Updated : Revised to correct outdated details and make the guidance easier to follow.
Full email headers can show how a message travelled, but they usually cannot identify the person who sent it or reveal their exact location. An IP address in a header may belong to a mail service, relay or company network rather than the sender’s phone or computer.
Use headers as one part of an investigation. Do not treat a city shown by an IP lookup as proof of who wrote an email.
How to view full headers in Gmail
- Open Gmail in a desktop web browser.
- Open the message you want to inspect.
- Click the message’s More menu next to Reply.
- Choose Show original.
The message menu is different from the browser’s own menu. Gmail opens a page with authentication information and the original message. Google’s full-header guide shows the current steps.
If you are using a phone app and cannot find this command, use Gmail’s web interface on a computer rather than assume the app has the same menu.
How to view email headers in Outlook
| Outlook version | Where to look |
|---|---|
| New Outlook for Windows | Open the message’s More actions menu, then View > View message details. |
| Outlook on the web / Outlook.com | Use the message’s More actions menu and look under View for message details. |
| Classic Outlook for Windows | Double-click the message to open it, then File > Properties > Internet headers. |
Microsoft‘s Outlook header guide separates these versions. Menus in Outlook for Mac or a mobile app can differ.
Which header fields matter?
| Field | What it can help show | Important limit |
|---|---|---|
| Received | Servers involved in transferring the message. | Not every entry should be trusted equally. |
| From | The displayed sender address. | A displayed name or address can be misleading. |
| Reply-To | Where a reply will be sent. | A different address is a clue, not automatic proof of fraud. |
| Authentication-Results | Checks reported by a receiving mail system, often including SPF, DKIM and DMARC. | Trust the results added by your provider, not a copied line from an unknown source. |
| Message-ID and dates | References useful to the mail provider or administrator. | They do not identify a person on their own. |
How should you read Received lines?
Mail servers normally add new Received information above earlier entries, as described in the SMTP standard. Reading from older entries upward can help explain the route, but the bottom line is not automatically a trustworthy sender address.
Start with the receiving infrastructure you trust and work back carefully. An attacker can include misleading earlier header text. A mail administrator can help decide where the reliable part of the chain ends.
Fields such as X-Originating-IP are not guaranteed to exist. Their absence does not prove that the sender used encryption, an anonymity tool or anything suspicious.
What can an IP address tell you?
A public IP lookup may suggest the network operator and an approximate location. Cloud mail, company gateways, mobile networks and VPNs can all put distance between that result and the person writing the message. Private IP addresses are not useful for public internet geolocation.
Do not try to identify or accuse someone from that result alone. For abuse, threats or repeated fraud, preserve the original message and report it through the mail provider or appropriate organization.
Does passing SPF or DKIM make an email safe?
No. Authentication helps check aspects of the sending domain and message, but a compromised or attacker-controlled account can still send harmful mail. Google’s authentication guide explains the checks and their limits.
Verify unexpected payment, password or account requests through a known contact method. If an email leads to a “verify your browser” page, see how to distinguish normal browser checks from fake command prompts.
Keep headers private when asking for help: they may contain email addresses, internal hostnames and other personal information. You can report a message without publishing its complete contents online.