What you can actually learn from an email's IP address

An email's IP address tells you where the message physically came from — the server that sent it. You can extract this information from the email's headers, which are the technical details hidden behind the message itself. However, what you learn is limited: an IP address shows you a general location and internet provider, but not a person's home address or identity. If you're trying to track down who sent you something, the IP alone won't get you there.

The headers also contain timestamps, routing information, and the names of servers the email passed through. This data is useful for spotting spam, phishing attempts, or confirming whether an email actually came from the company it claims to be from. But extracting and reading headers takes a few steps, and interpreting what you find requires understanding what you're looking at.

Key Takeaways

  • Email headers contain the IP address of the server that sent the message, but you have to unhide them first — they don't show by default in Gmail, Outlook, or most other services.
  • The IP address shows you a general location and internet service provider, but not the sender's name or home address.
  • Phishing emails often come from IP addresses that don't match the company they claim to represent, which is a red flag worth checking.
  • Different email providers have different steps for viewing headers, and the headers themselves use technical formatting that takes practice to read.

How to view email headers in Gmail

Open the email you want to check. Click the three dots in the top right corner of the message, then select "Show original" from the menu. A new tab or window will open showing the raw email data — this is the full header.

Look for the line that starts with "Received: from" at the very top of the header. This line contains the IP address of the server that sent the email, usually in square brackets like [192.0.2.1]. If there are multiple "Received: from" lines, the topmost one is the most recent server the email passed through — usually the one that sent it. The lines below show earlier stops in the email's journey.

You can also search within the header by pressing Ctrl+F (or Cmd+F on Mac) and typing "Received: from" to jump straight to the relevant lines. Copy the IP address if you want to look it up further.

How to view email headers in Outlook and Microsoft 365

Open the email and click the three dots in the top right corner. Select "View message details" or "Message details" depending on your version. This opens a panel showing header information, though it's formatted differently than Gmail's raw view.

Look for "Internet Headers" or scroll down in the details panel to find the full headers. If you don't see a full header option, click "View message source" or "View original" to see the raw data like you would in Gmail. The IP address will still be in the "Received: from" line at the top.

How to view email headers in other providers

Yahoo Mail: Open the email, click the three dots, and select "View raw message" or "View full headers." The process is similar to Gmail.

Apple Mail: Open the email, go to the menu bar and select View > Message > All Headers. This shows the full header information in the message itself.

Thunderbird: Right-click the email in your inbox and select "View Message Source." This opens the raw header data.

ProtonMail: Open the email and click the three dots, then select "View headers." ProtonMail shows headers in a formatted panel rather than raw text.

What the IP address actually tells you

Once you have the IP address, you can look it up using a free tool like WhatIsMyIPAddress.com, IPQualityScore, or AbuseIPDB. These sites show you the general location (city and country), the internet service provider, and sometimes whether the IP has been flagged for spam or abuse.

The location is approximate — it shows where the internet provider's server is, not necessarily where the person using it sits. A company's email server might be in Virginia even if the employee is in California. A Gmail account accessed from anywhere in the world will show Google's server location, not the user's location.

If an email claims to be from your bank but the IP address is in a country where your bank has no servers, that's a warning sign. If it's from a colleague and the IP matches your company's mail server, that's expected. But the IP address alone cannot prove who sent the email — it only shows where the message came from technically.

Why headers matter for spotting phishing

Phishing emails are designed to look like they come from a trusted company — your bank, PayPal, Amazon, or your employer. The sender's name in your inbox might say "PayPal Support," but the actual sending server could be anywhere. Checking the headers reveals the mismatch.

Look at the "From:" line in the header and compare it to the "Received: from" line. If the email claims to be from paypal.com but was actually sent from a random IP address with no connection to PayPal, it's almost certainly phishing. Legitimate companies send email from their own servers or from authorized mail services that are registered to their domain.

You can also check the "SPF," "DKIM," and "DMARC" lines in the header — these are authentication methods that verify an email actually came from the company it claims to represent. If these lines show "fail" or "none," the email is not authenticated and is more likely to be fraudulent.

What you cannot learn from an IP address

An IP address is not a person's identity. It belongs to a server or internet service provider, not to an individual. Even if you know the IP address, you cannot find out someone's name, home address, phone number, or physical location without additional information and legal authority.

If you receive threatening emails or believe you're being harassed, the IP address alone is not enough for law enforcement to act. You would need to report the email to your email provider and to the police, who can then request more detailed information from the internet service provider — and even then, only with a warrant.

Similarly, if you're trying to verify whether an email is legitimate, the IP address is one piece of evidence, not proof. A legitimate email from a company you know might still come from an unexpected IP if the company uses a third-party email service. Always check multiple signals: does the sender address match the company's real domain, do the links go to the real website, and does the message ask for information the company would never request by email.

Frequently Asked Questions

Can I find someone's home IP address from their email?

No. The IP in an email header belongs to the mail server that sent it, not to the person's home computer or phone. If someone uses Gmail, the IP will be Google's server. If they use their company email, it will be their company's server. You cannot determine a personal device's IP from email headers alone.

What if the email header shows multiple IP addresses?

Each "Received: from" line represents one server the email passed through. Read from top to bottom — the topmost one is the most recent and usually the sending server. The ones below show earlier hops. The very last one at the bottom is usually the recipient's mail server (where you received it).

Is it legal to look up someone's IP address from their email?

Yes, looking up the IP address from an email you received is legal. The headers are part of the message sent to you. However, using that IP to attempt to access someone's computer, identify their home address, or harass them is illegal. If you believe you're being threatened or harassed, report it to your email provider and local law enforcement instead of investigating on your own.

Why does my email show a different IP address each time?

Email providers often use multiple servers to handle traffic. Each time you send an email, it might route through a different server in their network, so the IP address can change. This is normal and doesn't indicate a security problem.

Can I block emails from a specific IP address?

Most email providers let you create filters or block senders, but blocking by IP address is less reliable because legitimate companies use multiple IPs and spammers change theirs constantly. It's more effective to block the sender's email address or use your provider's spam and phishing filters, which are designed to catch these patterns automatically.