What does the email header-line "message opened by mailclient" mean?

I tried to filter Google results for "message opened by mailclient" as follows:

  • Jan 1, 2008 – Jan 1, 2009
  • Jan 1, 2009 – Jan 1, 2010
  • Jan 1, 2010 – Jan 1, 2011
  • Jan 1, 2011 – Jan 1, 2012
  • Jan 1, 2012 – Jan 1, 2013
  • Jan 1, 2013 – Oct 31, 2013

Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after mailclient becomes (on average). It goes like this:

  • (2008) message opened by mailclient 1.0.20.1
  • (2009) message opened by mailclient 4.6.0.0
  • (2010) message opened by mailclient 6.21.11.1
  • (2011) message opened by mailclient 6.35.6.0
  • (2012) message opened by mailclient 6.54.5.0
  • (2013) message opened by mailclient 6.71.3.0

As a result, it's safe to assume that those numbers are not IP addresses, but rather version numbers of the mail client. Looks like the Belgian MP is just jealous that the NSA are tapping Angela Merkel but not her.

Now, please send this answer's link to the news paper that published that article.


After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP address of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js.

So, the message

message opened by mailclient 6.73.3.0

Means exactly that: the mailclient (you as the user) opened the email through the Mail.com webinterface.

Lesson of today: make sure the "IT expert" you consult can differentiate between an IP-address and a version number ;-).


Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so.

Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid of me to configure my mail server to add a header to indicate that I had done so!

We would need more technical detail to know for certain what has happened here, but my money is on a poorly configured mail server, not snooping.

Edit: I'm wondering if it is a "feature" of whatever back-end is running the gmx.com (and associated domains) mail server or webmail interface. I can reproduce the "header" line in question by sending email from gmail.com to gmx.com:

I'm standing by my conclusion that the header is not indicative of snooping, and the mail server is poorly configured in the sense that it's adding a human-readable header line that has no obvious meaning.

Return-Path: [redacted]@gmail.com
Received:  from mail-vc0-f180.google.com ([209.85.220.180]) by mx-ha.gmx.net
 (mxgmxus004) with ESMTPS (Nemesis) id 0LdpQ5-1W3Tig3xaN-00iyjP for
 <[redacted]@gmx.com>; Sat, 02 Nov 2013 16:47:58 +0100
Received: by mail-vc0-f180.google.com with SMTP id lc6so3571661vcb.25
        for <[redacted]@gmx.com>; Sat, 02 Nov 2013 08:47:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:from:date:message-id:subject:to:content-type;
        bh=jEEaGY9FD1DDKh9keJ/H5F18bxsFQwr5TvXHFCrp+Sw=;
        b=Tmxrwz8d+XFaUR+iIksktPamDVVZlG8myyEKbSnrHB5WRanmnIFh4xjFCZ1zna8J9s
         28S/QqQvArf8sHey5J1ZgGqvoTVBMobWFuK3hKob3CjWrvJu+abWx6EppiDFEXGAQord
         +c/X35Ho+b0bHH1sToBHmBDqvyT0bVzrnTiZCW2r7EXI+H/MQjFcNR+NbjFlngREMTZ9
         RO0eiRKYpHr8gfMn/fOoytSFy2TrxgGhTJSy93LrhHN0qjeuY+0SkW1RvSMFjyEVtlJo
         WSuWc+i7KP1HD+MS4R0ztBi6qR6YVJzEoz3OMPv6/9T/hkysax8gPO2iBhQMQy3wg45Z
         nUBQ==
X-Received: by 10.58.54.69 with SMTP id h5mr163046vep.25.1383407277299; Sat,
 02 Nov 2013 08:47:57 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.58.32.200 with HTTP; Sat, 2 Nov 2013 08:47:27 -0700 (PDT)
From: <[redacted]@gmail.com>
Date: Sat, 2 Nov 2013 [redacted]
Message-ID: <CAMx+XZ0_O+OLEH5=6=NJeLRb[redacted]@mail.gmail.com>
Subject: [redacted]
To: [redacted]@gmx.com
Content-Type: text/plain; charset=ISO-8859-1
Envelope-To: <[redacted]@gmx.com>
X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: notjunk:1;V01:K0:K9FP11uQyc8=:yWrrPx81cP9DKLPzL6aspyrja5
 7acFJLybJttLIn9Z4D9+wV9STt7wN1wj6S2tLrYQT8Ui495N0GvQ3FbZFt1YruK9egZuNLt+Y
 OfTRgJgCzP4fZJ4P9r35mfKGPzMRktYYrMaxD1xGAbB6dgFd/xa63i6+xLqwF7OoXR1RHgEZ8
 rXxc4IECACEw1WoioXRHQ89MJUp3gUQ2ZQMa7d6cH2DSQ7Mc0JvQntCYGbp7jYVRS6msl9HYo
 8OzPDrHoOoRTAG0Ajocv56SJDDiruo5rHE9xBAZC1p2ztbIVmi0hOMhZ4LFkA09Z9BuF2NmnB
 Hh1aYaza0uf5ELwIqFIjbmrv37GbauuJOCl26m2ZEO7GBPyG4h7Fe0sEfyM4yYDOiyvmfVYE3
 +9uym9D2SI4MrQwKqMpbecW1fM0u7xoi7wTDLI002fhQImYjBZ3Ua3/eYpLmFLk1eYtskILA1
 Nfsz+b0J96Q1rP4a3cy/fptRP+iWaoEoJ/y8HButhQAiPQYPE1bGknPWnXZkG/fII8sTAO1m0
 nd/YmjWkLvH3m4q/n1YPEOgydKzbBrb0+lfaHKoYVnF2xBJxvMdBYKLGwDDH60vazgViQwdxP
 T6ra7ekyJoat4a3UYoMF/aXRDVDoFuqI+9BH6lH9oT2K7bt1Xo5UaBtORayxYU7WNRoQD1d1c
 wWLdY0YM8oElKageQrzWiyQY8X/8ghL3N2/l4ImE9pFgpq70FbGK1oG48RQD1GIAf2VXeu6FZ
 y/2cOYvz3ud09Pniqgy3K09G6WkbjTFBe08Zd6XX+5jdfNK+m2F9Qp3jRZ0ihxjBP9uycuEKf
 vX0YQiu29xKtMjCUaErT5K2hYe+YFWQrb1TBhVR/pH9k5R9skCwd4nQVzkt5mWgfRxvvO6iad
 YUdYwY+wf1xhMOz9oFSdoYfe3OU0QM5n6xU1MGCV4AzwbdaZxdmRiBZnE+xIPRNn4DDm+bEv4
 v+2w9lFqVXctPcS5jzYJ0oME6t9altQmc1Y+0m27IAnSTYWftWImcKZHFdCxaY5aQ4xpIVRZc
 CF3GRDsx6Z489p0hlw4wGGBlkpQwamIHlS2/CpmMA7bRdlow0Fe8//wES5Hh2U/NNM3r2onv+
 IxmgVaUBWX6bxcO1PBBckGk62nZLOZySDez5ij1DUsiGAMLte8vDaBT0DSkVC+rlTc9GNrwJv
 wS9j11C6cc3ocqYhlaENrwSA5ZJlSN9l9h+K5ep+jjdYuWU/T73LAstrVRiCx0BcZYxd4x8a+
 4k2Ocph8oMSI2ywr1Urlirc9dgfrcVZr6RDZy69YJ6SpPrfZxVIGTrGfdTEJBwyjknaI39Y29
 9aA2dThpGtVmPXkeZWmsKeoouZ5hzUqyamzJW4wdQ5XLtoX1AAJVMU9Ch8ZRYIXap5opIbEeo
 svEWP1J98n+UlGo5L+YWS4Yq6lZabp6s0MD/ARB1zc8jMmUUTCCkaXVwFpFiqyVYC7GFYWQTT
 JJp4wXQw==
X-GMX-UID: NjUyOAUgSzg3M8ChcT4xpToxMekO3kko
X-Flags: 1401



MailID: NjUyOAUgSzg3M8ChcT4xpToxMekO3kko


------------------------------------------------------------------------
message opened by mailclient 6.73.3.0 (6.73.1.0)

Tags:

Email

Routing

Smtp

Recent Posts