Email headers are like the tiny shoe prints behind a message. Most people never look at them. But if an email feels odd, pushy, or mysterious, those prints can help. You may find mail servers, security checks, and sometimes the sender’s IP address.
TLDR: In Gmail, open the message, click the three dots, and choose Show original. In Outlook, open the message details or message source to view the email headers. Look for lines called Received, because they may show IP addresses. Just know that many services hide the real sender IP, so the IP may belong to a mail server, not the person.
First, what is an email sender IP?
An IP address is like a street address for a device or server on the internet. It can look like this: 192.0.2.55. It can also look longer if it uses IPv6.
When someone sends an email, the message travels through mail servers. Each server may add a note to the email header. These notes are called Received lines. They show where the email has been.
Fun image idea: think of your email as a postcard with travel stamps. Each mail server adds a stamp. Some stamps include IP addresses.
Important truth before we start
You may not always find the sender’s personal IP address. In fact, you often will not.
Why? Because big email services protect users. Gmail, Outlook, Yahoo, and many business systems may show the IP address of their own mail servers instead. This is normal.
So what can you learn?
- The route the message took.
- Which mail servers handled it.
- Whether the sender passed security checks.
- Sometimes, the original sending IP.
That is still useful. It can help you spot spoofing, scams, and strange mail sources.
How to check the IP address in Gmail
Let’s start with Gmail. It is pretty simple.
- Open Gmail.
- Open the email you want to inspect.
- Look at the top right of the message.
- Click the three dots menu.
- Choose Show original.
A new page will open. It may look scary. Do not panic. It is just a big pile of technical mail notes.
At the top, Gmail may show a quick summary. You may see items like:
- SPF
- DKIM
- DMARC
These are email security checks. If they say PASS, that is usually a good sign. It does not prove the email is safe. But it means the message matched some sender rules.
Now scroll down into the raw header text. Look for lines that begin with Received:. There may be many of them.
Here is the trick. Read the Received lines from the bottom upward. The lowest one is often closest to the original sender. The newest one is usually at the top. Email headers stack like pancakes. Fresh pancake on top. Old pancake on bottom.
Look for an IP address inside square brackets. It may look like this:
Received: from mail.example.com (mail.example.com [203.0.113.24])
In this example, the IP address is:
203.0.113.24
But remember the big warning. In Gmail, if the email was sent from another Gmail account, you will usually not see the person’s real IP address. You may only see Google mail server IPs. That is by design.
How to check the IP address in Outlook on the web
Outlook on the web is also friendly, once you know where to click.
- Open Outlook in your browser.
- Open the email message.
- Click the three dots near the top of the message.
- Choose View, View message details, or View message source.
The exact wording can change. Microsoft moves buttons sometimes. It is their little hobby.
When the message details open, you will see the full email header. Once again, search for Received:.
You can use your browser search tool. Press Ctrl + F on Windows. Press Command + F on Mac. Type Received.
Check the lower Received lines first. Look for an IP address in brackets. You may see something like:
Received: from unknown (HELO laptop) ([198.51.100.17])
That number in brackets may be the sending IP. Or it may be a server between the sender and you. Email can be sneaky like that.
How to check the IP address in Outlook desktop
If you use the Outlook desktop app, the steps are a little different.
- Open Outlook.
- Double click the email to open it in a new window.
- Click File.
- Click Properties.
- Look for the box called Internet headers.
That box contains the header text. It may be small. You can click inside it, press Ctrl + A, then copy it. Paste it into a text editor. Now it is much easier to read.
Again, search for Received:. Find IP addresses in brackets. Start near the bottom. Work upward.
What if there are many IP addresses?
This is normal. Email often hops through several servers.
Think of it like a package delivery. It may go from a local office, to a big warehouse, to another warehouse, then to your door. Each stop may leave a mark.
The first server that handled the email is usually near the bottom of the header. But not always. Some headers are rewritten. Some senders use tools that hide details. Some companies use email gateways.
So do not treat one IP address as magic proof. It is a clue. Not a courtroom confession.
How to look up an IP address
Once you find an IP address, you can look it up. Use an IP lookup site. Search for IP lookup in your browser. Paste the IP address there.
You may learn:
- The internet provider.
- The company that owns the server.
- The general city or region.
- The country.
But keep expectations low. IP location is not GPS. It may be wrong. It may show a data center. It may show the email provider, not the sender’s home or office.
Red flags to watch for
Email headers can help you sniff out trouble. Look for these warning signs:
- The sender name says one company, but the domain is different.
- SPF, DKIM, or DMARC says FAIL.
- The email claims to be local, but the route looks strange.
- The message uses urgent threats or surprise prizes.
- Links point to odd domains.
If something feels wrong, do not click links. Do not open attachments. Do not reply with private details. Report the message as phishing or spam.
Can you find the exact person from an IP?
Usually, no. And you should be careful.
An IP address rarely identifies one person by itself. It may belong to a server, a company network, a coffee shop, a VPN, or an email service. It can also change over time.
If there is a serious threat, do not try to play detective alone. Save the email. Keep the full headers. Report it to your email provider, your workplace security team, or local authorities.
Quick recap
In Gmail, use Show original. In Outlook web, use View message details or View message source. In Outlook desktop, use File, then Properties, then Internet headers.
Search for Received: lines. Check from the bottom upward. Look for IP addresses in brackets. Then use an IP lookup tool if you want more context.
Email headers are not always neat. They can be messy little spaghetti monsters. But with a calm eye, you can spot useful clues. And that makes your inbox a little less mysterious.
