Email Message-Id: headers generated by Outlook servers use domains that appear to incorporate
- AAA: a three character geographic region
- PPPP: either "PRXX" when appended to city, "PRDXX" appended to region where XX is a small value 01-99
- ...or PXXX where XXX appears to be a unique value 001-999
- BB: a two character "city" code
- C: a value appended to BB 0-9 or A-Z
- MM: "MB" or "01MB", not sure what this is
- DDDD: a value 0001-9999 server identifier? customer?
- X: seemingly random value 0-9a-z (which you'd expect in a Message-Id)
Server names are BBPPPPMMDDDD
This gives Message-Id values that look like the following:
<BBPPPPMMDDDDXXXXXXXXXXXXXXXXXXXXXXXX@BBPPPPMMDDDD.AAAPPPP.prod.outlook.com><xxxxxxxxxxxx4xxxxxxxxxxxxxxxxxxx@BBPPPPMMDDDD.AAAPPPP.prod.outlook.com>(128bit uuid - random)<xxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx@BBPPPPMMDDDD.aaapppp.prod.outlook.com>(128bit uuid random / RFC 4122 form)
Region codes from Microsoft 365 Multi-Geo availability
| Geo location | Code | eDiscovery data location |
|---|---|---|
| Asia-Pacific | APC | Southeast or East Asia datacenters |
| Australia | AUS | Southeast or East Asia datacenters |
| Brazil | BRA | (eDiscovery data location coming soon) |
| Canada | CAN | US datacenters |
| Europe / Middle East / Africa | EUR | Europe datacenters |
| France | FRA | Europe datacenters |
| Germany | DEU | Europe datacenters |
| India | IND | Southeast or East Asia datacenters |
| Japan | JPN | Southeast or East Asia datacenters |
| Korea | KOR | Southeast or East Asia datacenters |
| North America | NAM | US datacenters |
| Norway | NOR | (eDiscovery data location coming soon) |
| Qatar | QAT | (eDiscovery data location coming soon) |
| South Africa | ZAF | Europe datacenters |
| Sweden | SWE | Europe datacenters |
| Switzerland | CHE | Europe datacenters |
| United Arab Emirates | ARE | Southeast or East Asia datacenters |
| United Kingdom | GBR | Europe datacenters |
| Latin America | LAM | Not in the MS list, but observed |
City codes guessed at based on Country/Region specific Data Center city locations from recieved mail:
| Region | Code | City |
|---|---|---|
| AUS | ME | Melbourne |
| AUS | SY | Sydney |
| BRA | Rio | |
| BRA | Campinas | |
| CAN | YQ | Quebec |
| CAN | YT | Toronto |
| EUR | AM | Amsterdam |
| EUR | AS | |
| EUR | DB | Dublin |
| EUR | DU | Durham? |
| EUR | GV | Geneva |
| EUR | HE | Helsinki |
| EUR | PA | |
| EUR | PR | Paris |
| EUR | MR | Marseille |
| EUR | VE | |
| EUR | VI | Vienna |
| EUR | Gävle | |
| EUR | Sandviken | |
| EUR | Staffanstorp | |
| FRA | PR | Paris |
| FRA | MR | Marseille |
| DEU | Berlin | |
| DEU | FR | Frankfurt |
| IND | BM | Chennai? |
| IND | MA | Mumbai? |
| IND | PN | Pune? |
| JPN | Osaka | |
| JPN | TY | Tokyo |
| QAT | Doha | |
| KOR | PS | Seoul? |
| KOR | PU | Busan? |
| NOR | Oslo | |
| NOR | SV | Stavanger? |
| ZAF | JN | Johannesburg |
| ZAF | Cape Town | |
| SWE | Gävle | |
| SWE | Sandviken | |
| SWE | Staffanstorp | |
| CHE | GV | Geneva |
| CHE | ZR | Zurich |
| ARE | Dubai | |
| ARE | Abu Dhabi | |
| GBR | CW | Cardiff |
| GBR | LN | Leeds?? |
| GBR | LO | London |
| GBR | MM | Manchester?? |
| NAM | Boydton | |
| NAM | Cheyenne | |
| NAM | Chicago | |
| NAM | DM | Des Moines |
| NAM | Quincy | |
| NAM | SA | San Antonio |
| NAM | Santa Clara | |
| NAM | SJ | San Jose |
| NAM | BL | |
| NAM | BN | |
| NAM | BY | |
| NAM | CH | |
| NAM | CK | |
| NAM | CY | |
| NAM | DS | |
| NAM | EQ | |
| NAM | MN | |
| NAM | MW | |
| NAM | PH | |
| NAM | SN | |
| APC | HK | Hong Kong |
| APC | KL | Kuala Lumpur? |
| APC | PS | Seoul? |
| APC | SG | Singapore |
| APC | SI | Ho Chi Minh City? |
| APC | SL | |
| APC | TY | Tokyo |
| APC | SE |
Observed PXXX deployments
| code | region |
|---|---|
| P123 | GBRP123 |
| P152 | LAMP152 |
| P189 | EURP189 |
| P190 | EURP190 |
| P191 | EURP191 |
| P192 | EURP192 |
| P193 | EURP193 |
| P194 | EURP194 |
| P195 | EURP195 |
| P216 | KORP216 |
| P250 | EURP250 |
| P264 | FRAP264 |
| P265 | GBRP265 |
| P275 | ZAFP275 |
| P279 | NORP279 |
| P281 | DEUP281 |
| P282 | AUSP282 |