What you can actually learn from an email's IP address

An email's IP address tells you where the message physically came from — which server sent it and roughly where that server sits geographically. You find it by reading the email's full headers, which most email programs hide by default. The IP alone does not identify a person; it identifies a machine or a mail service. A Gmail message shows Google's IP, not the sender's home address. A work email shows your company's mail server, not your colleague's desk.

People look for email IP addresses for two main reasons: checking whether a suspicious message came from where it claims to, or investigating phishing attempts. The headers also show the path the message took — which servers handled it, in what order, and how long it sat in each one. This path is useful for spotting forgery, but it requires knowing what a legitimate path looks like for that sender.

Key Takeaways

  • Email headers are hidden by default in Gmail, Outlook, and most other services; you must turn on a "show original" or "view message source" option to see them.
  • The IP address appears in the "Received" headers, usually near the top, and shows which mail server sent the message — not necessarily who wrote it.
  • An IP address alone cannot prove who sent an email; you need to match it against known server IPs for that sender's organization or service.
  • Phishing emails often come from legitimate mail services (Gmail, Yahoo, Outlook) because the attacker created a fake account, so the IP will look normal.

How to view email headers in Gmail

Open the email you want to check. In the top right, click the three vertical dots (the menu icon). Select "Show original" from the dropdown. A new tab opens showing the raw email code, including all headers.

The headers appear at the top in a block of text. Look for lines that start with "Received:" — these show the path the email took. The first "Received:" line (the one closest to the top) shows the most recent server that handled it. Read the headers from bottom to top to trace the message backward from sender to your inbox.

Each "Received:" line contains an IP address in square brackets, like [203.0.113.45]. That number is what you are looking for. Write it down or copy it. You can then search that IP in a free IP lookup tool to see what organization owns the server and where it is registered.

How to view email headers in Outlook and Outlook.com

In Outlook on the web, open the email. Click the three dots in the top right and select "View message details" or "View message source." A panel opens on the right showing the headers.

In Outlook desktop (the Windows or Mac process), right-click the email in your inbox and select "Properties" (Windows) or "View Message Details" (Mac). A window opens with a "Message" tab. Click "Internet Headers" or "Internet Message ID" to see the full headers.

Look for the "Received:" lines and the IP addresses in square brackets. The topmost "Received:" line is the last server to touch the email before it reached you — usually your email provider's server. The bottom "Received:" line is closest to the original sender.

How to view email headers in Apple Mail and Yahoo Mail

In Apple Mail on Mac, open the email. Go to the menu bar and click "Message," then select "Raw Message Source." A window opens showing all headers.

In Yahoo Mail on the web, open the email. Click the three dots in the top right and select "View Raw Message." The headers appear in a new window or tab.

In both cases, search the text for "Received:" and look for IP addresses in square brackets. Copy the IP and note which "Received:" line it came from — the order matters when you are tracing the message path.

What the IP address actually tells you

Once you have the IP, you can search it on a free site like IP2Location, MaxMind, or WHOIS lookup tools. These show you the country, city, and organization that owns or operates that IP address. If the email claims to be from your bank but the IP is registered to a data center in another country, that is a red flag.

However, many legitimate emails will show IPs from unexpected places. A message from a coworker might route through your company's cloud mail server in Virginia even though your coworker is in California. A Gmail message always shows Google's IP, not the sender's. A message from a small business might route through a third-party email service you have never heard of.

The IP is most useful when you already know what the legitimate IP should be. If you work for a company, ask your IT department what IP range your mail server uses. If you are checking a message from a bank, call the bank's main number (not a number in the email) and ask what mail servers they send from. Then compare the IP in the suspicious email to that list.

Why phishing emails often look legitimate in the headers

A common mistake is assuming a suspicious email is fake because the IP looks wrong. In reality, many phishing emails come from real, legitimate mail servers — because the attacker created a fake account on Gmail, Yahoo, Outlook, or another free service. The IP will be Google's or Microsoft's, which looks completely normal.

The real clue is usually not the IP but the sender's email address itself. A phishing email might come from paypa1.com (with a number one instead of the letter L) or support@bankname.info instead of the real domain. The headers will show that the message came from a legitimate mail service, but the "From:" field will show the fake address.

This is why checking headers is useful for learning how email routing works, but it is not a reliable way to spot phishing on its own. Combine it with other checks: does the sender's actual email address match what you expect, does the message ask you to click a link or enter a password, and does the tone match how that organization usually contacts you.

When to involve your email provider or IT department

If you receive a phishing email or a message that appears to be from someone you know but looks suspicious, report it to your email provider. In Gmail, click the three dots and select "Report phishing." In Outlook, click the three dots and select "Report" or "Report phishing." In Yahoo Mail, click the three dots and select "Report as spam" or "Report phishing."

Your email provider uses these reports to train their filters and may investigate the sender's account. If the email came from inside your organization, forward it to your IT department or security team with the full headers included. They can check whether the IP matches your company's mail servers and whether the account has been compromised.

Do not click links or read attachments from suspicious emails, even if the headers look legitimate. Do not reply to the email or give the sender any information. If you are unsure whether an email is real, contact the organization directly using a phone number or website you find yourself, not one provided in the email.

Frequently Asked Questions

Can I find someone's home IP address from their email?

No. The IP in an email header shows the mail server that sent it, not the sender's computer or home network. If someone uses Gmail, the IP is Google's. If they use their work email, the IP is their company's mail server. To find someone's actual computer IP, you would need access to their device or network, which email headers do not provide.

What if the IP address is blocked or private?

Some organizations use private IP addresses internally or mask their mail servers behind a proxy. In those cases, the IP lookup will show limited information — maybe just the country or the hosting provider. This is normal and does not mean the email is fake. It usually means the sender's organization is security-conscious and does not want to expose their exact server locations.

Can I trace an email back to a specific person using the IP?

Not reliably. The IP shows you the mail server, but many people use the same mail server. If 100 people at a company use the same corporate mail server, the IP tells you the message came from that company, not which person sent it. Law enforcement can subpoena email providers for more detailed logs, but you cannot do that yourself.

Is it illegal to look up someone's email IP address?

No. Email headers are part of the message itself, and looking them up is normal troubleshooting. However, using that information to harass someone, impersonate them, or gain unauthorized access to their accounts is illegal. Looking at headers is fine; acting on them in harmful ways is not.

What should I do if I find a suspicious IP in my email?

First, check whether the sender's email address itself looks wrong — misspelled domain, unusual extension, or an address you do not recognize. If the address looks legitimate, contact the sender through a different method (phone, in person, or a website you trust) to confirm they sent the message. If you cannot confirm it, delete the email and report it to your email provider.