Paste the headers of an email to find the IP address of the server that sent it
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.Every mail server that handles a message adds a Received line naming the server it came from, usually with its IP address. Paste the full headers and this page reads them oldest first and shows the first public IP address: normally the server that sent the message, not the sender's own computer, because big providers such as Gmail and Outlook do not record that. Lines below your own provider's can be forged.
Open the email and copy its full headers: in Gmail, Show original; in Outlook, File, Properties, Internet headers.
Paste them into the box; the Sender IP line appears at the top of the result.
Read the Route table to see which server recorded that address, oldest hop first.
Use the links to look up who holds the address or check it against blocklists, then press Copy analysis.
Paste the full headers of a message, or the whole .eml file, and the page reads them in your browser. Nothing is looked up and nothing is sent.
The route. Each mail server adds a Received line at the top as it passes the message on, so the headers read newest first. The page turns them around and lists each hop oldest first: the server it came from with the address it connected from, the server that received it, the protocol, the time in UTC, and the delay since the hop before. Folded lines are joined first, as RFC 5322 section 2.2.3 describes, and the date is taken from after the last semicolon. A negative delay is flagged, because it means a server's clock is wrong, not that mail travelled back in time.
The verdicts. SPF, DKIM and DMARC are read from the topmost Authentication-Results header, the one your own provider wrote, using the RFC 8601 layout, with Received-SPF as a fallback. Lower Authentication-Results headers are listed too, since anyone could have added those before the message arrived. ARC seals from forwarders and mailing lists are shown with their chain verdicts, and each DKIM-Signature with its domain, selector and signed headers.
The rest of the article, and all 6 questions about Email Header Analyzer, are on the Email Header Analyzer page.
In Gmail, open the message, choose the three-dot menu and Show original. In Outlook on the desktop, open the message, then File, Properties, and copy the Internet headers box. In Apple Mail, choose View, Message, All Headers. Copy everything from the first Received line down and paste it here.
Look at the Delay column. The hop with the big number is where the message waited: a sender's outbound queue, a greylisting receiver that asked it to retry, or a spam filter. A few seconds per hop is normal. A negative delay means one server's clock is wrong, so the delays next to it are unreliable.
The receiving server found that neither SPF nor DKIM passed for a domain matching the visible From address. Either the message was forged, or a real service is sending for the domain without being set up in its SPF record or signing with its DKIM key. The Alignment section shows which domains were compared.
Usually. The first public address in the oldest Received lines is normally the server that sent the message; private addresses such as 10.x or 192.168.x belong to the sender's own network. Webmail often hides the user's own address. Lines added before your provider's servers can be forged by a spammer.
Still stuck? Ask about Email Header Analyzer and anybody who knows can answer. No account needed.
On the related tools: SPF Record Generator – Write an SPF record for your mail providers and see how many lookups it uses · DMARC Record Generator – Build a DMARC record step by step, from p=none reporting to p=reject.