Email Header Tracer
Paste the full raw headers of a message to find the IP address it was sent from, where that address is located, who operates it and whether it is blacklisted.
- Runs on our servers
- Free to use
- API available →
About this tool
Every mail server that handles a message adds a Received: header on top, so the chain, read from the bottom up, reconstructs the path from sender to you. The Email Header Tracer parses that chain and other sender hints (X-Originating-IP, X-Sender-IP, SPF results), picks the most likely origin address and enriches it with geolocation, ISP, ASN, blacklist detections and whois, together with the message's From, Subject, Date and authentication results.
It is the first step when investigating phishing, spam or threats: the whois output gives you the abuse contact to notify. Check a single address directly with the IP Blacklist Check.
How to use it — quick steps
- 01
Enter the raw e-mail headers
Type or paste the raw e-mail headers in the field above. Use Ctrl + V to paste from the clipboard.
- 02
Press "Trace e-mail"
Press "Trace e-mail" or Ctrl + Enter. The result appears below in a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
Smart sender detection
X-Originating-IP, SPF "permitted sender" and the earliest public Received hop are examined to find the real origin.
Location and reputation
The sender IP is geolocated and checked against blacklists, with whois data for abuse reports.
Full Received chain
Every hop is listed in order so you can follow the path the message took.
Frequently asked questions
Where do I find the headers?
Gmail: open the message menu and choose "Show original". Outlook: File → Properties → Internet headers. Apple Mail: View → Message → All Headers. Copy everything from the first Received: line to the blank line before the body.
The sender IP is a Google or Microsoft address
Webmail providers send through their own servers and hide the user's IP; in that case the originating address cannot be recovered from headers.
Can headers be forged?
Received lines added by servers after the sender are trustworthy; anything the sender wrote themselves (From, X-Originating-IP, early Received lines) can be fake. The tool prefers values confirmed by SPF where available.