What you can actually learn from an email's IP address

An email's IP address tells you the server that sent or relayed the message, not necessarily who wrote it. If you receive an email from someone's personal account, the IP usually belongs to Gmail, Outlook, Yahoo, or another email provider — it does not identify the person. If the email came from a business domain (like someone@company.com), the IP might point to that company's mail server, which narrows the location to their office or data center.

The practical reason to look up an email IP is to check whether a message is suspicious. Scammers often send from servers in countries you would not expect, or from servers known for spam. A legitimate business email from a CEO should come from the company's own mail server, not from a free Gmail account. If you are being harassed or threatened, the IP address is one piece of evidence you can share with law enforcement or your email provider.

What an IP address cannot do: it cannot identify an anonymous sender by name, it cannot prove who physically typed the message, and it cannot override the privacy protections your email provider has in place. If someone is harassing you, the email provider themselves (not the IP address) is your fastest route to action.

Key Takeaways

  • Email IP addresses come from the mail server that sent or relayed the message, which is usually your email provider's server, not the sender's home or office.
  • You can view the IP address by opening the email's full headers in Gmail, Outlook, Yahoo, or Apple Mail — the steps differ slightly by provider.
  • An IP address can show you the general location and owner of a mail server, but it cannot identify a person or override your email provider's privacy rules.
  • If you are being harassed or threatened, report the email directly to your provider rather than investigating the IP yourself — they have tools and legal authority you do not.
  • Scammers often spoof email addresses and use relay servers to hide their origin, so a suspicious IP address is one warning sign among many, not proof of fraud.

How to find the IP address in Gmail

Open the email you want to check. Click the three dots in the top right corner of the message, then select "Show original." A new tab opens with the full email headers — all the routing information the message collected as it traveled from server to server.

Look for the line that begins with "Received: from" at the very top of the headers. The first one shows the most recent server that handled the message. You will see text like "Received: from mail.google.com (mail.google.com. [142.251.41.229])" — the number in brackets is the IP address. If there are multiple "Received" lines, each one is a hop the email took. The bottom one is closest to the original sender.

Copy the IP address and paste it into an IP lookup tool like IP2Location, MaxMind, or AbuseIPDB. These tools show you the country, city, and organization that owns the IP. If the email claims to be from your bank but the IP is registered in a country where your bank has no offices, that is a red flag.

How to find the IP address in Outlook

Open the email and click the three dots at the top right. Select "View message details" or "View message source" depending on whether you are using Outlook.com or Outlook desktop. The full headers appear in a new window or panel.

Scroll to the top and find the "Received:" lines. The first one at the very top is the most recent server. Look for the IP address in square brackets — it usually appears after the server name. For example: "Received: from mail.outlook.com ([52.101.23.45])". Copy that IP and search it in an IP lookup tool.

How to find the IP address in Yahoo Mail

Open the email and click the three dots in the top right corner. Select "View raw message." The full headers display in a new window. Find the "Received:" line at the top — the IP address is in square brackets after the server name.

Yahoo sometimes shows multiple "Received" lines if the message passed through several servers. The first one is the most recent. Copy the IP address and look it up in an IP database.

How to find the IP address in Apple Mail

Open the email. In the menu bar at the top, click "Message," then select "Show All Headers." The full headers appear at the top of the email window. Look for "Received:" at the very top — the IP address is in square brackets.

If you are using iCloud Mail on the web, open the email, click the three dots, and select "View Message Source." The headers appear in a new window.

What to do if the IP address looks suspicious

If the IP belongs to a country you do not recognize, or if it is listed on spam databases like AbuseIPDB, do not click links or read attachments from that email. Do not reply to it. Instead, report it to your email provider.

In Gmail, click the three dots and select "Report phishing." In Outlook, click the three dots and choose "Report." In Yahoo, click "Spam." In Apple Mail, select "Message" from the menu, then "Mark as Junk." Your email provider uses these reports to block similar messages and protect other users.

If the email contains a threat or harassment, take a screenshot of the full headers (including the IP address) and report it to your local police or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Do not try to contact the IP owner yourself — that can escalate the situation and may not be safe.

Why email providers do not always show you the sender's real location

Most personal emails come from Gmail, Outlook, Yahoo, or Apple — so the IP address points to those companies' data centers, not to the person who sent the message. A scammer using a Gmail account will show a Gmail IP, not their home IP. This is why the IP address alone cannot identify someone.

Business emails are more revealing. If someone claims to work for a company but the email comes from a free Gmail account instead of the company's domain, that is a sign the email is fake. Legitimate companies send from their own mail servers, which have their own IP addresses.

Some scammers use email relay services or compromised servers to hide their origin. They send through a chain of servers so the "Received" line at the bottom (closest to the original sender) is harder to trace. This is why IP addresses are useful context but not definitive proof.

Frequently Asked Questions

Can I find out who sent an email just from the IP address?

No. The IP address shows you the mail server, not the person. If the email came from Gmail, the IP points to Google's servers, not the sender's home or office. If you need to identify a sender, ask your email provider — they have access to account information and can help with harassment or fraud.

What does it mean if the IP address is from a different country than the sender claims?

It is a warning sign, especially if the sender claims to be from your bank or a company with no offices in that country. Scammers often send from servers far from their targets. But legitimate emails can also come from unexpected locations if the sender is traveling or using a VPN. Look at other signs too: does the email ask for passwords, contain spelling errors, or use a suspicious link?

Is looking up an IP address safe?

Yes. Looking up an IP address in a public database is safe — you are not contacting the server or downloading anything. Do not click links in the suspicious email itself, but searching the IP number in a lookup tool is harmless.

Should I reply to the email or contact the IP owner if something seems wrong?

No. Do not reply to a suspicious email or try to contact the IP owner. Report it to your email provider instead. If it is a threat or harassment, contact your local police or the FBI's IC3.

Why do some emails have multiple IP addresses in the headers?

Each "Received:" line shows a server the email passed through. A message might go from the sender's mail server to a relay server to your mail server — each hop adds a line. The first line at the top is the most recent server (usually your email provider). The last line at the bottom is closest to where the email originated.