the ORIGIN IP field that jonconley speaks of must not be common cause I've never seen it before. However, there are RECIEVED fields that are found in all emails. The only problem is that sometimes the first RECIEVED field does not contain the originators IP, but the originator mail services IP. When I say 'first' I actually mean the LAST occurance of RECIEVED.
Example 1:
Received: from 216.136.174.9 (HELO web13609.mail.yahoo.com) (216.136.174.9) by mta175.mail.scd.yahoo.com with SMTP; 06 Mar 2003 10:05:46 -0800 (PST)
Recieved: from <SenderDomainNotFound> (HELO <SenderDomainAsSpecifiedBySender>) (<RealSenderIP>) by <RecieverDomain> with <Protocol>; <DateTimeRecieved>
Example 2 (multiple fields):
Received: from web2301.mail.yahoo.com (128.11.68.52) by mta135.mail.yahoo.com with SMTP; 09 Jul 2000 17:08:10 -0700 (PDT)
Message-ID: <
[email protected]>
Received: from [209.253.72.45] by web2301.mail.yahoo.com; Sun, 09 Jul 2000 17:01:28 PDT
Date: Sun, 9 Jul 2000 17:01:28 -0700 (PDT)
Recieved: from <SenderDomain> (<SenderIP>) by <RecieverDomain> with <Protocol>; <DateTimeRecieved>
Message-ID: <POP3ID@SenderDomain>
Recieved: from <SenderIP> by <RecieverDomain>; <DateTimeRecieved>
In the last example the originator IP is 209.253.72.45. At minimum all Recieved fields will have a format similar to this:
Recieved: from <SenderInfo> by <RecieverInfo>; <AnyOtherInfo>