Trace Email (Find Email Address Source)

In the following steps you'll learn how to find and copy an email header and paste it into the Trace Email Analyzer to get the sender's IP address and track the source.

Would you like to track down (or trace) where an email that you received came from?

This Trace Email tool can help you do precisely that. It works by examining the header that is a part of the emails you receive to find the IP address. 

(A header is the unseen part of every sent and received email. To learn a little bit more on headers. You can see an example of a header at the end of this article.)

What email provider do you use?

To find the IP address of a received email you're curious about, open the email and look for the header details. How you find that email's header depends on the email program you use. Do you use Gmail or Yahoo? Hotmail or Outlook?

For example, if you're a Gmail user, here are the steps you'd take:

1. Open the message you want to view
2. Click the down arrow next to the "Reply" link
3. Select "Show Original" to open a new window with the full headers

STEPS TO TRACING AN EMAIL:

1. Get instructions for locating a header for your email provider below

   Apple Mail 2.x (Mac)

   1. Select the message you want to view the headers of.
   2. Press SHIFT-COMMAND-H to toggle full headers for the message. (Alternatively you can click VIEW in the menu bar, click MESSAGE, click LONG HEADERS.

   Microsoft Outlook 2003 (Win)

   1. Select the message you want to view the headers of.
   2. Right click the mouse, select OPTIONS
   3. Headers will be displayed within the "Internet Headers" area of a pop-up window.

   Mozilla Thunderbird 2.x (Win)

   1. Select the message you want to view the headers of.
   2. Press CTRL-U (or click VIEW from the menu bar, select MESSAGE SOURCE)
   3. Headers will be displayed in a new window.

   Google Mail (GMail)

   1. Open the message you want to view the headers of.
   2. Click the down arrow next to the "Reply" link.
   3. Select "Show Original" to open a new window with the full headers

   Windows Live Hotmail

   (Full Version)
   1. This does not work with Safari on Mac OS X
   2. Right click on the message. (From the list of emails)
   3. Select "View Source"
   4. A new window with the full headers and HTML source of the email will open

   Yahoo Mail

   "New" Version
   1. Right click on the message.
   2. Select "View Full Headers"
   3. A new window with the full headers will open

   Yahoo Mail

   "Classic" Version
   1. Click on the message.
   2. Click "Full Headers" on the bottom right of the screen
2. Open the email you want to trace and find its header
3. Copy the header, then paste it into the Trace Email Analyzer below
4. Press the "Get Source" button
5. Scroll down below the box for the Trace Email results!

You should know that in some instances people send emails with false or "forged" headers, which are common in spam and unwanted or even malicious e-mail. Our Trace Email tool does not and cannot detect forged e-mail. That's why that person forged the header to begin with!

Trace Email Analyzer Paste the header you've copied in the box.

Example of an email header

Return-path: <user@example.com>
Received: from mac.com ([10.13.11.252])
  by ms031.mac.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28
  2007)) with ESMTP id <0JMI007ZN7PETGC0@ms031.mac.com> for user@example.com; Thu,
  09 Aug 2007 04:24:50 -0700 (PDT)
Received: from mail.dsis.net (mail.dsis.net [70.183.59.5])
  by mac.com (Xserve/smtpin22/MantshX 4.0) with ESMTP id l79BOnNS000101
  for <user@example.com>; Thu, 09 Aug 2007 04:24:49 -0700 (PDT)
Received: from [192.168.2.77] (70.183.59.6) by mail.dsis.net with ESMTP
  (EIMS X 3.3.2) for <user@example.com>; Thu, 09 Aug 2007 04:24:49 -0700
Date: Thu, 09 Aug 2007 04:24:57 -0700
From: Frank Sender <sender@example.com>
Subject: Test
To: Joe User <user@example.com>
Message-id: <61086DBD-252B-46D2-A54C-263FE5E02B41@example.com>
MIME-version: 1.0 (Apple Message framework v752.2)
X-Mailer: Apple Mail (2.752.2)
Content-type: text/plain; charset=US-ASCII; format=flowed
Content-transfer-encoding: 7bit