Trace the Sender of an Email from Its Header

What this tool does

An email passes through several servers on its way from the sender to the recipient, and each server adds a Received line at the top of the header. Reading these lines from the bottom up shows which servers the email went through.

Use it to check where a spoofed or spam email came from, or to find where an email was delayed. Most email programs show the header through a feature such as View message source.

How to read the results

• The number is the order in the header; 1 is the record of the server that received the email last.
• The hop column shows the sending server's name, IP address, and time received as recorded.
• The country and organization are looked up only for public IP addresses; internal addresses such as office networks are not looked up.
• IP addresses in a cloud range or on a Tor exit node also show that result.

Frequently asked questions

Is the header stored on the server?

The header is analyzed only inside your browser, and its text is not sent to the server. Only the public IP addresses in the route are sent to look up their country and organization.

Is the bottom IP address the sender's location?

It often shows the location of the mail server or connection the sender used, but if the sender used webmail or an email delivery service, it shows that service's server. The lower lines can be rewritten by the sender, so lines written by the recipient's servers are more reliable.

Why are no Received lines found?

If you pasted only the message body, or a header that your email program shortened, it contains no Received lines. Copy the whole header from a feature such as View message source.