store the IP address of anyone who sends an email from Hotmail: this allows them to blacklist either email addresses or IP addresses from which emails overwhelmingly reported as spam are sent from. (Random email used for illustration purposes, not actually marked as junk.)

The X-Originating-IP information is either used behind the scenes, as people report a given IP as spam, or actively, as is the case with the Hotmail spam report collection page.

As noted next, if the X-Originating-IP field does not appear in the email headers, you may have more luck with the "Received" header, which often contains the originating IP address. Keep in mind that, as explained in our "What is my IP address?" tutorial, an external IP address can represent a school or a public library: in other words, the same X-Originating-IP would be displayed for any of potentially thousands of users using Hotmail behind that IP address.

How reliable is X-Originating-IP?

Unfortunately, like any other email header field, X-Originating-IP can be faked: this means that in most cases, it will in fact give you the IP address of the person who sent the email, but the information isn't guaranteed to be accurate. Another way to find out where an email came from, or at least from which IP address it originated, you can also look for other email header fields that include IP addresses: depending on how the email was transported to your Hotmail inbox, it may include IP addresses from several mail relays. The equivalent of X-Originating-IP is often stored inside the Received email header field.

Bonus Hotmail Tip: Who does this IP address belong to?

Here is a quick way to determine to whom belongs the IP address you found in the Hotmail X-Originating-IP field: it won't give you the person's name of course, but it will give you the name of the organization who currently owns this particular IP address. (We are not collecting the information you type; the result will open in a new window.)

(The pre-filled, sample IP address belongs to Microsoft, to one of their Hotmail servers.)