Find Email Address Source
In the following steps you'll learn how to find and copy an email header and paste it into the Trace Email Analyzer to get the sender's IP address and track the source.
Would you like to track down (or trace) where an email that you received came from?
This Trace Email tool can help you do precisely that. It works by examining the header that is a part of the emails you receive to find the IP address. If you read the IP Lookup page, you'll get a clear idea of what information an IP address can reveal.
(A header is the unseen part of every sent and received email. To learn a little bit more on headers, click here. You can see an example of a header at the end of this article.)
What email provider do you use?
To find the IP address of a received email you're curious about, open the email and look for the header details. How you find that email's header depends on the email program you use. Do you use Gmail or Yahoo? Hotmail or Outlook?
For example, if you're a Gmail user, here are the steps you'd take:
- Open the message you want to view
- Click the down arrow next to the "Reply" link
- Select "Show Original" to open a new window with the full headers
Note: We are in the process of compiling instructions from a variety of popular webmail services and email applications. In the meantime, if you have a question about your email provider, please post it in the Email Tracing Forum.
STEPS TO TRACING AN EMAIL:
- Get instructions for locating a header for your email provider here
- Open the email you want to trace and find its header
- Copy the header, then paste it into the Trace Email Analyzer below
- Press the "Get Source" button
- Scroll down below the box for the Trace Email results!
You should know that in some instances people send emails with false or "forged" headers, which are common in spam and unwanted or even malicious e-mail. Our Trace Email tool does not and cannot detect forged e-mail. That's why that person forged the header to begin with!
Example of an email header
Return-path: <firstname.lastname@example.org> Received: from mac.com ([10.13.11.252]) by ms031.mac.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTP id <0JMI007ZN7PETGC0@ms031.mac.com> for email@example.com; Thu, 09 Aug 2007 04:24:50 -0700 (PDT) Received: from mail.dsis.net (mail.dsis.net [220.127.116.11]) by mac.com (Xserve/smtpin22/MantshX 4.0) with ESMTP id l79BOnNS000101 for <firstname.lastname@example.org>; Thu, 09 Aug 2007 04:24:49 -0700 (PDT) Received: from [192.168.2.77] (18.104.22.168) by mail.dsis.net with ESMTP (EIMS X 3.3.2) for <email@example.com>; Thu, 09 Aug 2007 04:24:49 -0700 Date: Thu, 09 Aug 2007 04:24:57 -0700 From: Frank Sender <firstname.lastname@example.org> Subject: Test To: Joe User <email@example.com> Message-id: <61086DBD-252B-46D2-A54C-263FE5E02B41@example.com> MIME-version: 1.0 (Apple Message framework v752.2) X-Mailer: Apple Mail (2.752.2) Content-type: text/plain; charset=US-ASCII; format=flowed Content-transfer-encoding: 7bit