Find the sender's IP address and location from email headers
The original IP address where the email originated, which can reveal the sender's approximate location.
The path the email took through various mail servers from sender to recipient.
SPF, DKIM, and DMARC results that indicate if the email is legitimate or potentially spoofed.
When the email was sent and how long it took to travel through each server.
Email tracing analyzes the email headers — metadata added by each mail server that handles the message. By parsing the "Received" headers from bottom to top, you can trace the path the email took and identify the originating IP address.
You can usually identify the sender's approximate city and country from their IP address, along with their ISP. However, VPNs, proxies, and webmail services (Gmail, Outlook) often mask the sender's real IP, limiting location accuracy.
In Gmail, open the email and click the three dots menu, then "Show original." In Outlook, open the message, click File then Properties, and look in the "Internet headers" box. Copy all the header text and paste it into our tool.
Yes, some headers like "From" and "Reply-To" can be easily spoofed. However, "Received" headers added by intermediate mail servers are harder to forge. Our tool analyzes the full header chain to identify suspicious or inconsistent entries.
More Tools