Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by saagarjha on Wednesday July 01, 2026 @06:37PM
(#48754067)
Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address
[ Parent
| on HN ]
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by lapcat on Wednesday July 01, 2026 @06:53PM
(#48754199)
It's not a Gmail thing:
> The reason why my IP address is visible is because Apple Mail sends emails with SMTP.
Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by saagarjha on Wednesday July 01, 2026 @08:24PM
(#48754864)
Yeah but I think Gmail seems to actually just keep that header rather than nuking it. To be fair I don't entirely know what I would do to fix it since (like the post) this seems like there aren't many good options here.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by js2 on Wednesday July 01, 2026 @10:10PM
(#48755593)
Gmail's SMTP servers are what's adding the received header with your IP address, not Apple Mail.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by lapcat on Wednesday July 01, 2026 @08:58PM
(#48755062)
> I think Gmail seems to actually just keep that header rather than nuking it.
I think that's common among email providers.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by frollogaston on Wednesday July 01, 2026 @06:45PM
(#48754120)
Yes, was able to repro just now
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real...
by AnonC on Wednesday July 01, 2026 @11:47PM
(#48756294)
I clearly remember many years ago that this wasn’t the case with Gmail, when looking for the source IP address in a case involving harassment of a person. I could only get Gmail’s own IP address in the headers from the multiple emails I examined at that time.
Nevertheless, as js2 said in another comment, it’s your mail provider (in this case Gmail) deciding whether to include the sender’s IP address or not.