Nov 01 2023 11:10 PM
I want to understand how O365 shows the source IP and originating country in its email headers. I see two similar headers in the email source - X-MS-Exchange-Organization-OriginalClientIPAddress and X-MS-Exchange-Organization-ConnectingIP. Both contain the same values. What is the difference between them and why is Microsoft sharing the same information in both places ?
For originating country, O365 is showing this header - X-MS-Exchange-Organization-Originating-Country. Which of the above two IPs is it referring to while showing the originating country - is it the OriginalClientIPAddress or ConnectingIP ? There is also CTRY inside X-Forefront-Antispam-Report, is it the same data that is spread across multiple headers ?
A follow-up question - How do I find the reverse DNS of the source IP ? Can I use the header X-MS-Exchange-Organization-PtrDomains ? Or PTR: inside X-Forefront-Antispam-Report ?
Nov 01 2023 11:23 PM
X-MS-Exchange-Organization-OriginalClientIPAddress is for identifying and tracking the origin of a message,
and X-MS-Exchange-Organization-ConnectingIP is for indicating the IP address used while the message is traveling between servers.
Nov 01 2023 11:37 PM
Nov 01 2023 11:56 PM