Tracing An Email

The purpose of this guide is to show the process involved in tracing an email. The first step required to tracing an email is finding out the headers of the email. What are headers? Email headers are lines added at the top of an email message that are used by servers as the email goes on route to get delivered. Generally email clients only show the standard To, From, and Subject headers, but there are more.

1) Enabling Email Headers


Enabling Email Headers For Gmail

Step 1:Once Logged into your Gmail Account open the Email whose headers you want to view. Click on the “More Options” link in the message next to the date of the email.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 2: Now click the “Show Original” link.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 3: This link will popup a new window the headers and the body of the message.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Enabling Email Headers For Hotmail

Step 1:Once logged in, click on the "Options" link in the upper navigation bar.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 2: Now click on the "Mail Display Settings" link.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 3: Change the "Message Headers" option to "Full" and click ok.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 4: Go to your inbox and open any one of your email. You emails show now contain additional headers.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Enabling Email Headers For Yahoo



Step 1:Once logged in, click on the "Options" link in the upper navigation bar.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 2: Now click on the "General Preferences" link.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 3: In the paragraph titled Messages and locate the "Headers" heading and select "All".


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Step 4: Go to your inbox and open any one of your email. You emails show now contain additional headers.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


2) Understanding Email Headers


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


In this example the “Sender” located at
To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.
want to send an email to “Receiver” located at
To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.
. The sender composes his email at his workstation in the university’s computer lab (lab.exampleuniversity.edu). Once completed the email message is passed to the university’s mail server called mail.exampleuniversity.com. The mail server seeing that it has a message for
To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.
, contacts someisp.com mail server and delivers the email to it. The email is stored on someisp.com server until Receiver logs on to check his/her inbox.

In this example, four headers will be added to the email message. This first header is generated by email client on lab.exampleuniversity.edu when forwarding it to the mail server at mail.exampleuniversity.edu.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


The following header is added when mail.exampleuniversity.edu transmits the message to mail.exampleisp.com.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.

The following header is added when mail.exampleisp.com stores the message on the server for Reciever.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


The following header is added when Reciever downloads the email from home machine called reciever.local.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


3) Tracking The Orginal Sender

The easiest way for finding the original sender is by looking for the X-Originating-IP header, this header is important since it tells you the IP Address of the computer that had sent the email. If you can not find the X-Originating-IP header then you will have to sift through the Received headers to find the sender's ip.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Once the email sender's ip is found go to
To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.
to begin a search.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Now click on the "NET-24-16-0-0-1" link.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Scroll down the page untill you find the OrgAbuseEmail field.


To view links or images in this forum your post count must be 5 or greater. You currently have 0 posts.


Remember to include all the headers of the email along with an attached copy when filling a complaint.