Why you might need to find an email's IP address

An email IP address is the numerical identifier of the computer or server that sent an email message. Finding it tells you where an email actually came from — which can help you spot spoofed messages, track down spam sources, or understand why a legitimate email landed in your spam folder.

Every email carries hidden information called headers that record the path the message took from sender to your inbox. The IP address lives in those headers, along with timestamps and the names of mail servers that handled the message. Your email client normally hides this information to keep the interface clean, but you can view it in seconds.

This matters most when you receive a suspicious message claiming to be from your bank, a service you use, or someone you know. Checking the IP address and headers can confirm whether the message actually came from that organization or from someone impersonating them.

Key Takeaways

  • Email headers contain the IP address and server information for every message; you access them through your email client's settings, not by installing anything.
  • The "Received" line closest to the top of the headers shows the most recent server; the one at the bottom shows the original sender's IP address.
  • An IP address alone does not prove fraud — you also need to check whether the sender's domain name matches the organization's real domain.
  • Different email providers (Gmail, Outlook, Yahoo) use different menu paths to show headers, but the process takes under one minute in each.
  • If you find a suspicious IP address, you can search it in a free IP lookup tool to see what organization owns it and where it is located.

How to view email headers in Gmail

Open the suspicious email in Gmail. Click the three-dot menu icon in the top right corner of the message (not the menu for your whole inbox — the one for just that email). Select "Show original" from the dropdown.

Gmail will open a new tab showing the complete email source code. The headers appear at the top in plain text. Look for lines that start with "Received:" — these show the path the email took. The first "Received:" line (at the very top) is the most recent server; scroll down to find earlier "Received:" lines that trace back to the original sender. The IP address appears in square brackets, like [192.0.2.1].

You can also copy this entire text and paste it into a plain text editor if you want to save it or search within it more easily. Gmail does not store this view, so if you close the tab, you will need to open the email again and repeat the steps.

How to view email headers in Outlook and Outlook.com

For Outlook on your computer: right-click the email in your inbox and select "Message" or "Properties" (the exact wording depends on your version). A window will open showing the full headers. Look for the "Received:" lines the same way you would in Gmail — the bottom-most one shows the original sender.

For Outlook.com in your web browser: open the email and click the three-dot menu. Select "View message details" or "View message source" depending on your version. The headers will display in a panel on the right side of the screen or in a new window. The IP address appears in the same format: in square brackets within the "Received:" lines.

How to view email headers in Yahoo Mail

Open the email you want to check. Click the three-dot menu icon at the top of the message. Select "View raw message" or "View full headers" (Yahoo's wording varies by account type).

Yahoo will display the complete headers in a new window or panel. Find the "Received:" lines and look for IP addresses in square brackets. The topmost "Received:" line is the most recent server that handled the message; the bottom one is closest to the original sender.

Reading the IP address from the headers

Once you have the headers open, locate all lines beginning with "Received:". Each one represents a mail server that processed the email. The format usually looks like this:

Received: from mail.example.com (mail.example.com [203.0.113.45]) by smtp.gmail.com with SMTP id abc123

The IP address in square brackets is what you are looking for. In this example, it is 203.0.113.45. If you see multiple "Received:" lines, the one at the very bottom of the headers (the oldest entry) shows the IP address of the server that originally sent the email. The ones above it show intermediate servers that relayed the message.

Write down or copy the IP address. You will use it in the next step to find out who owns that server and where it is located.

Using an IP lookup tool to verify the sender

Once you have the IP address, search it in a free IP lookup tool to see what organization owns it. Common tools include IP2Location, MaxMind GeoIP2, WHOIS.com, and IPQualityScore. Type the IP address into the search box and the tool will return the owner's name, country, and sometimes the city.

Compare this information to the email's "From:" address and the organization's real domain name. If an email claims to be from your bank but the IP address belongs to a different company in a different country, that is a strong sign the message is fraudulent. If the IP address belongs to the correct organization and is located in the right country, the email is more likely to be legitimate.

Keep in mind that some legitimate organizations use third-party email services, so the IP address owner might not be the organization itself. For example, a small business might send email through a service like Mailchimp or SendGrid, so the IP address would belong to that service, not the business. Check the sender's domain name (the part after the @ symbol) as your primary verification — if it matches the organization's real website, the email is more likely genuine even if the IP address belongs to a different company.

What to do if you find a suspicious IP address

If the IP address does not match the organization that supposedly sent the email, do not click any links or read any attachments from that message. Do not reply to it.

If the email claims to be from your bank, credit card company, or another financial institution, contact that organization directly using a phone number or website you know is real — not a number or link from the suspicious email. Tell them you received a message and ask whether it came from them. They can confirm whether the email is legitimate and advise you on next steps.

If the email is spam or phishing, report it to your email provider. In Gmail, click the three-dot menu and select "Report phishing" or "Report spam". In Outlook, right-click the email and choose "Report message" or "Junk". In Yahoo, click the three-dot menu and select "Report as spam" or "Report phishing". Reporting helps your email provider improve its filters and protect other users.

Frequently Asked Questions

Can someone hide their real IP address when sending an email?

Not completely. The originating mail server's IP address will always appear in the headers because email requires it to function. However, someone can use a mail service, proxy, or VPN to mask their personal computer's IP address. The IP you find will belong to the service they used, not their home or office. This is why checking the sender's domain name is equally important.

What if the headers show multiple IP addresses?

Each "Received:" line represents a different mail server. The bottom-most one is the original sender; each one above it is a server that relayed the message toward your inbox. This is normal and does not indicate fraud. You should focus on the bottom-most IP address, which is closest to the actual source.

Does checking email headers work the same way on my phone?

Most phone email apps do not show full headers easily. If you need to check headers on a phone, open the email in your web browser instead of the app — go to Gmail.com, Outlook.com, or Yahoo.com in Safari or Chrome. The steps are the same as the web versions described above.

Can I report an IP address to the police if I think an email is a scam?

You can report the email itself to your local police department's non-emergency line or through their online reporting system, and include the IP address as part of your report. However, police typically investigate only large-scale fraud. For individual scam emails, reporting to your email provider and to the Federal Trade Commission at ReportFraud.ftc.gov is usually more effective.