How to Get an IP Address from Email

When a suspicious message lands in your inbox, you may want to know where it came from. One way to investigate that is by checking the email header.

An email header can sometimes reveal an IP address linked to the mail server that handled the message. In some cases, it may also show the sender’s originating IP address. However, this depends on the email provider, server configuration, privacy controls, and whether the sender used a webmail service, VPN, proxy, or email marketing platform.

This guide explains how to find email headers in Gmail, Yahoo Mail, and Outlook, how to read the header fields, and how to examine IP addresses safely.

How to Find IP Address of Email Sender in Gmail

Gmail makes full headers available through the “Show original” option.

Steps for Gmail

1. Open Gmail on a desktop browser.
2. Open the email you want to inspect.
3. Click the three-dot More menu next to the Reply button.
4. Select Show original.
5. A new tab will open with the full email header and message source.
6. Copy the header text.
7. Look for lines that begin with Received:.
8. Search within those lines for IP addresses inside square brackets, such as [203.0.113.25].

Screenshot suggestion: Insert a screenshot showing the Gmail three-dot menu beside the Reply button with “Show original” highlighted.

Gmail also shows authentication results on the original message page. You may see SPF, DKIM, and DMARC status. These results help confirm whether the message passed sender verification checks.

How to Find IP Address of Email Sender in Yahoo Mail

Yahoo Mail uses the “View Raw Message” option to show headers.

Steps for Yahoo Mail

1. Log in to Yahoo Mail from a desktop browser.
2. Open the email you want to check.
3. Click the More icon above the message.
4. Select View Raw Message.
5. A new page or tab will display the raw email source.
6. Copy the header section.
7. Review the Received: fields.
8. Look for IPv4 or IPv6 addresses linked to mail servers.

Screenshot suggestion: Insert a screenshot showing the Yahoo Mail More menu with “View Raw Message” selected.

Yahoo headers may include multiple Received lines. Start from the bottom Received line and move upward. The lower lines usually show the earliest part of the email’s route, while the upper lines show later mail server hops.

How to Find IP Address of Email Sender in Outlook

Outlook has different steps depending on whether you use new Outlook, Outlook on the web, or classic Outlook for Windows.

Steps for New Outlook or Outlook on the Web

1. Open Outlook.
2. Open the message you want to inspect.
3. Click More actions at the top of the message.
4. Select View.
5. Click View message details.
6. Copy the full message header.
7. Search for Received: lines and IP addresses.

Screenshot suggestion: Insert a screenshot showing “View message details” inside the Outlook message options menu.

Steps for Classic Outlook for Windows

1. Double-click the email to open it in a separate window.
2. Click File.
3. Select Properties.
4. Find the Internet headers box.
5. Copy the header text into Notepad or another text editor.
6. Search for Received lines and IP addresses.

Classic Outlook often displays the header in a small box, so copying it into a text editor makes analysis easier.

Sample Email Header Code for Examination

Below is a simplified example of an email header. This is not from a real message, but it shows the kind of information you may see.

Return-Path: <sender@example.com>
Received: from mail.example-sender.com (mail.example-sender.com [203.0.113.25])
        by mx.google.com with ESMTPS id abc123
        for <recipient@gmail.com>;
        Tue, 24 Jun 2026 10:15:32 -0700 (PDT)
Received: from user-device.local (unknown [198.51.100.42])
        by mail.example-sender.com with ESMTPA;
        Tue, 24 Jun 2026 10:14:58 -0700
Authentication-Results: mx.google.com;
        spf=pass smtp.mailfrom=example.com;
        dkim=pass header.d=example.com;
        dmarc=pass header.from=example.com
From: "Example Sender" <sender@example.com>
To: recipient@gmail.com
Subject: Account Update Required
Date: Tue, 24 Jun 2026 10:14:55 -0700
Message-ID: <123456789@example.com>

In this sample, two IP addresses appear:

203.0.113.25
198.51.100.42

The first IP address belongs to the sending mail server. The second may represent the device or network that submitted the message to that server. In real email systems, this second IP may be hidden, replaced, or absent.

How to Read the Received Lines

The Received fields are usually the best place to start. Each mail server adds its own Received line at the top of the header. Because of that, the newest hop appears at the top, and the oldest hop appears closer to the bottom.

A basic method is:

1. Find all Received: lines.
2. Start with the lowest Received line.
3. Look for an IP address in square brackets.
4. Check whether the server name matches the sender’s domain.
5. Compare timestamps for unusual delays or mismatched time zones.
6. Review SPF, DKIM, and DMARC results.

If the email claims to come from a bank, software vendor, payment app, or business partner but the header shows failed authentication, unrelated domains, or strange routing, treat it as suspicious.

Can You Always Get the Sender’s IP Address from an Email?

No. You can often get IP addresses from the email’s path, but they may not be the sender’s personal device IP.

For example, if someone sends an email from Gmail, Yahoo Mail, or Outlook.com, the header may show Google, Yahoo, or Microsoft mail servers instead of the sender’s home or office IP address. Large email providers usually hide the user’s device IP for privacy and security reasons.

You are more likely to see the sender’s original IP address when the message was sent through a private mail server, older email client, poorly configured SMTP server, or custom domain mail setup.

That means header analysis is useful, but it is not a perfect identity tool. It can help you identify suspicious routing, forged sender details, unusual server locations, or failed authentication checks.

How to Track an IP Address from an Email

After finding an IP address, you can use an IP lookup tool to track the approximate location, hosting provider, ASN, and abuse reports. This can help you understand whether the IP belongs to a known email provider, cloud hosting company, residential ISP, VPN service, or suspicious server.

Do not assume that an IP address gives you a person’s exact location. IP geolocation is approximate. It may identify a city, region, internet provider, data center, or country, but it does not prove who sent the email.

For a serious threat, such as financial fraud, stalking, extortion, or business email compromise, preserve the full email header and report it to your email provider, security team, bank, platform support team, or law enforcement where needed.

Common Signs of a Suspicious Email Header

A suspicious email may show one or more of these signs:

• SPF, DKIM, or DMARC failure
• A From address that does not match the sending domain
• Received lines showing unrelated servers
• A reply-to address from a free email account
• A domain that looks similar to a real brand but is slightly misspelled
• IP addresses linked to hosting providers with abuse history
• Strange timestamp gaps between mail server hops

These signs do not always prove an email is malicious, but they are enough to slow down and verify before clicking links, opening attachments, or sending information.

Key Takeaways

• Getting an IP address from an email starts with the full email header, not the visible sender name.
• Gmail users can find headers through More > Show original. Yahoo Mail users can use More > View Raw Message. Outlook users can check View message details in new Outlook or File > Properties in classic Outlook.
• The Received lines are the main place to look for IP addresses, server names, and timestamps.
• Large providers such as Gmail, Yahoo, and Outlook may hide the sender’s device IP, so the visible IP may belong to a mail server rather than the person who sent the message.
• SPF, DKIM, and DMARC results help verify whether the sender domain passed authentication checks.
• An IP address is useful for security review, but it does not prove identity by itself. Use header data responsibly and report serious threats through the proper channels.