What you can actually learn from an email's IP address

An email header contains the IP address of the server that sent it, but what you can do with that information is narrower than you might think. The IP address tells you which mail server handled the message — not necessarily where the person who wrote it was sitting. If someone sent you mail from Gmail, you will see Google's server IP, not their home address. If they sent it from their workplace, you will see their company's mail server.

The IP address becomes useful when you are trying to understand whether an email came from where it claims to come from. A message that says it is from your bank but routes through a server in another country is a red flag. An email from a coworker that bounces through an unfamiliar server might mean their account was compromised. You can cross-reference the IP against known mail servers, but you cannot use it to pinpoint a person's location or identity on your own.

Key Takeaways

  • Email headers are hidden by default in most mail programs — you must open the full headers to see the IP address at all.
  • The IP address in an email shows which mail server sent it, not where the sender was physically located when they wrote it.
  • You can look up an IP address using free tools like MXToolbox or IP2Location to see what organization owns that server.
  • If you suspect fraud or harassment, forward the full email with headers to your mail provider or law enforcement rather than investigating the IP yourself.

How to view the full email header in Gmail

Gmail hides the technical details of an email by default. To see the headers where the IP address lives, open the email and look for the three-dot menu icon in the top right corner of the message. Click it and select "Show original" from the dropdown. A new window will open showing the raw email code.

Scroll to the top of this raw view. You are looking for lines that begin with "Received:" — these trace the path the email took through mail servers. The first "Received:" line at the very top shows the most recent server, which is usually Gmail's own infrastructure. The second or third "Received:" line often contains the IP address of the server that originally sent the message. It will look like this: Received: from mail.example.com (mail.example.com. [192.0.2.1]). The numbers in brackets are the IP address.

How to view the full email header in Outlook and Outlook.com

In Outlook on the desktop, open the email and click the "File" tab at the top left. Select "Properties" from the menu. A window will open with a "Message" tab — click it. At the bottom of this window is a large text box labeled "Internet Headers." This box contains all the header information, including the IP addresses of the servers that handled the message.

In Outlook.com (the web version), open the email and click the three-dot menu icon in the top right. Select "View message details" or "View message source" depending on your version. The headers will display in a panel on the right side of the screen. Look for the "Received:" lines at the top, just as you would in Gmail.

How to view the full email header in Apple Mail

Open the email in Apple Mail and go to the "View" menu at the top of your screen. Select "Message" and then "All Headers." The full headers will now display above the email body. The "Received:" lines at the top contain the IP addresses you are looking for. On some versions of macOS, you may need to select "View" and then "Show All Headers" instead.

If you are using Mail on an iPhone or iPad, the process is different. Open the email, tap the sender's name at the top, and look for a "Details" button. This shows limited header information, but may not display the full IP address chain. For complete headers on mobile, you may need to forward the email to yourself on a desktop computer or use a web-based mail client.

What to do once you have found the IP address

Once you have the IP address, you can look it up using a free tool like MXToolbox (mxtoolbox.com) or IP2Location (ip2location.com). Enter the IP address into the search box. The tool will tell you which organization owns that server and often what country or region it is registered to.

If the IP belongs to a major mail provider like Google, Microsoft, or Yahoo, that tells you the email came through their system — which is normal and expected. If the IP belongs to a small business or an unfamiliar hosting company, that might tell you something about where the email originated, though not where the sender was physically located. A person in New York can send mail through a server in California or overseas.

Do not assume an IP address proves fraud or identifies a person. IP addresses change, are shared among many users, and can be spoofed in some cases. If you believe an email is fraudulent or threatening, take the full email with headers to your mail provider's abuse team or to law enforcement. They have tools and authority to trace mail in ways you cannot.

When the IP address does not tell you what you need

Many people look up an email's IP address hoping to identify who sent it or where they were. In most cases, the IP address will not answer either question. If someone sent you mail from their work email, the IP belongs to their employer's mail server, not to them. If they used Gmail or Outlook, the IP belongs to Google or Microsoft, not to the sender.

Spoofed emails — messages that fake their sender address — can have misleading headers too. A scammer can make an email appear to come from your bank while routing it through a completely different server. The IP address might be the only clue that something is wrong, but it is not proof of identity.

If you need to know who actually sent an email, your mail provider is your best resource. Gmail, Outlook, and Yahoo all have abuse reporting systems. Forward the suspicious email to them with full headers, and their security teams can investigate using information you cannot access.

Frequently Asked Questions

Can I find out where someone lives from their email IP address?

No. The IP address shows which mail server handled the email, not where the sender was physically located. Even if the IP is registered to a city, the person who sent the email could be anywhere in the world. They may have been using a work email, a web-based mail client, or a mail app that routes through a server far from their actual location.

What does it mean if the IP address is from a different country than the sender claims?

It could mean the sender was traveling, using a work account based overseas, or using a mail service hosted in another country. It could also be a sign of fraud — for example, a fake bank email routed through a server in Eastern Europe. The IP address alone is not proof of anything, but it is worth noting if it contradicts what the sender told you.

Can I report someone to the police based on their email IP address?

Not on your own. Law enforcement and mail providers have legal tools to trace emails that you do not. If you have received threatening, harassing, or fraudulent mail, forward the full email with headers to your mail provider's abuse team and file a report with local police or the FBI's Internet Crime Complaint Center. They can subpoena records from mail providers and ISPs to identify the actual sender.

What if I see multiple IP addresses in the email headers?

Multiple IP addresses are normal. Each "Received:" line represents one mail server the message passed through on its way to you. The first one at the very top is the most recent — usually your own mail provider. The ones below it show the path backward to the original sending server. Read them from top to bottom to trace the email's journey.

Is it safe to share an email's IP address with someone else?

Yes. An IP address is not sensitive information in the way a password or credit card number is. However, do not share the full email headers with strangers, because headers can contain other details like your own mail server information. If you need to report an email, share it directly with your mail provider or law enforcement rather than posting it online.