This is the third in a series of articles on reading internet message headers. If you haven't already done so, please read the first two articles, Reading Internet Message Headers, and Where'd That Email Come From?

Messages sent through mailing lists are a bit different than those sent directly to one or more email addresses. There are many different programs that run mailing lists, and each of them seems to do slightly different things to the headers depending on the software and how it is configured. Unless you have access to the messages before they go through the mailing list software, it can be very difficult to really know the origin of those messages. Listowners may or may not have access to the records of where the messages originated, depending on whether they run their own server and list software or are using a service like EGroups or ListBot.

Here's an example of a message sent through EGroups:
Received: (from root@localhost)
	by (8.10.2/8.10.2) id e6M6ouU25336
	for; Sat, 22 Jul 2000 02:50:56 -0400
Received: from ( [])
	by (8.10.2/8.10.2) with SMTP id e6M6olc25331
	for <>; Sat, 22 Jul 2000 02:50:47 -0400
Received: from [] by with NNFMP; 22 Jul 2000 06:48:27 -0000
Received: (qmail 11241 invoked from network); 22 Jul 2000 06:48:22 -0000
Received: from unknown ( by with QMQP; 22 Jul 2000 06:48:22 -0000
Received: from unknown (HELO ( by mta1 with SMTP; 22 Jul
 2000 06:48:22 -0000
Received: from localhost (spoons@localhost) by (8.9.3/8.9.2/ with
ESMTP id XAA04661 for <>; Fri, 21 Jul 2000 23:48:22 -0700 (PDT)
X-Authentication-Warning: spoons owned process doing -bs
Message-ID: <>
From: Barbara Mikkelson <>
MIME-Version: 1.0
Mailing-List: list; contact
Delivered-To: mailing list
Precedence: bulk
List-Unsubscribe: <>
Date: Fri, 21 Jul 2000 23:48:22 -0700 (PDT)
Subject: [ulrp-update] Urban Legends Reference Pages Update #33  
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

As you can see, EGroups is configured so that you can tell where the message originated - from a shell acount user at who had the IP address when she sent the message. The following lines:
Mailing-List: list; contact
Delivered-To: mailing list
List-Unsubscribe: <>

differ from messages sent without mailing list software, but all are fairly clear. The first is used by EGroups to track messages that bounce. The second is used to indicate which mailing list the message came from (, and gives the contact address for the owner of that list. The third is, again, just the mailing list name. The fourth gives the address to which an unsubscribe request would be sent, in case the recipient doesn't want to receive further messages from that list.

I'm also on mailing lists run through ListBot, and some are configured so that I can see where messages originated, while some are not. I'm assuming that's something controlled by the individual list owners.

Return-Path: <>
Received: (qmail 17645 invoked from network); 24 Nov 2000 21:23:22 -0000
Received: from unknown (HELO (
  by with SMTP; 24 Nov 2000 21:23:22 -0000
Received: (qmail 3820 invoked by uid 0); 24 Nov 2000 22:08:24 -0000
Date: 24 Nov 2000 22:08:24 -0000
Message-ID: <975103704.2299.qmail@ech>
To: List Member <>
Mailing-List: ListBot mailing list contact
From: "Dead Troll News" <>
Delivered-To: mailing list
Subject: Dead Trolls & Lost Scrolls at Christmas

All I know about the above message is that it was sent through ListBot by the owner of the Dead Troll mailing list (they're a comedy group, in case you were wondering). That list is announcement only, so only the listowner can send messages. If I had reason to try finding out where the message originated, I'd have to try to contact the listowner or someone at ListBot.

In the next article we'll talk about messages posted to newsgroups.

Originally published February 12, 2001

About the Author

Cynthia Armistead is a freelance technical writer, quality assurance analyst, and Internet security advocate with a broad spectrum of experience.

Please if you'd like to discuss a project.