How to View Raw Email Headers in Gmail to Trace IP Addresses

Why Check Raw Email Headers?

An email header contains the hidden metadata that tracks a message’s journey from the sender’s outbox to your inbox. While the standard Gmail interface only shows you the “From,” “To,” and “Date” fields, the raw header contains the complete routing history. This includes the IP addresses of every mail server the message passed through. Reviewing the raw headers is an essential troubleshooting step if you need to determine why an email was flagged as spam, verify if a sender’s address is forged (spoofing), or trace the geographic origin of a suspicious message.

How to Access Raw Headers in Gmail

Gmail makes it relatively simple to view this hidden data, though the option is tucked away in a sub-menu.

1. Open Gmail in a web browser on your computer. (This feature is not fully available on the Gmail mobile app).
2. Open the specific email you want to investigate.
3. In the top right corner of the email message window (next to the Reply arrow), click the three vertical dots (More menu).
4. From the dropdown menu, select Show original.

Understanding the “Show Original” Page

Clicking “Show original” will open a new tab containing a vast amount of technical data.

The top section of the page provides a highly useful summary generated by Google. This summary automatically decodes the most critical security information, including whether the email passed SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC checks. If any of these say “FAIL,” the email is highly likely to be spoofed or malicious.

How to Trace the IP Address

To find the actual IP address of the server that sent the email, you need to look at the raw text below the summary box.

1. Scroll down to the section that looks like a wall of text (the actual raw header).
2. Press Ctrl + F (or Cmd + F on a Mac) to open the browser’s search function.
3. Search for the phrase Received: from.
4. You will likely see multiple “Received:” lines. Email headers are written chronologically from bottom to top. Therefore, the lowest “Received:” entry in the header block usually represents the very first server that handled the email (the sender’s server).
5. Look for an IP address (e.g., [192.168.1.1] or an IPv6 address) listed on that specific line.

Once you locate this originating IP address, you can copy it and paste it into any free online “IP Lookup” or “WHOIS” tool to determine the geographic location and internet service provider associated with the sender.