Blog/
How to find an IP address in email headers
Step-by-step: open raw email headers, read Received lines, pick the sender IP, then look it up for ISP and reputation.
Every email carries a chain of Received headers. Those lines often include the connecting IP of the previous hop. Learning to read them helps you investigate phishing, spam, or a compromised mailbox — without guessing from the From: display name.
Show the raw headers
- Gmail: Open message → ⋮ → Show original
- Outlook / Microsoft 365: Open message → View → View message details (or File → Properties)
- Apple Mail: View → Message → All Headers
- Proton / others: look for “View headers” / “Original message”
Which Received line to trust
Headers are written top-down as the message travels. The top Received line is usually your provider. Walk downward until you find the first hop outside your mail host — that “from … ([IPv4 or IPv6])” value is often the sender’s connecting address. Ignore private ranges (10.x, 192.168.x, 172.16–31.x) and obvious internal load balancers.
What to do with the IP
Paste the public IP into an IP lookup for ISP and ASN, then run a blacklist check if the message looks abusive. Ownership (RDAP) tells you which network announced the block — not always the person at the keyboard.
Geo, ISP, ASN, and ownership signals in one report.
Limits and privacy
Webmail and large ESPs often show their own infrastructure IPs, not a home user’s address. Mailing lists and forwarders add hops. An IP is a network clue for abuse desks — not a home street address.