Emails are still the most popular way of communicating online, especially for formal communications.
Whether it’s work correspondence, catching up with friends, or advertising, email is the preferred medium of contact. We’ve all come to accept it as a regular feature of our lives.
But as much as emails and internet mail applications are ubiquitous, we can’t ignore the many problems that regularly accompany email communication.
Usually, the first thing people do when they receive an email is to check who sent it. Therefore, one of the most pertinent concerns for people is to trace the origin of an ambiguously-sent email.
Did you know that emails come with much more information than what appears in most email clients? The header alone contains enough data about the sender to help you trace the email back to its source.
Furthermore, if you doubt an email’s validity, you can check the sender’s IP address. Although it won’t confirm the validity, it can provide an approximation of the sender’s location.
It can help you decide whether the source is trustworthy or not and whether you should open it.
If you’re wondering what an IP address is, it’s a number that identifies the device connected to a network.
It allows devices to communicate with other devices over the Internet and acts as an identifier for a specific device, much like your house address identifies your home.
Unfortunately, you can’t find the IP address on the header when you open an email. For that, you will have to do a little digging.
But why would anyone need to trace an email address? Doesn’t it sound like a breach of privacy? Read on as we discuss:
Table of Contents
Why Trace An Email Address?
Before we go ahead and discuss how you can trace an email address, let’s gloss over a few reasons people tend to trace them.
Cybercrime has become all too common in today’s day and age, and emails are among the most popular routes for hackers to penetrate systems.
Electronic mail from unknown sources may often ask you to click on a link that installs malware on your device. These malicious links can retrieve your financial data and identity with a method known as phishing.
Other times, you can be contacted by scam artists looking to rope you in for fraudulent schemes. Knowing the source of an email can help you decide whether it’s wise to click on it or not.
In other instances, you might want to trace an email to block persistent sources of spam or abusive content.
Marking content as spam tells your email service to filter out emails of similar nature from your inbox. Most server administrators use tracing to mark spam the same way.
How to Trace an Email Address
At times the anonymity of the Internet can be abused; therefore, it is crucial to confirm the source and identity of anyone you interact with. Doing so will help you protect yourself and prevent future cases of cybercrime and abuse.
It’s pretty easy to trace the location through the IP itself, and it can be done with the help of various applications and free tools. However, the tricky part is, retrieving the actual IP address.
Once you have the sender’s IP address, you can track their location using any IP tracking tool. The IP address information you’re looking for can be found in the field named SPF (sender policy framework), and getting to that portion is what we’ll be discussing.
You can trace the sender of an email by looking at the full email header, which contains all the routing information and metadata. Much of this information is technical data that a regular layperson wouldn’t know how to interpret, but it’s important because it is vital to trace the email source.
Generally, most email clients, such as Gmail and Outlook, don’t display this full email header because it’s rather useless to a regular user. However, if required, users have the option to access the header.
The visible portion of the email header is just a small part of the complete information stored behind it. Users generally only get to see the “To” and “From” address fields along with the subject line.
Here’s how you can open the complete header in three different email clients:
- Gmail Email header: Open your Gmail account and go to the email you want to trace. Select the drop-down menu located at the top-right corner and then click on ‘Show Original’
- Outlook Email header: Double click on the email that you wish to trace. Head onto File > Properties. Click on the message you want to check, and in the View pane, click the Action menu. Select ‘View Message Source’
- Yahoo Email header: Open the email, click on More (three horizontal dots) located at the top and select ‘View Raw Message’
- Apple Mail Email Header: Open the email and click on ‘View Message > Raw Source‘
We are aware that there are numerous other email clients. The information on how to access their header is readily available on the internet.
Making Sense Of The Full Email Header
Here’s where we get to the tricky part; you may get confused by the complicated jargon in the full email header. It looks like a lot of information that can be hard to wade through.
When reading the full email header, consider the following:
Email headers must be read from bottom to top, with the oldest information located at the bottom. Moreover, every server that the email travels through is added to the ‘Received’ portion.
Let’s take a look at some of the data within the email header:
Gmail Email Header Lines
Here’s a breakdown of the information found within the header and how you can make sense of each line while reading from bottom to top:
- Reply-To: This is the email address you send your response to
- From: This shows the email sender (but it is not a reliable indicator as it can be forged)
- Content-type: This instructs your email client on how to interpret content. Some standard character sets are UTF-8 and ISO-8859-1
- MIME-Version: This is a declaration of the email format standard that is in use
- Subject: This is a header for the subject of the email and its content
- To: This indicates the recipients of the email
- DKIM-Signature: DKIM stands for Domain Keys Identified Mail, and it authenticates the domain that the email was sent from. It helps protect against sender fraud and email spoofing
- Received: This shows every server that the email traveled through before reaching your inbox. The list is read from bottom to top, with the original sender being the bottom-most line
- Authentication-Results: This contains a record of all the authentication the email has been through, and it can include more than one authentication method
- Received-SPF: The Sender Policy Framework is a part of the authentication process, and it protects against forgery from the sender’s end
- Return-Path: This shows the location where bounce or non-sent messages end up
- ARC-Authentication-Results: The Authentication Receive Chain is another standard of authentication, and it verifies the email intermediaries’ and server identities that relayed your message
- ARC-Message-Signature: This signature takes a snapshot of the message header information to use for validation purposes like DKIM
- ARC-Seal: This serves to seal ARC authentication results and the message signature to verify the contents and is used for validation like DKIM
- X-Received: This is slightly different than the ‘Received’ information since it is non-standard. It also displays the non-permanent address, such as a mail transfer agent or Gmail SMTP server
- X-Google-SMTP-Source: This shows the email transferring using a Gmail SMTP server
- Delivered-To: This displays the final recipient of the email in the complete header
Although this list is quite extensive and may not make sense to some, the good thing is that you don’t need to understand all of these terms to trace an email.
These terms are simply a breakdown of the complete email header, and as you learn to look through them, you will quickly learn to trace the email sender.
Tracing The Original Sender Of An Email
To trace the origins of the IP address – or the person who sent you the email – you need to locate the first ‘Received’ in the complete email header. Right next to the first Received line, you will see the IP address originating from the sender’s server.
In some email headers, it can even be classified as X-Originating-IP or Original-IP.
Once you have found the original IP address from the email header, you can use several different sites to find the source of this IP address.
You don’t need to search for the source IP yourself since it is a very long and arduous process, and it’s much easier to use a dedicated header-analyzing site.
Some of the most widely used header analyzers are:
- GSuite Toolbox Messageheader
- MX Toolbox Email Header Analyzer
- IP-Address Email Header Trace
All you need to do is copy the complete header into the text box and click ahead. The site will analyze it and revert with the IP address.
For MX Toolbox, paste the IP address in the box, change the search type to Reverse Lookup, and press enter in the drop-down menu. The site will display in-depth information about the original server.
It’s important to note that private IP addresses can be untraceable, and header analyzer sites will not return any results. In that case, you will be shown something similar to this message:
The following IP ranges are private:
- 0.0.0-10.255.255.255
- 16.00-172.31.255.255
- 168.0.0-192.168.255.255
- 0.0.0-239.255.255.255
While these header analyzers and IP locating tools make your work a lot easier and save a lot of time, the results arent always accurate.
The information they display regarding the sender can be vastly different from actual data. The location shown may also be entirely off the mark.
If you’re trying to find the originator of an email sent through a Gmail account, you wouldn’t have much luck, as it will only display the location of the last Gmail server and not the sender’s IP address.
Tracing the geographical location of the IP address can be handy. If you’ve received an email from PayPal and the IP address originates from a dubious place, the chances are that it’s a phishing email.
Formal emails will only come from specific locations, and if they aren’t, that is a red flag.
Finding the geographical location of an IP address is incredibly easy, and you can utilize an IP location site for it, such as whatismyip.com or IP Tracker.
All you need to do is paste the IP address from the header into the search box, and the site will display a map showing the IP address’s location alongside other relevant information.
Once you know the location of the IP source, you can confirm with relevant authorities through correspondence.
It’s important to note that it’s very easy for spammers to use proxy servers and hide their actual IP addresses or put in multiple ‘Received fields’ in the email header to throw you off. If the source seems fishy, it’s better to ignore or delete it.
If you have established that the sender is fake or impersonating someone else, you can block them directly or through their IP address. Any further messages they send to you will be filtered out.
It’s important to note that Gmail does not have this feature yet. Your only solution would be to mark their emails as spam or ignore them.
These days, you can find numerous applications and software to help you deal with spammers and unwanted emails. A quick search can help you find one alongside instructions on how to use it correctly.
Locating Sources On Social Media
Social media also poses many cyber-security threats and potential privacy loopholes that not many people are aware of.
Most users are unaware of how vulnerable they are to exposure while posting their personal information on social media platforms.
People tend to use similar usernames for different social media platforms. And it’s very straightforward to find their profiles using their email address.
Subsequently, it becomes possible to track their location based on the information they publish.
Once again, this technique is not very reliable, as spammers tend to use fake social media profiles and addresses.
Taking Care Of Your Email Security
This task is often restricted to IT security experts, but ensuring email security is something every business should prioritize among all departments.
Coaching employees on measures to prevent security compromises is a good start.
From interns to senior managers to CEOs and more — everybody uses emails to communicate. These correspondences can contain some confidential information, and that’s why email security should be an essential part of any good business network.
To do that, you must be aware of all potential threats to your network from emails and how you should secure all devices connected to the network.
Hackers employ various tricks to steal sensitive information using emails. Here are some of the most commonly used methods:
Spoofing
This method allows hackers to penetrate your network by posing as legitimate users to gain confidential information from employees tasked with public outreach.
They can add malware – such as ransomware and scareware – to email attachments during correspondence.
You can protect yourself from spoofing by using verifiable spam filters. And always remember to read and review before replying to an email!
Take some time to go over the email address. Is the email really from your client or colleague, or are the contents unusual? Spending a few minutes going over emails in detail can save you from many troublesome hours.
Phishing
Hackers use this method to steal the identities of unsuspecting individuals. The tell-tale signs of an interaction with a fisher are:
- They utilize official-looking email addresses that may seem unconvincing
- They pose as representatives from organizations such as banks or credit card companies
- They may ask you to reveal delicate information, such as your account number, social security number, and password
You can protect yourself from phishing attacks in much the same way you can for spoofing. Take some extra time to review emails, as well as any links or attachments added to them.
If you receive an email from the bank, ensure that the site’s security clearance is complete. If you have any doubts, call up their official number and confirm whether they have sent the email.
Spam
Spam might seem more of an annoyance than a significant security issue; however, it can end up causing you a lot of trouble.
Often, spam emails contain hidden malware or other viruses that may cause your entire network to collapse.
Usually, spam filters and anti-malware programs can offer adequate protection against spam and its resultant threats.
Staying Safe From Cyber Attacks
As an individual and collectively, you can take several steps to ensure that your network is protected from email security threats.
Bringing Awareness To Employees
If you’re working in an organization, it’s essential to ensure that all employees are vigilant about potential cyber-threats and do their part to keep the network protected.
Educate them about network security and potential threats. Inform them regularly about security and network updates, and make sure to give new hires a complete walk-through of network security rules.
Use Strong Passwords
Weak passwords are easy to breach. Using a unique password, with a mix of numbers, letters, and symbols – or a phrase or word that only you know – is a sure-fire way to protect from cyber-miscreants.
Try to use different passwords for different accounts so that even if one account gets compromised, the rest are safe.
Backing Up Your Data
Backing up your data on an off-site backup store ensures a possible recovery even if your data falls at the hands of malware.
Building everything from scratch after a cyber-attack can be very expensive, time-consuming, and stressful. In some cases, losing data on a massive scale is a fatal blow to businesses.
Limiting Attachments
Large attachments are often indicative of malware. These types of viruses are known to increase the size of attachments in suspicious ways. It’s a good idea to install limits to the size of attachments and clean out your inbox regularly.
Adding Filters
Putting in the right kind of filters can help protect you from malware and other network security issues. It’s better to discuss the level of internet filtering necessary for your organization with an IT security professional.
Too much filtering will slow down your network and damage overall productivity. IT experts can help you strike a balance.
Stay Updated
Always make sure that your network security is updated with the current standards. Outdated systems pose compatibility issues with newer devices, and hackers can easily exploit this to penetrate your system.
Remember to update your software regularly. Software updates close any loopholes and contain optimized security measures that hackers cannot bypass.
Wrapping Up
While we discussed how to track someone’s location using their email, this information should be used ethically and not to breach someone’s privacy.
To summarize, IP addresses can be changed and hidden, so many at times you won’t get the right results.
If you feel the sender is sending red flags, such as suspicious speech patterns or requests, try to trace them through social media and use the IP address trace. Make sure that the email address is verifiable or can be counter-checked.
If you still don’t find any results, it’s better to block the sender directly or through their IP address and report them to tech support. Better safe than sorry!
FAQs
Can An Email Be Traced To A Cell Phone?
While it is easy to trace emails through computers, it is challenging to trace emails and determine a sender’s location through a cellphone, as it is less location-specific.
Does A VPN Hide Your Email Address?
Instead of using your IP address to send emails, a VPN provider will assign a different IP address to your email so that it can be hard to trace the original sender’s location.
