How to trace an email’s IP source

The first thing you do when you hear that email notification is check the sender, right? This is the fastest way to find out who’s email, as well as possible content.

But did you know each email comes with more information than what appears in most email clients? There’s a bunch of information about the sender included in the email header—information you can use to track down the email source.

Here’s how to trace back the email source and why you need to do so.

Why track email addresses?

Before you learn how to track email addresses, you need to know why you need to. In this day and age, malicious emails appear very often. Phishing, spam, malware, and phishing emails are common in inboxes. If you follow the email source, you have a slight chance of discovering who (or where) the email came from.

In other cases, you can track the origin of an email to block the source of spam or junk content, to permanently remove it from your inbox. (If you want to prevent your own email identity from being revealed, learn how to send emails completely anonymously)

How to track an email address

You can track the sender’s email address by viewing the full email header. Email headers contain routing information and email metadata—information you wouldn’t normally be interested in. But that information is important for tracing the origin of the email.

Most email clients don’t display the full email header by standard because it’s full of technical data and is somewhat useless for the average user. However, most email clients provide a way to check email headers in full. You just need to know where to watch, as well as what you’re watching.

• Gmail’s Full Email Header: Open your Gmail account, then open the email you want to track. Select the drop-down menu in the top right corner, then select Show original.
• Outlook Full Email Header: Double-click the email you want to track, select File > Properties. Information will appear in internet headers.
• Apple Mail Full Email Headers: Open the email you want to follow, then go to View > Message > Raw Source.

Understand the data in the full email header

You read email headers chronologically, bottom to top (i.e. oldest information is at the bottom), and each new server the email goes through adds Received into the title.

Check out this sample email header taken from a Gmail account:

There is a lot of information. But we’ll go through it together, reading from the bottom up:

• Reply-To: The email address you send your email to.
• From: Displays the sender of the message.
• Content-type: Tell your browser or email client how to interpret the content of the email. The most common character sets are UTF-8 (see in the example) and ISO-8859-1.
• MIME-Version: Declare the email format standard being used. The MIME version is usually “1.0”.
• Subject: Subject of the email body.
• Big: E-mail recipients; may display other addresses.
• DKIM-Signature: DomainKeys Recogfied Mail authenticates the domain the email was sent from and will protect the email from sender spoofing and phishing.
• Received: The “Received” line lists each server the email travels through before reaching your inbox. You read the lines “Received” from bottom to top; The most important point is the originator.
• Authentication-Results: Contains a record of the validation checks performed; may contain more than one authentication method.
• Received-SPF: Policy Sender Policy Framework (SPF) forms part of the email validation process that prevents sender address spoofing.
• Return-Path: The end location of unsent or returned messages.
• ARC-Authentication-Results: Chain Authenticated CHEAPeceive OLDhain is another authentication standard; ARC verifies the identity of email intermediaries and the server that forwards your message to its final destination.
• ARC-Message-Signature: Signature snapshot of message header information for authentication, similar to DKIM.
• ARC-Seal: “Seal” ARC validation results and message signatures, verifying their content; similar to DKIM.
• X-Received: Different from “Received” in that it is considered non-standard; that is, it may not be a permanent address, such as a mail server or Gmail SMTP server.
• X-Google-Smtp-Source: Displays emails transferred using Gmail’s SMTP server.
• Delivered-To: The last recipient of the email in this header.

You don’t have to understand what all this means to track an email. But if you learn to look at email headers, you can quickly start tracking email senders.

Tracing the original sender of an email

To track the original email sender’s IP address, go to Received first in the full email header. Next to the first Received line is the IP address of the server that sent the email. Sometimes it will appear as X-Originating-IP or Original-IP.

Find the IP address, then go to MX Toolbox. Enter the IP address in the box, change the search type to Reverse Lookup using the drop-down menu, then press Enter. The search results will display a variety of information related to the sending server.

Unless the original IP address is one of millions of private IP addresses. In that case, you will see the following message:

The following IP ranges are private:

• 0.0.0-10.255.255.255
• 16.00-172.31.255.255
• 168.0.0-192.168.255.255
• 0.0.0-239.255.255.255

Looking up the IP addresses for those ranges will not return any results.

3 Free Tools to Track Emails and IP Addresses

Of course, there are some handy tools available to automate this process for you. It’s helpful to learn about full email headers and their contents, but sometimes you need information quickly.

Check out the following header parsers:

However, the results do not always match. In the example below, I know that the sender is not near the location below.

In that, your success will vary depending on the sender’s email provider. For example, if you’re trying to track an email sent from a Gmail account, you’ll only find out the location of the Google server that ultimately processed your email — not the IP address of the original sender.

In addition, you can also use gunt to find other people’s information when they know the email here.