What you can and cannot learn from an email's IP address
You cannot reliably find someone's IP address from a regular email they send you. Email clients like Gmail, Outlook, and Yahoo strip out the technical headers that contain IP information before the message reaches your inbox. Even if you could see those headers, an IP address only tells you the location of the mail server that sent the message, not where the person actually was when they wrote it.
The only scenario where you might see IP data is if you run your own mail server and someone sends directly to it, or if you use specialized email forensics tools that capture headers from the original message. For most people checking personal or work email, this is not possible.
If you have a legitimate reason to trace an email — such as investigating fraud or harassment — the better path is to report it to the email provider or to law enforcement, both of which have access to server logs that regular users do not.
Key Takeaways
- Gmail, Outlook, Yahoo, and most email services remove IP address information from the headers you can see.
- Even if you could see an IP address, it belongs to the mail server, not the sender's device or location.
- Email headers are only visible if you open the "Show original" or "View message source" option in your email client.
- For fraud or harassment, report the email to the provider or law enforcement instead of trying to trace it yourself.
- Third-party email header analyzers exist but cannot recover information the email provider has already removed.
How to view email headers in your email client
If you want to see what header information is actually available in an email you received, most providers let you view the raw message. In Gmail, open the email and click the three dots in the top right, then select "Show original." This opens a new window with all the technical details the mail server recorded.
In Outlook on the web, click the three dots next to "Reply" and select "View message details" or "View message source." In Apple Mail, go to the View menu and choose "Message" then "All Headers." Yahoo Mail shows headers if you click the dropdown arrow next to the sender's name and select "Full Headers."
When you open these headers, you will see lines like "Received: from mail.example.com" repeated several times. Each line represents a mail server the message passed through. The IP addresses in these lines belong to those servers, not to the person who sent the email. The most recent "Received" line (at the bottom) is closest to the original sender, but it still only shows the outgoing mail server's IP, not the sender's device.
Why IP addresses in email headers are not reliable
Email passes through multiple servers on its way to you. A message sent from Gmail goes through Google's servers, then through your recipient's mail server, then to your inbox. Each server adds a "Received" line with its own IP address. None of these IPs tell you where the person was sitting when they hit send.
Someone using Gmail from a coffee shop, a home network, or a corporate office all send through the same Gmail servers. The IP address you see in the header is Gmail's server IP, not the sender's location. Similarly, someone using a VPN, a proxy, or a corporate network will have their actual IP masked by the intermediate service.
If someone is trying to hide their identity, they can use a VPN or send through an anonymous email service, which makes the IP address even less useful. Law enforcement and email providers can sometimes trace further back using server logs, but regular users cannot.
When you might actually see sender IP information
If you run your own mail server — which is rare for individuals but common for businesses — you can see more detailed logs about incoming connections. Your server records the IP address of the machine that connected to it and sent the message. This is closer to the sender's actual location, though still not definitive if they used a VPN or proxy.
Some email services designed for business or security purposes, like Proton Mail or Tutanota, handle headers differently and may retain more information. However, even these services do not show you the sender's IP in a way you can access from your inbox.
If you receive a suspicious email at a business address, your IT department may have email security tools that log connection details. These tools can sometimes identify the source IP, but they require server-level access that individual email users do not have.
Third-party email header analyzers and what they can do
Several free online tools exist that claim to analyze email headers and extract IP addresses. Tools like MXToolbox Header Analyzer, Email Header Analyzer, and others let you paste the raw email source and will parse the header information for you. These tools are useful for understanding what information is in the headers, but they cannot recover information that has already been removed.
If Gmail or Outlook has stripped the IP address before you downloaded the message, no analyzer can bring it back. These tools only organize and display the data that is already there. They can help you understand the path an email took and identify which servers handled it, but they cannot trace the sender's actual location.
Some paid forensics services claim to recover deleted or hidden header information, but these are typically used by law enforcement or large organizations with legal authority. For personal use, they are not necessary and often do not work as advertised.
What to do if you need to trace a suspicious email
If you received a fraudulent, threatening, or harassing email, do not spend time trying to trace the IP yourself. Report it to the email provider first. Gmail, Outlook, and Yahoo all have abuse reporting options built into their interfaces. Click the three dots on the email and select "Report phishing," "Report spam," or "Report abuse" depending on what you are dealing with.
The email provider has access to server logs and connection data that you do not. They can see the actual IP address that connected to their servers, the time of connection, and sometimes additional details. They can also take action — blocking the account, removing the message, or forwarding the report to law enforcement if needed.
If the email involves a crime — threats, extortion, identity theft — report it to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov or to your local police department. Include the full email headers and any other details you have. Do not attempt to contact the sender or investigate further on your own.
The difference between email IP addresses and web server IP addresses
Email IP addresses and the IP addresses you see when visiting a website are different things. When you visit a website, your browser connects directly to that site's server, and the server can log your IP address. Website owners can see visitor IPs in their server logs.
Email is different because you are not connecting directly to the sender. You are connecting to your email provider's server, which retrieves the message from the sender's provider's server. The sender never sees your IP address unless you click a link in their email or reply to them.
This is why phishing emails sometimes include tracking pixels or links designed to confirm your email address is active — they are trying to get you to connect directly to their server so they can log your IP. Do not click suspicious links in emails, even if you are just trying to see where they lead.
Frequently Asked Questions
Can I find someone's IP address if they email me from their personal computer?
No. Even if they email from their home computer, the message goes through their email provider's servers first. You only see the IP address of those servers, not their computer. Their email provider might have that information in their logs, but you cannot access it.
Does viewing an email in plain text show the IP address?
Viewing the message source or raw headers shows whatever IP information the email provider included. Most major providers have already removed or obscured the sender's IP by the time the message reaches you. Viewing it in plain text does not reveal information that was already stripped.
What if someone sends me an email from a free email service like Gmail or Yahoo?
The IP address in the headers will be Gmail's or Yahoo's server IP, not the sender's. These services handle millions of users, so the server IP tells you nothing about which person sent the message or where they were located.
Can I use an IP address from an email to find someone's location?
Not reliably. Even if the IP address belonged to the sender's device — which it usually does not — IP geolocation is only accurate to the city or region level, and often less accurate than that. It cannot pinpoint a specific address or building.
What should I do if I receive a threatening email?
Report it to your email provider using their abuse reporting tool, then report it to law enforcement if the threat is credible. Include the full email headers when you report it. Let the authorities handle the investigation — they have the tools and legal authority to trace the email properly.