How to Trace an Email Using Its Headers

Tracing an email means reconstructing the route it took between mail servers. It is useful for diagnosing delays, finding where a message was handed to a forwarder, or identifying which service sent it. It is not a way to unmask a person, and it is worth being clear about that before you start.

Step 1: Get the full raw headers

Open the message in the receiving mailbox and copy the complete original headers: Show original in Gmail, Message details or Internet headers in Outlook, All Headers in Apple Mail. Copy only the header block, not the body.

Step 2: Number the Received headers from the bottom

Each server prepends its Received header, so the bottom header is the oldest. Number them from the bottom: hop 1 is the first server that accepted the message, and the top hop is usually your own provider.

Received: from mx.example.net (mx.example.net [198.51.100.5])
        by mailbox.example.net with ESMTPS id 8f2a;
        Thu, 8 Oct 2026 12:30:12 +0530          <- hop 2 (newest)
Received: from mail.example.com (mail.example.com [203.0.113.25])
        by mx.example.net with ESMTPS id 1c9d;
        Thu, 8 Oct 2026 12:30:10 +0530          <- hop 1 (oldest)

Step 3: Read each hop

• from: the name the sending server gave itself (its HELO), often followed by the reverse-DNS name and IP address the receiver actually saw.
• by: the server that wrote the line, which is the one that received the message.
• with: the protocol, such as ESMTP, ESMTPS (TLS) or ESMTPSA (TLS with authentication).
• id and for: the receiving server's queue ID and, sometimes, the recipient.
• The timestamp after the final semicolon.

The important detail is that the from part is partly self-reported: the IP address in square brackets is what the receiving server observed, but the name before it is whatever the sender announced.

Step 4: Convert timestamps and compare

Convert each timestamp to UTC and subtract to see how long each hop took. A gap of several minutes often means greylisting, queueing or scanning. A later hop that appears earlier than the previous one usually points to an unsynchronized clock rather than anything sinister. The Email Header Analyzer does the conversion and flags unusual delays and ordering.

Step 5: Decide how much to trust each line

Your provider's Received header is the most trustworthy because it records a connection your provider actually handled. Anything lower in the chain is a claim by another system, and a sender can add invented Received lines at the bottom to confuse a reader. Authentication results from your own provider help you decide whether the first hop was authorized for the sender's domain.

If the message contains links, a separate question is where they lead. The Redirect Chain Analyzer follows redirects hop by hop, which is a different kind of trace.