Email Lookup Guide: Find an Address or Identify a Sender

An email lookup works in two directions. You either start with a person and need their work address, or you start with an address in your inbox and need to know who is behind it. This guide gives the first a short summary and spends its length on the second: checking a sender through the address, the domain, and the headers, then the legal limits that apply once you write to someone.

What an email lookup can reach, and where it stops

A manual lookup only reaches information that someone chose to publish or that a mail system records in plain view. That includes a company website, a team or press page, a domain’s registration record, a social profile, and the headers attached to a message you received. It does not include a private inbox, a provider’s account records, or anything that sits behind a login you do not own.

Keep two limits in mind from the start:

• A name in the From line proves nothing. Microsoft notes that some senders use spoofing to disguise their email address, and that checking the header shows whether the real address differs from the one displayed.
• A guess is not a result. An address you built yourself stays a guess until a deliverability check or a reply confirms it.

Finding a person’s work address: a short summary

If you start from a name and a company, an email address search relies on public sources, not tricks. Look first at what the company itself publishes, such as team, press, and contact pages, then at what the person publishes about themselves. A web search narrowed to the company’s domain often shows how addresses there are formed. Where nothing personal is public, a role inbox or a contact form is a legitimate route, and asking a mutual contact is too.

Two cautions apply. Domain registration records rarely give you a named person’s inbox any more, as the domain section further down explains. And an address you derive from a company’s format is a candidate, not a fact, so check that it accepts mail before the first message.

The full method to find email address details for a named person, one source at a time and in the order to try them, is in our guide to finding someone’s email address. The rest of this article stays with the opposite problem: an address you already have, and a sender you cannot place.

Reverse email lookup for an unknown sender

A reverse email lookup starts from a message you already have. The aim is not to unmask a stranger. It is to decide whether the message is genuine, who it claims to come from, and whether it is safe to answer. Work from the outside in: the address, then the domain, then the headers.

Search the address itself

Put the full address in quotes and search for it. Google’s help page on refining web searches explains that quotes return pages with the exact phrase, and that site: in front of a domain keeps results on one site. Public results can include a company page, a forum signature, or a scam warning posted by someone who got the same message. An address with no public trace at all, claiming to belong to an established company, deserves more caution.

Then search the name in the signature together with the company name, for example “jane doe” site:example.com, and check whether the public profile, the company site, and the email domain agree.

Read the domain

The part after the @ carries a lot of weight. Check that:

• The domain matches the company it claims. Lookalike spellings, extra words, or an unexpected country ending are warning signs.
• The domain has a real site. Visit it by typing the address yourself, not by clicking a link in the message.

Look the domain up in ICANN Lookup

ICANN Lookup queries a domain’s registration data over RDAP. ICANN’s Registration Data Access Protocol page says RDAP was built as the replacement for WHOIS, and that as of 28 January 2025 gTLD registries and registrars no longer have to run WHOIS services, except for .com, .name, and .post.

According to the tool’s own FAQ, a lookup can show the registrar sponsoring the domain and, where they are available, dates for when the registration was created, updated, and expires. The same FAQ says that because of applicable law and ICANN policies, not every field is returned, and results vary between registrars and registry operators. For a suspicious sender, the creation date is the useful part: a domain registered recently that presents itself as a long running firm deserves a second look. The FAQ also lists the registrar’s abuse contact email among the fields, which is where a phishing domain can be reported.

Do not expect a name. An ICANN Contractual Compliance advisory notes that ICANN’s Registration Data Policy has applied since 21 August 2025. Under it, a registrar that hides the registrant’s email has to show a substitute: either a contact address or a link to an online form that forwards your message.

Open the full message headers

Headers record which servers handled a message and whether the sending domain passed authentication. Microsoft describes the internet header as a list of technical details such as who sent the message, the software used, and the servers it passed through.

How to open them:

• Gmail on a computer: open the message, click More next to Reply, then Show original. Google’s help page on tracing an email with its full header also points to the Google Admin Toolbox Messageheader tool, where you paste the header and analyze it.
• New Outlook, plus the web version and Outlook.com: select More actions in the message window, then View, then View message details, according to Microsoft’s guide to viewing internet message headers in Outlook.
• Classic Outlook for Windows: open the message in its own window, then File, then Properties. The header shows in the Internet headers box.

Read SPF, DKIM, and DMARC results

Once the header is open, look for the line that records authentication. Microsoft’s reference on anti-spam message headers explains that the results of SPF, DKIM, and DMARC checks are stamped in the Authentication-Results header of inbound mail. What each result means, in that reference’s terms:

Microsoft’s SecOps guide to email authentication adds that a DMARC failure means neither SPF nor DKIM passed in alignment with the From address domain.

Treat a pass as one signal, not a verdict. It is a statement about the domain in the From line, not about the company the message claims to speak for, so the spelling and registration checks above still matter. Also compare the From address with Reply-To and Return-Path. If replies would go to a different domain than the one shown, ask why.

Spot phishing before you reply

Google’s guide to avoiding and reporting phishing emails suggests checking that the email address and the sender name match, and hovering over links on a computer to see whether the real URL matches the description. The FTC’s consumer page on recognizing and avoiding phishing scams lists common hooks: claims of suspicious log in activity, a problem with your account or payment details, an invoice you do not recognize, or a link to make a payment.

If you think a message may be real, contact the company through a phone number or website you already know, not through the details in the email. If you conclude it is phishing, the FTC’s advice on protecting yourself from phishing is to forward it to the Anti-Phishing Working Group, whose address is on its phishing reporting page, and to report it at ReportFraud.ftc.gov. In Gmail you can also use Report phishing from the More menu.

Verify an email address before you write back

Sometimes the sender checks out and you want to reply, or a message gives you a new address to use, such as a colleague’s or a billing contact’s. Before you rely on it, confirm that it exists and accepts mail. Our walkthrough on how to check an address before sending covers the format, domain, and mailbox checks in order and explains how to read uncertain results. If a check cannot settle it, reply to the address that already wrote to you, not to a new one quoted in the message body.

Email lookup checklist for an unknown sender

Privacy and legal limits of an email lookup

Finding an address is one step. Using it is where the law applies. The rules below are summaries of official guidance, not legal advice, so check them against your own situation.

GDPR: you need a lawful basis

If you process personal data of people in the EU, the European Commission’s page on grounds for processing lists six: consent, a contract, a legal obligation, a task in the public interest, vital interests, and legitimate interests. Legitimate interests only work after you have checked that the person’s fundamental rights and freedoms are not seriously impacted.

Two further points matter for a lookup:

• You must tell people where you got their data. The Commission’s page on what information must be given to individuals says that when data comes from another source, the organization must say which source and whether it was publicly accessible, no later than one month after obtaining it, or at the first communication with the person.
• Bought or shared lists carry the seller’s problems. The Commission’s guidance on data received from a third party for marketing says such lists are processed on legitimate interests, people keep the right to object, and you must not send advertising to anyone who objected.

CAN-SPAM: US rules once the message is commercial

According to the CAN-SPAM Act compliance guide published by the FTC, the Act reaches every commercial message, B2B mail included, not only bulk sends. Breaking those rules can cost as much as $53,088 per message, which the FTC counts one email at a time. What it requires:

• No false or misleading header information, and no deceptive subject lines.
• Identify the message as an ad where it is one.
• Show a real postal address for the sender, such as a street address or a registered PO box.
• Tell people how to stop further marketing mail. The opt-out has to keep working no less than 30 days past each send, and each request must be acted on within 10 business days.

When not to look someone up

Some lookups should not happen at all, whatever the tools allow:

• The person has asked not to be contacted. An earlier “no” or an unsubscribe ends the matter.
• The purpose is personal, not professional. Tracking down a former partner, a reviewer who criticized you, or a private individual who has not made contact details public is not a business lookup.
• You plan to bulk mail the result. Scraping or guessing addresses for a mass campaign runs straight into the consent and opt-out rules above.
• The sender is threatening you. Keep the original message and full headers, and take it to the police or your provider rather than trying to identify the person yourself.

Writing once you have the address

Keep the first message short, say how you found the address, give one reason for writing, and leave the reader a simple way to decline. Our email sending tips cover formatting and timing, and if you are writing from a new domain, our guide on setting up a professional email address explains why the From line matters to the person receiving it. Plan details for Email Finder Online are on the pricing page.

Frequently asked questions