Find an IP Address from an Email Guide

Understanding IP Addresses and Email Headers

An IP address is a unique numerical identifier assigned to every device connected to the internet. Think of it like a mailing address for your computer or phone — it tells the internet where to send information back to you. IP addresses come in two versions: IPv4, which looks like four numbers separated by dots (192.168.1.1), and IPv6, which uses a longer format with letters and numbers.

When someone sends you an email, their device leaves behind digital traces called headers. Email headers contain information about the journey your message took through the internet. This information includes timestamps, server names, and crucially, the sender's IP address or the IP address of the mail server that processed the email. Most people never see these headers because email programs hide them by default — but they're always there, stored with every message you receive.

Understanding this connection between emails and IP addresses matters for several reasons. You might want to investigate suspicious emails to understand where they actually came from. You could be trying to track down a person who sent you a message from an unknown account. You might need to identify whether an email came from a legitimate company server or from somewhere else entirely. Learning to read email headers gives you a tool for digital investigation and verification.

The headers in your email contain several layers of information. The "From" line shows what the sender claims, but this can be faked. The "Received" lines, however, are harder to falsify because they're added by actual mail servers as the message passes through the internet. Each "Received" line includes the IP address of a server that handled your email. By reading these lines in reverse order, you can trace the path your email took from the original sender all the way to your inbox.

Practical Takeaway: Before attempting to find an IP address, understand that email headers are complex and reading them requires patience. Not every line contains an IP address, and some addresses may belong to intermediate servers rather than the original sender. Set realistic expectations about what information you'll find and what it actually tells you.

Accessing Email Headers in Different Email Platforms

Different email services store and display headers in different locations. Gmail, Outlook, Yahoo Mail, and other providers each have their own method for showing you this information. If you don't know where to look, you won't be able to see the headers at all. Fortunately, most major email providers make headers accessible, though they may be hidden by default behind a menu or settings option.

In Gmail, the process is straightforward. Open the email you want to investigate. Look for the three vertical dots (sometimes called a menu icon) next to the reply arrow. Click these dots and select "Show original." This opens a new window with the complete raw email, including all headers. The headers appear at the top of this window. Some people prefer to look for "View original" or similar language depending on their Gmail version or language settings. This raw view shows everything the email system recorded about this message.

Microsoft Outlook works differently. Open the email, then look for "File" in the menu bar at the top. Click File, then select "Properties." A dialog box opens showing message details. You'll see a section labeled "Internet Headers" — this contains the information you need. In Outlook's web version (Outlook.com), click the three dots near the subject line and look for "View message details" or "View original." The exact wording changes sometimes, but the principle remains the same.

Yahoo Mail users should open an email, then click the three-line menu icon (the hamburger menu) in the top right. Look for "More," then select "View raw message" or "Show headers." Some versions of Yahoo Mail display a "Full Header" option instead. Apple Mail users can go to the "View" menu at the top of the screen and select "Message" followed by "All Headers." This shows complete header information for the selected email.

Less common email services may have different procedures. If you use ProtonMail, Tutanota, or another privacy-focused service, headers might be intentionally limited or unavailable. Professional services like corporate email systems often have their own procedures for accessing headers. When in doubt, search "[Your email service] view email headers" to find current instructions, as these procedures occasionally change when companies update their platforms.

Practical Takeaway: Write down the method for your specific email provider and bookmark it. You'll refer back to these steps multiple times. If one method doesn't work, try searching for an alternative procedure — your email client might have recently updated its interface.

Reading Email Headers to Locate IP Addresses

Once you've accessed the raw email headers, you're looking at a wall of text that may seem confusing. Headers follow a standard format, and each line serves a specific purpose. The key is learning which lines contain IP address information and how to read them. Most headers follow patterns that become obvious once you know what to look for.

The most important lines for finding IP addresses are those labeled "Received:" — these lines appear multiple times in any email. Each "Received:" line represents one server that handled your email. These lines are added in reverse chronological order, meaning the bottom "Received:" line was added first (closest to the original sender), and the top one was added last (closest to you). Each "Received:" line typically includes information like: "from [server name] ([IP address]) by [receiving server] with [protocol details]"

The IP address you're looking for usually appears in square brackets, like [192.168.1.100]. Sometimes you'll see multiple IP addresses in one "Received:" line — one for the sending server and one for the receiving server. The IP address closest to "from" represents where the email came from at that stage of its journey. The IP address closest to "by" represents where it was received at that stage.

An example helps clarify this. A real (anonymized) header might read: "Received: from mail.example.com ([203.0.113.42]) by mail.receiver.com ([198.51.100.55]) with SMTP id abc123". In this line, 203.0.113.42 is the IP address of the sending server, and 198.51.100.55 is the receiving server's IP. To find the original sender's IP, look at the bottom-most "Received:" line — though even this may not be the original sender if they used a mail relay service or company email system.

Other header lines worth noting include "X-Originating-IP:" which sometimes appears and shows an IP address directly. However, this line can be faked by senders, so it's less reliable than "Received:" lines added by actual mail servers. The "Return-Path:" line shows where bounced emails would go, and might include an IP address or at least a domain name that you can investigate. The "X-Sender:" line occasionally appears and might contain IP information, though again, this is less trustworthy than server-generated "Received:" lines.

Practical Takeaway: Start by identifying all "Received:" lines in your headers, then read them from bottom to top. The bottom line is closest to the original sender. Write down or copy all IP addresses you find, noting which line they came from. You'll need these addresses in the next step of investigation.

Using IP Address Lookup Tools and Services

Once you've extracted an IP address from your email headers, you need information about where that address is registered and what it tells you. Several free online services provide IP address information. These tools access large databases of IP address ownership information. They can show you what country an IP address is registered in, what internet service provider (ISP) owns it, and sometimes what city or region it's associated with.

Popular IP lookup tools include IP2Location, MaxMind's GeoIP2, WhatIsMyIPAddress, and IPQualityScore. Most of these services have free versions that provide basic information. You simply enter the IP address you found in the email header, and the tool returns its geographic location and ISP information. Some tools show additional data like whether the IP is from a data center, VPN, or proxy service, which can indicate whether someone was trying to hide their location.

What these tools actually tell you matters for understanding limitations. Geographic data shows where an IP address is registered, not necessarily where a person physically was when they sent the email. Someone could send an email from New York while using a VPN service with a server in London — the IP lookup would show London. Similarly, corporate email servers might have IP addresses registered in one city while the company operates in many