Finding an IP address from an email can help you investigate suspicious messages, verify where a message may have traveled, or provide useful technical details to an email administrator. However, it is important to understand what email headers can and cannot reveal. In many cases, you will identify the IP address of a mail server, security gateway, or email provider—not the sender’s home or office device.

TLDR: To find an IP address from an email, open the message’s full headers or original source, then examine the Received lines from bottom to top. Look for the earliest trustworthy public IP address, then verify it with an IP lookup tool. Treat the result as technical evidence, not absolute proof of a person’s location or identity.

Why Email Headers Matter

Every email contains more than the visible sender, subject, and message body. Behind the scenes, it includes headers: technical metadata added by servers as the message moves from sender to recipient. These headers can show routing paths, timestamps, authentication checks, mail server names, and sometimes IP addresses.

The most important header for tracing an email is usually Received. Each mail server that handles the message typically adds its own Received line. By reviewing these lines carefully, you may be able to identify the first public server that accepted the message.

Important: modern services such as Gmail, Outlook, Yahoo, and corporate mail platforms often protect user privacy by hiding the sender’s original IP address. Instead, you may only see the IP address of Google, Microsoft, a marketing platform, a VPN, or a mail relay.

Before You Start: Legal and Practical Limits

Use this process only for legitimate purposes, such as investigating phishing, reporting abuse, troubleshooting mail delivery, or verifying suspicious activity. Do not use header data to harass, threaten, dox, or attempt to identify someone without a lawful reason.

Also remember that an IP address is not a precise identity. It may point to an internet service provider, a data center, a company mail server, a VPN, a proxy, or a cloud service. Even when a city or country is shown, geolocation databases can be inaccurate. For serious threats, fraud, or crime, preserve the email and report it to your organization, email provider, or law enforcement.

Step 1: Open the Full Email Headers

The first step is to view the full technical headers. The process depends on your email service or app.

• Gmail: Open the email, click the three dots near the reply button, then choose Show original.
• Outlook on the web: Open the message, click the three dots, choose View, then select View message source or View message details, depending on the version.
• Microsoft Outlook desktop: Open the message in a separate window, go to File, then Properties. Look for Internet headers.
• Apple Mail: Open the message, select View, then Message, then All Headers or Raw Source.
• Yahoo Mail: Open the email, click the three dots or More, then choose View raw message.

Once opened, copy the full header text into a plain text editor. This makes it easier to search, compare lines, and avoid overlooking important details.

Step 2: Find the “Received” Lines

Search the header for the word Received:. You will likely see several lines, each representing a server that handled the email. A simplified example might look like this:

Received: from mail.example.com (mail.example.com [203.0.113.25])
by mx.google.com with ESMTPS id abc123
for <recipient@example.com>; Tue, 10 Oct 2026 14:22:10 +0000

In this example, 203.0.113.25 is an IP address associated with a server named mail.example.com. The square brackets often contain the IP address used during the connection.

Email headers are usually added from top to bottom as the message moves through servers, but when reading the path, you often work from the bottom Received line upward. The bottommost Received line is commonly the earliest handoff recorded in the message. That said, be cautious: attackers can forge some header lines before the message reaches a legitimate mail server.

Step 3: Identify a Public IP Address

Look for IP addresses in the Received lines. Public IPv4 addresses usually look like four numbers separated by periods, such as 198.51.100.42. IPv6 addresses are longer and use colons, such as 2001:db8::1.

Ignore private or local IP addresses, because they are not routable on the public internet. Common private ranges include:

• 10.0.0.0 to 10.255.255.255
• 172.16.0.0 to 172.31.255.255
• 192.168.0.0 to 192.168.255.255
• 127.0.0.1, which refers to localhost

The best candidate is usually the earliest public IP address added by a trusted mail server. However, if the email came through Gmail, Outlook, a newsletter system, or a business email platform, the earliest reliable IP may still belong to that service rather than the original sender.

Step 4: Check Email Authentication Results

Before trusting the route, review authentication headers such as SPF, DKIM, and DMARC. These checks help determine whether the message was authorized to send on behalf of the claimed domain.

• SPF checks whether the sending server is permitted by the domain’s DNS records.
• DKIM verifies whether the message was signed by the sending domain and not significantly changed.
• DMARC tells receiving servers how to handle messages that fail SPF or DKIM checks.

If these checks fail, the visible “From” address may be spoofed. In that situation, do not assume the sender name or domain is genuine. The IP address may still be useful for reporting abuse, but it may not identify the person behind the message.

Step 5: Use an IP Lookup Tool

After you identify a likely public IP address, use a reputable IP lookup or WHOIS service to gather more context. These tools can show the owner of the IP block, the internet service provider, the autonomous system number, and approximate geolocation.

When reviewing lookup results, focus on the organization and network owner more than the exact map location. For example, if the IP belongs to a cloud hosting provider, the message may have been sent through a server or compromised account. If it belongs to a known email provider, the provider may be the only party able to investigate the actual user account.

For abuse reports, look for an abuse contact in WHOIS records. Many network operators list an email address such as abuse@example.net for reporting spam, phishing, malware, or threats.

Step 6: Preserve Evidence Properly

If the email is suspicious or harmful, preserve it before taking action. Do not simply forward it, because forwarding can alter headers or remove technical details. Instead, save the original message as an .eml or .msg file when possible, or use your email provider’s “show original” download option.

Keep the following information together:

• The full original headers
• The message body and attachments, if safe to retain
• The date and time received
• The suspected IP address and lookup results
• Any related screenshots or incident notes

If attachments or links appear malicious, do not open them on your primary device. Report them to your security team or use a controlled analysis environment.

Common Mistakes to Avoid

• Assuming the IP identifies a person: It often identifies a server, VPN, proxy, or provider.
• Trusting every header line: Some headers can be forged before the message reaches a legitimate server.
• Relying on geolocation alone: IP location data is approximate and sometimes wrong.
• Ignoring authentication results: SPF, DKIM, and DMARC can reveal spoofing or unauthorized sending.
• Replying to suspicious emails: This may confirm your address is active or expose you to further manipulation.

What to Do With the IP Address

Once you have a likely IP address, use it responsibly. For spam or phishing, report the email through your provider’s built-in reporting tools. For business email threats, send the original message to your IT or security team. For serious threats, fraud, extortion, or stalking, contact appropriate authorities and provide the preserved original email.

If the IP belongs to a hosting company or ISP, you can submit a concise abuse report. Include the full headers, timestamp, and a short explanation. Avoid exaggeration; clear technical evidence is more useful than speculation.

Conclusion

Finding an IP address from an email is a matter of examining the full headers, locating the Received lines, identifying a public IP address, and verifying it through reputable lookup sources. The process can provide valuable clues, especially when investigating spam, phishing, or mail delivery problems. Still, IP data has limits and should be interpreted carefully. Treat email headers as one piece of evidence, not as final proof of a sender’s identity.