Solved

Display Sending Server IP from the Header in Outlook Field

Posted on 2009-04-08
9
319 Views
Last Modified: 2012-05-06
Is it possible to add a field in Outlook that will display the sending servers IP address? I am using the SPF check field from Microsoft already. I am looking for something similar. Here's what I want to accomplish:

Emails tagged as spam by GFI on the Exchange Server are forwarded to a designated "SPAM" mailbox to catch any legit emails for fallback purposes. I'd like to sort all emails in this box by the sending servers IP address.
0
Comment
Question by:lewisig
  • 5
  • 4
9 Comments
 
LVL 76

Expert Comment

by:David Lee
Comment Utility
Hi, lewisig.

From an Outlook client perspective "yes" that is possible, but it will require some scripting.  A script will have to retrieve the header, parse it for the sending server's IP address, create a user-defined property in the Outlook item, insert the IP address in the property, and save the item.  The script will have to run at the client.  I can help with the script and instructions for using it if you want to go this route.
0
 
LVL 1

Author Comment

by:lewisig
Comment Utility
Sounds appropriate. Unfortunately, I do not know scripting well so any help would be appreciated.
0
 
LVL 76

Expert Comment

by:David Lee
Comment Utility
No problem.  What version of Outlook do you use?
0
 
LVL 1

Author Comment

by:lewisig
Comment Utility
2003 and 2007.  If it has to be one, let's go with 2003
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 76

Accepted Solution

by:
David Lee earned 125 total points
Comment Utility
Here's the code for doing this.  Follow these instructions to use it.

1.  Start Outlook
2.  Click Tools > Macro > Visual Basic Editor
3.  If not already expanded, expand Microsoft Office Outlook Objects
4.  If not already expanded, expand Modules
5.  Select an existing module (e.g. Module1) by double-clicking on it or create a new module by right-clicking Modules and selecting Insert > Module.
6.  Copy the code from the Code Snippet box and paste it into the right-hand pane of Outlook's VB Editor window
7.  Edit the code as needed.  I included comments wherever something needs to or can change
8.  Click the diskette icon on the toolbar to save the changes
9.  Close the VB Editor
10. Select one or more messages.
11. Run the macro GetSIP

The macro will get the sending server's IP, or at least attempt to (I'll explain that below), and store it in an Outlook user property.  All you'll need to do is modify a view by adding the field to it.  The field name is SendingServer.

I cannot guarantee that the code will get the sending server's IP.  There's nothing unique that marks that IP.  If the header has multiple entries, then it's possible that the code will return the wrong one.
Sub GetSIP()

    Dim olkItem As Outlook.MailItem, olkProp As Outlook.UserProperty

    For Each olkItem In Outlook.Application.ActiveExplorer.Selection

        Set olkProp = olkItem.UserProperties.Find("SendingServer", True)

        If TypeName(olkProp) = "Nothing" Then

            Set olkProp = olkItem.UserProperties.Add("SendingServer", olText, True)

        End If

    Next

    olkProp.Value = GetSenderIP(Outlook.Application.ActiveExplorer.Selection(1))

    olkItem.Save

    Set olkProp = Nothing

    Set olkItem = Nothing

End Sub
 

Function GetSenderIP(olkItem As Outlook.MailItem)

    'Set the error handler to allow us to handle errors in code

    On Error Resume Next
 

    'Declare a constant

    Const CdoPR_TRANSPORT_MESSAGE_HEADERS = &H7D001E
 

    'Declare a few variables

    Dim mapSession As Object, _

        mapMessage As Object, _

        mapFields As Object, _

        strHeader As String, _

        arrHeaders As Variant, _

        varHeader As Variant, _

        intLeftBracket As Integer, _

        intRightBracket As Integer, _

        strIP As String
 

    'Create a CDO session and login to it using the existing Outlook session

    Set mapSession = CreateObject("MAPI.Session")

    mapSession.Logon , , False, False, 0
 

    'Get the selected message's ID

    Set mapMessage = mapSession.GetMessage(olkItem.EntryID, olkItem.Parent.StoreID)
 

    'Get message fields

    Set mapFields = mapMessage.Fields
 

    'Get the Internet header

    Err.Clear

    strHeader = mapFields.Item(CdoPR_TRANSPORT_MESSAGE_HEADERS).Value

    If Err.Number = 0 Then

        arrHeaders = Split(strHeader, vbCrLf)

        For Each varHeader In arrHeaders

            If Left(varHeader, 9) = "Received:" Then

                intLeftBracket = InStr(1, varHeader, "[")

                intRightBracket = InStr(1, varHeader, "]")

                If (intLeftBracket > 0) And (intRightBracket > 0) Then

                    If intRightBracket > intLeftBracket Then

                        strIP = Mid(varHeader, intLeftBracket + 1, intRightBracket - intLeftBracket - 1)

                        If strIP <> "127.0.0.1" Then

                            GetSenderIP = strIP

                        End If

                    End If

                End If

            End If

        Next

    End If
 

    'Logout of the CDO sesison

    mapSession.Logoff
 

    'Clean up

    Set mapSession = Nothing

    Set mapMessage = Nothing

    Set mapFields = Nothing

End Function

Open in new window

0
 
LVL 1

Author Comment

by:lewisig
Comment Utility
Instead of running a macro on selected messages, is there a method to extract the unique header information to a column for sorting? Can the unigue mark to identify the sending mail server in the message header be the combination of "Received: from" and "by mail.myserver.com"?

examples:

Received: from JSTQIDTOA ([115.138.6.53] RDNS failed) by mail.myserver.com
Received: from host-54-254.compi.net.pl ([194.187.54.254]) by mail.myserver.com
0
 
LVL 76

Expert Comment

by:David Lee
Comment Utility
"is there a method to extract the unique header information to a column for sorting"
That's exactly what the code is doing.  A column is composed of the values of a given property for each item.  The information you want from the header isn't part of Outlook's object model, i.e. it's not a property.  So the first step is to read each message (each selected message), pull that information from the header, and put it into a user-defined property.  That's what allows you to add a column showing the information.  

"Can the unigue mark to identify the sending mail server in the message header be the combination of "Received: from" and "by mail.myserver.com"?"
Sure.  But how does that help if the message passed through 4 or 5 servers on its way to you?  So long as the server names are all in order and all messages headers are formatted in exactly the same way, then the code should work without any problem.  My point was that none of the servers listed in the header are uniquely marked or tagged as being the server of origin.  
0
 
LVL 1

Author Comment

by:lewisig
Comment Utility
Never got around to this, sorry. Found a work around.
0
 
LVL 76

Expert Comment

by:David Lee
Comment Utility
I don't mind that you found a workaround, but why give me the lowest grade possible for putting in the effort to help out?
0

Featured Post

Integrate social media with email signatures

Is your company active on social media? Do you also use email signatures? Including social media icons in your email signature is a great way to get fans for free. Let all your email users know you’re on social media quickly and easily, in a single click.

Join & Write a Comment

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now