How to Trace an Email’s IP Address & Sender Location

Have you ever received malicious emails claiming you’re the lucky guy who inherited a fortune from a wealthy cousin? When you wanted to dig deeper, you may have found nothing because the email address didn’t reveal much.

You can look at the email’s header to discover the sender’s IP address. You can find the IP address used by the email servers, which can lead to finding the sender’s IP address and approximate location or even discovering their identity.

Why Would You Want to Trace an IP Address?

You can trace an IP address to find out where an email is coming from, giving you insights into its legitimacy.

Alternatively, you may want to block the sender’s IP address and prevent receiving more spam, even if they change their email address.

You’ll need to access the email header to get the IP address from an email.

What Is an Email Header?

The email header contains information like email metadata and routing information. It’s full of technical data useless for the average user. However, the email header is a valuable resource that can help you trace an email address back to its sender, which I’ll explain briefly.

The entire email header contains a lot of information. Here’s a quick breakdown of what these lines in an email header mean:

• From: This field displays the email address of the Message’s sender.
• Reply-To: This field specifies the email address to which you should respond.
• To: This field lists the intended recipients of the email.
• Subject: This field contains the subject line of the email.
• Received: This field lists the servers the email traveled through before it arrived in your inbox. Look for Original IP or X Originating IP to find the IP address of the email server that sent the email.
• MIME-Version: Multipurpose Internet Mail Extensions (MIME) shows the standard email format.
• Content-Type: This field tells your email client or web browser how to interpret the content of the Message.
• DKIM-Signature: Domain Keys Identified Mail (DKIM) authenticates the email’s domain and can help protect against email spoofing and sender fraud.
• Authentication-Results: This field contains a record of the performed authentication checks.
• Received-SPF: Sender Policy Framework (SPF) is part of the email authentication process that stops sender address forgery.
• Return-Path: This field specifies where non-delivery or bounce messages are sent.
• ARC-Authentication-Results: This field is part of another authentication standard called the Authenticated Received Chain (ARC) that verifies the identities of email forwarders and intermediaries.
• ARC-Message-Signature: This field takes a snapshot of the message header information for validation.
• ARC-Seal: This field “seals” the ARC authentication results and the message signature, verifying their contents.
• X-Received: This is not a standard field and can include non-permanent addresses, such as mail transfer agents or a Gmail SMTP server.
• X-Google-Smtp-Source: This field indicates that the email message was transferred using a Gmail SMTP server.
• Delivered-To: This field indicates the final recipient of the email.

Note: Don’t confuse the Received line with X Received, as they differ. X Received only provides temporary addresses, such as the Google SMTP source server or a mail transfer agent.

How to Open an Email Header

Here’s a quick guide on opening the email header to trace an email address and check the message sender on different email clients.

Open the Email Header on Gmail

1. Open your Gmail account.

2. Open the email you wish to trace.

3. Click on the three vertical dots in the top right, then click Show Original.

Here’s an example of what you’ll see:

Open the Email Header on Microsoft Outlook

1. Open your Microsoft Outlook account.

2. Click on the email you want to trace.

3. In the preview window, click on the three horizontal dots > View > View message source.

Here’s what you can expect to see:

Open Email Header on Yahoo Mail

1. Open your Yahoo account.

2. Open the email you want to trace.

3. Click the three horizontal dots above the email, then select View raw message.

It’ll look something like this:

Open the Email Header on Apple Mail

1. Open Apple Mail.

2. Head to View.

3. Find Message.

4. Click on Raw Source.

Can You Trace an IP Address From an Email? Here’s How in 2024

Your success rate will depend on several factors, such as the email provider, email client type, and the sender’s location. For example, for a Gmail account, you can only find the location of the last Google server that processed the email, not the original sender’s IP.

To better understand how to trace IP addresses using email headers, I’ll show you how I traced the IP address from an email I sent myself.

For this example, I’m using Gmail.

1. First, you need to get the email header, as shown above. Open the email you received and click on the three dots in the top-right corner. Since I’m using Gmail, I’ll go to Show Original in the drop-down menu to open the email header.
2. At the top will be a box containing a table of information. In that table, look for SPF, which will provide the sender’s IP address.
3. Once you find the IP, you can use a tool like WhatIsMyIP or IP-Lookup to find out where the IP address is located.

Since I used Gmail, only the email server IP address was displayed under “Received” and not the IP address from the sender (which would be my IP in this case).

Interestingly, another tool showed a different location for the same IP, so you may want to try several tools to find the most common result.

How to Avoid Email IP Tracking with a VPN

If you want to prevent your IP address from being traced via email, you can use a VPN or a proxy server to replace your actual IP address with a new one.

Here are my top three VPN recommendations that protect your online data with high-level encryption protocols and strict no-logs policies, meaning your activity is never monitored or recorded.

1. ExpressVPN

ExpressVPN provides rotating IP addresses, meaning your IP address changes each time you connect to a server. This makes tracking your original IP address from your email header even more challenging.

2. CyberGhost

CyberGhost offers a double IP feature, which assigns two IP addresses to your device to increase your online privacy further. It lets you change your IP address for free using its proxy browser extension. Plus, you can use its Private Browser, so your browsing data, like your history, cookies, and passwords, are deleted as soon as you close the browser.

3. Private Internet Access (PIA)

PIA offers dedicated IP addresses in multiple countries. Using the same IP address consistently prevents your emails from being mistakenly flagged as spam or suspicious activity, improving your email deliverability rates. This can be particularly useful when sending sensitive information via email.

Conclusion

In some cases, it’s possible to trace the IP address from an email to find out where the sender is located. The IP address you need is already provided in the email header. To discover the location of the original sender, you can use IP lookup tools.

The same thing can happen the other way around. If you don’t want your IP address to be discoverable via email, connect to a secure VPN like ExpressVPN when you send emails.

Frequently Asked Questions

Topic: How To Guides, Internet