You can see the IP address of an email sender by looking at the email headers, but what you find depends on how the email was sent and routed

Every email passes through one or more mail servers on its way to your inbox, and each server stamps the message with technical information called headers. These headers contain IP addresses — the numerical identifiers that mark where the email came from and where it traveled. You can view these headers in most email clients, though the process differs depending on whether you use Gmail, Outlook, Apple Mail, or another service.

The catch: the IP address you find may not belong to the person who sent the email. It might belong to their email provider's server, a corporate mail server, a VPN service, or a proxy. If someone sent the email through Gmail, you will see Google's server IP, not their home internet address. If they used a VPN, you will see the VPN provider's IP. This matters because finding an IP address is not the same as identifying a person.

Key Takeaways

  • Email headers contain IP addresses, but they show the mail server that sent or relayed the message, not necessarily the sender's location or identity.
  • In Gmail, open the email, click the three dots, select "Show original," and look for "Received:" lines to find IP addresses.
  • In Outlook, right-click the email, choose "Message Properties" or "View Message Details," and scroll to the Internet Headers section.
  • IP addresses from major providers like Gmail, Outlook, or corporate servers tell you which service was used, not who the person is.
  • If you need to identify someone behind an email, contact law enforcement or your email provider's abuse team rather than trying to trace the IP yourself.

How to view email headers in Gmail

Open the email you want to examine. In the top right, click the three vertical dots (the menu icon). A dropdown menu will appear. Select "Show original" — this opens a new tab or window with the full email source code, including all headers.

Look for lines that begin with "Received:". These lines are stacked from bottom to top, with the oldest entry at the bottom. Each "Received:" line shows an IP address in brackets, like [192.0.2.1] or [2001:db8::1]. The topmost "Received:" line (the last server to handle the email) is usually the most relevant, but you may see several. The first one in the chain (at the bottom) shows where the email originated.

You will also see "From:" and "Return-Path:" lines, but these can be spoofed — someone can forge these fields. The "Received:" headers are harder to fake because they are added by actual mail servers as the message passes through.

How to view email headers in Outlook

Open the email. Right-click anywhere in the message body. A context menu will appear. Select "Message Properties" (on Windows) or "View Message Details" (on Mac). A new window opens showing the full headers.

Scroll down to find the "Internet Headers" section. This contains the same "Received:" lines you would see in Gmail. Copy the entire headers section if you need to examine it more carefully or share it with someone else.

If right-clicking does not work, try clicking the three dots in the top right of the email, then look for "View Message Details" or "View Message Source" depending on your Outlook version.

How to view email headers in Apple Mail and other clients

In Apple Mail, open the email. Go to the menu bar and click "View," then select "Message" and "All Headers." The headers will display at the top of the email window. Look for the "Received:" lines as described above.

In other email clients like Thunderbird, Yahoo Mail, or ProtonMail, the process varies. Generally, look for a menu option labeled "View Source," "Show Headers," "View Original," or "Message Details." If you cannot find it, check the email provider's help documentation for your specific client.

What the IP address actually tells you

An IP address is a number, not a name. By itself, it does not identify a person. If the email came through Gmail, the IP belongs to Google's mail server, not the sender. If it came through a corporate network, the IP belongs to that company's mail server. If the sender used a VPN or proxy service, the IP belongs to that service.

You can look up an IP address using a free tool like WhatIsMyIPAddress.com or MaxMind GeoIP to see what country or city it is registered to and which organization owns it. This tells you the mail server's location, not the sender's. A person in New York using Gmail will show a Google server IP that might be registered to a data center in Virginia or California.

If you need to know who actually sent an email — for example, if it is harassment, fraud, or a threat — do not rely on IP tracing. Contact your email provider's abuse team with the full headers, or contact law enforcement. They have tools and legal authority to work with mail servers and internet service providers to identify someone.

Why email headers can be misleading

The "From:" field in an email can be forged. Someone can send an email that appears to come from your bank, your boss, or anyone else. The headers are more reliable because they are added by actual mail servers, but they still show only the path the email took through the mail system, not the sender's identity.

A phishing email might show headers from a legitimate mail server if the attacker compromised an account or used a service that does not verify sender identity carefully. The IP address in the headers will match the mail server used, but that does not mean the person who owns that account sent it.

This is why security experts recommend checking headers when you suspect fraud or phishing, but also why checking headers alone is not enough. If an email seems suspicious, do not click links or download attachments, regardless of what the headers show.

When you might need to trace an email

If you received a threatening email, a blackmail attempt, or a message that is part of a crime, save the full headers and report it to law enforcement. Include the email address it came from, the date and time, and the full headers. Do not try to contact the sender or investigate further on your own.

If you received a phishing email pretending to be from your bank or a service you use, forward it to that organization's abuse or security team. Include the headers. They can tell whether the email actually came from their servers or was spoofed.

If you are locked out of your own account and need to prove someone else accessed it, your email provider can examine server logs and IP addresses to show when and where your account was accessed. Contact their support team.

Frequently Asked Questions

Can I find someone's home address or real name from their email IP?

No. An IP address is assigned to an internet connection, not a person. Even if you find the IP, you would need to contact the internet service provider with a legal order to learn who the account holder is. Email providers and ISPs do not release this information to the public.

What if the email came through a VPN or proxy?

The IP address will belong to the VPN or proxy service, not the sender. You will see the VPN provider's location and company name when you look up the IP. You cannot trace further without the VPN provider's cooperation, which they typically will not give without a legal order.

Does viewing headers tell me if an email is spam or phishing?

Headers can help. If the "From:" address claims to be from your bank but the "Received:" headers show the mail came from an unrelated server, that is a red flag. However, headers alone do not prove an email is malicious. Use them as one piece of evidence, along with checking for suspicious links and unusual requests.

Can someone hide their IP address when sending email?

Not completely. Mail servers always add "Received:" headers as the email passes through. However, using a VPN, proxy, or a mail service that does not log IP addresses makes it much harder to trace. This is why law enforcement works with mail providers and ISPs rather than relying on headers alone.

Is it legal to look up someone's IP address from their email?

Looking up an IP address in public headers is legal. Attempting to use that IP to hack into someone's computer, access their network, or identify them for harassment is not. If you suspect a crime, report it to law enforcement rather than investigating yourself.