What an email header is
Every email carries a header, a block of technical lines added as the message travels. The header records the route the message took, with a line for each mail server that handled it, and these lines are usually labelled Received. Read from the bottom up, they show the servers in the order the message passed through them. The line nearest the bottom shows where the message entered the mail system, and it often includes the IP address of the sender's connection or of the sender's mail server.
The header also shows the sender and reply addresses, the date, a message identifier and sometimes the program used to write the message. Some of these fields can be forged, so the header is a starting point for investigation and not proof of who sent the message.
Where to find the header
In Gmail, open the message, open the menu next to the reply button and choose the option that shows the original message; the full header is displayed, and the Received lines can be read from it. In Outlook on a computer, open the message in its own window and view its properties, where the internet headers are shown in a box. In Yahoo Mail, the option to view the raw message shows the same lines. The exact menu names change from time to time, so the help pages of the service are the safest guide.
Once the header is open, look for the first Received line, the one at the bottom, and for a field that gives the originating address. The IP address can then be looked up with a public lookup tool to see the provider and the approximate location of the network. The location is the location of the provider's network, not of a person.
What the IP address does and does not show
An IP address identifies a connection, not a person. Many people share a connection in a home, an office or a public network. A sender may use a service that hides the address or sends the message from a different machine. Web-based mail services often show the address of their own servers in place of the sender's. The result may be only a name of a provider.
To go from an address to a person, the records of the internet provider are needed, and those can be obtained only by the police or a court. Section 67C of the Information Technology Act requires an intermediary to preserve and retain specified information for the period and in the manner that the Central Government prescribes, which is why a prompt complaint matters.
The legal limits for the person tracing
Reading the header of a message that one has received is not an offence. Going further is. Section 43 makes a person who accesses another person's computer, computer system or network without permission liable to compensation, and section 66 makes the act a crime where it is dishonest or fraudulent. A person who finds an address and then tries to enter the sender's system, or confronts the person, risks committing an offence or making matters worse.
The proper course for a threat, fraud or harassment is to keep the original message with its full header and report it. The steps are in the guide on how to file a cyber crime complaint online, and the handling of such evidence is explained in the page on computer forensics. The offences that apply are listed in the guide to the IT Act 2000.