What an email IP address tells you

Every email carries hidden information about where it was sent from. That information is an IP address — a string of numbers like 192.168.1.1 that identifies the computer or server that sent the message. Finding it requires looking at the email's full headers, which most email programs hide by default.

An IP address can tell you roughly where an email originated — sometimes the city or country, sometimes just the internet service provider. It cannot tell you the sender's name or prove they wrote the message. If someone spoofed an email address (made it look like it came from someone else), the IP address shows where the email actually came from, not who typed it.

People look up email IPs for a few reasons: to check whether a suspicious email came from where it claims to, to report phishing or spam to the right provider, or to understand the path a message took through the internet. It is not a way to identify someone by name, and it should not be your only tool for deciding whether to trust an email.

Key Takeaways

  • Email headers contain the IP address of the server that sent the message, but you must view full headers to see it — most email programs hide them by default.
  • The first IP address in the headers is usually the most recent one; earlier addresses show servers the message passed through on its way to you.
  • You can paste an IP address into a free lookup tool to see the country and approximate location, but the result is often vague and may not pinpoint a person.
  • If you find a phishing or spam email, reporting it to your email provider is more useful than looking up the IP yourself.

How to view email headers in Gmail

Open the email in Gmail and click the three dots in the top right corner of the message. Select "Show original" from the menu. A new tab or window opens with the full email source code, including all headers.

Look for lines that start with "Received:" — these show the path the email took. The topmost "Received:" line is usually the most recent server; each line below it is an earlier hop. The IP address appears after "from" or "by" in square brackets, like this: [192.0.2.146]. Copy the first IP address you see (the one closest to the top).

How to view email headers in Outlook

Open the email and click "File" in the top menu. Select "Properties" (on Windows) or "Get Info" (on Mac). A window opens showing message details. Look for a section called "Internet Headers" or scroll down until you see lines starting with "Received:". Copy the first IP address you find in square brackets.

On Outlook.com (the web version), open the email and click the three dots. Select "View message details" or "View message source". The headers appear in a panel on the right side of the screen.

How to view email headers in Apple Mail

Open the email and go to the "View" menu at the top. Select "Message" and then "All Headers". The full headers now appear at the top of the email. Scroll through the "Received:" lines and copy the first IP address you see in square brackets.

If you do not see an "All Headers" option, try clicking the small arrow next to "Details" at the top of the email, or right-click the message and look for "View Full Headers" or similar.

How to look up an IP address

Once you have the IP address, paste it into a free lookup tool. Common options include IP2Location, MaxMind GeoIP2, IPQualityScore, or simply searching "IP lookup" in your browser. Most of these tools show the country, approximate city, internet service provider, and sometimes whether the IP belongs to a data center or residential connection.

The location is often accurate to the city level, but not always — it depends on how recently the IP database was updated and whether the ISP reports its location data. A result showing "New York" might mean the server is in New York, or it might mean the ISP's main office is there. If the IP belongs to a cloud provider like Amazon Web Services or Google Cloud, the location may be even less precise.

Do not assume the location is where the sender is sitting. A person in Tokyo could send an email through a server in London. A phisher could use a VPN or proxy to mask their real location. The IP address is one piece of information, not proof of identity or intent.

What to do if you find a suspicious email

If you suspect an email is phishing, spam, or fraud, reporting it to your email provider is more effective than investigating the IP yourself. In Gmail, click the three dots and select "Report phishing" or "Report spam". In Outlook, click the three dots and select "Report" or "Junk". In Apple Mail, click "Mail" in the top menu and select "Junk Mail" or "Report Junk".

When you report an email, your provider's security team reviews it and can take action against the sender's account or server. They have access to much more information than you do — including patterns of abuse, complaints from other users, and the ability to contact the IP's hosting provider. If you are reporting a serious crime like fraud or identity theft, contact your local police or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.

Why email headers can be misleading

Email headers can be forged or altered in transit. A sender cannot easily fake the "Received:" lines added by legitimate mail servers, but they can fake the "From:" line that shows the sender's address. This is why a phishing email might have a fake "From:" address but a real IP address pointing to the attacker's server.

Some legitimate emails also pass through multiple servers before reaching you, so the first IP address might belong to a mail relay service, not the original sender. If an email came from a large company like Microsoft or Google, the IP might belong to their data center, not the person who sent it. The headers show the technical path, not necessarily the human story.

Frequently Asked Questions

Can I find out someone's home address from their email IP?

No. An IP address shows the internet service provider and approximate city, but not a street address. Even if you know the ISP, they do not release customer information to the public. Law enforcement can request that information with a warrant, but you cannot.

Does looking up an IP address tell me if an email is real?

Not by itself. A real company's email might come from a data center in a different country. A phishing email might come from a residential IP that looks legitimate. Check the sender's address, look for spelling mistakes, and hover over links to see where they actually go. The IP is one clue, not the whole picture.

What if the IP address is from a VPN or proxy?

Then the lookup tool will usually tell you it is a VPN or data center, not a residential connection. This does not prove the sender is doing anything wrong — many people and companies use VPNs for privacy. It just means the IP does not reveal the sender's real location.

Can I report an email to the IP's hosting provider myself?

You can try. Most hosting providers have an abuse email address (often abuse@[provider].com). But most providers receive thousands of reports and prioritize those from other companies or law enforcement. Your email provider's report is usually more effective because they have a direct relationship with the hosting provider.

Is finding an email's IP address illegal?

No. The headers are part of the email you received, and looking at them is not illegal. Using the information to harass, threaten, or hack someone is illegal, but simply reading headers and looking up an IP address is not.