Menu Close

So It Came From a Mailing List — Where Did It Come From Before That?

This is the third in a series of arti­cles on read­ing inter­net mes­sage head­ers. If you haven’t already done so, please read the first two arti­cles, Read­ing Inter­net Mes­sage Head­ers, and Where’d That Email Come From?

Mes­sages sent through mail­ing lists are a bit dif­fer­ent than those sent direct­ly to one or more email address­es. There are many dif­fer­ent pro­grams that run mail­ing lists, and each of them seems to do slight­ly dif­fer­ent things to the head­ers depend­ing on the soft­ware and how it is con­fig­ured. Unless you have access to the mes­sages before they go through the mail­ing list soft­ware, it can be very dif­fi­cult to real­ly know the ori­gin of those mes­sages. Lis­town­ers may or may not have access to the records of where the mes­sages orig­i­nat­ed, depend­ing on whether they run their own serv­er and list soft­ware or are using a ser­vice like EGroups or ListBot. 

Here’s an exam­ple of a mes­sage sent through EGroups:

Received: (from root@localhost)
	by zeus.larp.com (8.10.2/8.10.2) id e6M6ouU25336
	for cynthia@larp.com; Sat, 22 Jul 2000 02:50:56 -0400
Received: from hn.egroups.com (hn.egroups.com [208.50.99.199])
	by zeus.larp.com (8.10.2/8.10.2) with SMTP id e6M6olc25331
	for <cyn@technomom.com>; Sat, 22 Jul 2000 02:50:47 -0400
X-eGroups-Return: sentto-125177-20-964248507-cyn=technomom.com@returns.onelist.com
Received: from [10.1.10.37] by hn.egroups.com with NNFMP; 22 Jul 2000 06:48:27 -0000
Received: (qmail 11241 invoked from network); 22 Jul 2000 06:48:22 -0000
Received: from unknown (10.1.10.26) by m3.onelist.org with QMQP; 22 Jul 2000 06:48:22 -0000
Received: from unknown (HELO shell21.ba.best.com) (206.184.139.153) by mta1 with SMTP; 22 Jul
 2000 06:48:22 -0000
Received: from localhost (spoons@localhost) by shell21.ba.best.com (8.9.3/8.9.2/best.sh) with
ESMTP id XAA04661 for <ulrp-update@egroups.com>; Fri, 21 Jul 2000 23:48:22 -0700 (PDT)
X-Authentication-Warning: shell21.ba.best.com: spoons owned process doing -bs
X-Sender: spoons@shell21.ba.best.com
To: ulrp-update@egroups.com
Message-ID: <Pine.BSF.4.21.0007212345130.24084-100000@shell21.ba.best.com>
From: Barbara Mikkelson <spoons@best.com>
MIME-Version: 1.0
Mailing-List: list ulrp-update@egroups.com; contact ulrp-update-owner@egroups.com
Delivered-To: mailing list ulrp-update@egroups.com
Precedence: bulk
List-Unsubscribe: <mailto:ulrp-update-unsubscribe@egroups.com>
Date: Fri, 21 Jul 2000 23:48:22 -0700 (PDT)
Reply-To: ulrp-update-owner@egroups.com
Subject: [ulrp-update] Urban Legends Reference Pages Update #33  
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Status:   

As you can see, EGroups is con­fig­ured so that you can tell where the mes­sage orig­i­nat­ed — from a shell acount user at best.com who had the IP address 206.184.139.153 when she sent the mes­sage. The fol­low­ing lines:
X‑e­Groups-Return: sentto-125177–20-964248507-cyn=technomom.com@returns.onelist.com
Mail­ing-List: list ulrp-update@egroups.com; con­tact ulrp-update-owner@egroups.com
Deliv­ered-To: mail­ing list ulrp-update@egroups.com
List-Unsub­scribe: <mailto:ulrp-update-unsubscribe@egroups.com>

dif­fer from mes­sages sent with­out mail­ing list soft­ware, but all are fair­ly clear. The first is used by EGroups to track mes­sages that bounce. The sec­ond is used to indi­cate which mail­ing list the mes­sage came from (ulrp-update@egroups.com) and gives the con­tact address for the own­er of that list. The third is, again, just the mail­ing list name. The fourth gives the address to which an unsub­scribe request would be sent, in case the recip­i­ent does­n’t want to receive fur­ther mes­sages from that list. 

I’m also on mail­ing lists run through List­Bot, and some are con­fig­ured so that I can see where mes­sages orig­i­nat­ed, while some are not. I’m assum­ing that’s some­thing con­trolled by the indi­vid­ual list owners. 

Return-Path: <deadtroll-return-9-17388717@listbot.com>
Delivered-To: cyn@null.com
Received: (qmail 17645 invoked from network); 24 Nov 2000 21:23:22 -0000
Received: from unknown (HELO lbmail4.listbot.com) (204.71.191.16)
  by zeus.larp.com with SMTP; 24 Nov 2000 21:23:22 -0000
Received: (qmail 3820 invoked by uid 0); 24 Nov 2000 22:08:24 -0000
Date: 24 Nov 2000 22:08:24 -0000
Message-ID: <975103704.2299.qmail@ech>
To: List Member <cyn@null.com>
Mailing-List: ListBot mailing list contact deadtroll-help@listbot.com
From: "Dead Troll News" <wes@deadtroll.com>
Delivered-To: mailing list deadtroll@listbot.com
Subject: Dead Trolls & Lost Scrolls at Christmas

All I know about the above mes­sage is that it was sent through List­Bot by the own­er of the Dead Troll mail­ing list (they were a com­e­dy group, in case you were won­der­ing). That list is only for announce­ments, so only the list own­er can send mes­sages. If I had rea­son to try find­ing out where the mes­sage orig­i­nat­ed, I’d have to try to con­tact the list own­er or some­one at ListBot. 

In the next arti­cle we’ll talk about mes­sages post­ed to news­groups.

Orig­i­nal­ly pub­lished 12 Feb­ru­ary 2001. Last updat­ed 17 Feb­ru­ary 2019.