Check the email headers to see where a message came from

Every email carries hidden information called headers that show the path the message took from sender to your inbox. The headers include the IP address of the server that sent the email — not the sender's personal computer, but the mail server their email provider uses. You can view these headers in any email client and read the IP address directly from the "Received" line.

The process differs slightly depending on whether you use Gmail, Outlook, Apple Mail, or another email service. In each case, you open a specific email, find a menu option to show headers or source code, and look for lines that begin with "Received:" The first Received line (at the bottom of the header block) shows the original sending server's IP address.

Keep in mind that the IP address you find belongs to the email provider's server, not to the person who sent the message. A Gmail sender's email will show Google's server IP, not their home or office IP. This matters if you are trying to trace a suspicious email — the IP tells you which mail service was used, but not the sender's location.

Key Takeaways

  • Email headers contain a "Received:" line that shows the IP address of the mail server that sent the message.
  • In Gmail, click the three dots next to an email and select "Show original" to see the full header with IP addresses.
  • In Outlook on the web, click the three dots and choose "View message details" or "View message source" to find the Received lines.
  • The IP address shown belongs to the email provider's server, not the sender's personal device or location.
  • Multiple Received lines appear in headers because the email passes through several servers; the bottom one shows the original sender's mail server.

How to view headers in Gmail

Open the email you want to check. Click the three dots (more actions menu) in the top right corner of the message. Select "Show original" from the dropdown menu. A new tab or window opens showing the raw email source, including all headers.

Scroll to the top of the source view. Look for the line that begins with "Received: from" — this is usually the first Received line you see. The IP address appears in brackets or after the word "from". It looks like this: [203.0.113.45] or 203.0.113.45. This is the IP address of Google's mail server that handled the message.

If you see multiple Received lines, scroll down to find the very last one. That final Received line shows the original sending server before the message entered Gmail's system. The IP addresses in the middle lines show the path the email took through various servers.

How to view headers in Outlook

Open the email in Outlook on the web or the Outlook desktop app. In the web version, click the three dots next to the sender's name or in the top right corner. Select "View message details" or "View message source" depending on your version.

In the desktop app, right-click the email and choose "Message Options" or "Properties." Look for a section labeled "Internet Headers" or "Message Headers." The headers display in a text box. Find the "Received:" lines and locate the IP address in brackets, such as [192.0.2.100].

The first Received line (at the top of the headers section in Outlook) shows the most recent server the message passed through. Scroll down to see earlier Received lines that trace the message backward to its origin. The last Received line in the chain shows the original sending server's IP.

How to view headers in Apple Mail and other clients

In Apple Mail on Mac, open the email and go to the menu bar. Click "View" and select "Message" then "All Headers." The headers appear at the top of the email. Look for "Received:" lines and find the IP address in brackets.

In Thunderbird, right-click the email and select "View Message Source." The full headers and message body display. Find the Received lines and identify the IP addresses.

In other email clients like Yahoo Mail or ProtonMail, look for a menu option labeled "View Source," "Show Headers," "View Original," or "Message Details." The location varies, but the principle is the same: you are looking for the raw email source code where the Received lines contain the IP addresses.

Understanding what the IP address tells you

The IP address in an email header identifies the mail server, not the sender's device. If someone sends you an email from Gmail, the IP address belongs to one of Google's mail servers, not to their home WiFi or office network. This is true for Outlook, Yahoo, ProtonMail, and any other email service.

You can search the IP address online using a reverse IP lookup tool to find out which company or service owns that server. This helps you confirm whether the email came from a legitimate service or from a spoofed or suspicious source. For example, if an email claims to be from your bank but the IP address belongs to a different company entirely, that is a red flag.

If you receive a suspicious email and want to report it, the IP address and full headers are useful information to include. Email providers and security teams use headers to trace abuse and block malicious senders. However, headers alone cannot prove who sent the email — they only show which server was used.

Why multiple IP addresses appear in headers

An email does not travel directly from sender to recipient. Instead, it passes through multiple mail servers, and each one adds a "Received:" line to the header. The first Received line (at the top) shows the most recent server — usually your email provider's server that delivered the message to your inbox. The last Received line (at the bottom) shows the original sending server.

Reading the headers from bottom to top traces the email's journey backward. The bottom Received line shows where the email started. Each line above it shows a server it passed through. This chain helps you understand the path the message took and identify where it originated.

Sometimes you see IP addresses that belong to your own email provider multiple times. This happens when large services like Gmail or Outlook use many servers to handle mail. The repeated IPs do not mean something is wrong — it is normal for a message to pass through several of the same company's servers.

Frequently Asked Questions

Can I find the sender's home or office IP address from an email?

No. The IP address in an email header belongs to the mail server used to send the message, not to the sender's computer or network. If someone sends you an email from Gmail, you see Google's server IP, not their home WiFi or office network IP. To find a sender's personal IP, you would need access to their device or network logs, which email headers do not provide.

What does it mean if the IP address is not in brackets?

IP addresses in headers appear in brackets like [203.0.113.45] or sometimes without brackets like 203.0.113.45. Both formats mean the same thing. The brackets are just a formatting choice. Look for any string of four numbers separated by periods in the Received lines.

Can I use the IP address to report spam or phishing?

Yes. If you receive spam or a phishing email, the IP address and full headers are useful information to include when reporting to your email provider or to organizations like the Anti-Phishing Working Group. However, headers alone do not prove who sent the email — they show which server was used. Your email provider uses this information along with other data to investigate and block abusive senders.

Why do I see different IP addresses in the same email's headers?

Each "Received:" line shows a different mail server the message passed through. The email travels from the sender's mail server, through intermediate servers, and finally to your mail server. Each server adds a Received line with its own IP address. Reading from bottom to top shows you the complete path the email took.

Is the IP address the same every time someone sends me an email?

Not necessarily. A large email provider like Gmail uses many servers, so the IP address may differ from message to message. However, the IP will always belong to that provider's network. If you see a completely different company's IP address in an email that claims to be from a trusted sender, that is worth investigating.