Email passes through mail infrastructure
SMTP messages can accumulate Received headers as servers relay the message. Those lines describe mail-handling infrastructure and routing hops.
Do not assume every address belongs to the sender
A header may show a provider, outbound mail server, security gateway or organizational relay. Consumer webmail services can intentionally avoid exposing the user's residential IP in the message headers.
How to investigate responsibly
Identify which header lines were added by trusted mail systems, check the network ownership of relevant IPs, and treat the result as routing evidence. Header parsing requires attention to trust boundaries because user-supplied header content can be forged.
IP lookup is only one part
ASN, RDAP and reverse DNS can explain who operates an address, but they do not prove who authored a message. Authentication mechanisms such as SPF, DKIM and DMARC answer different email-security questions.
Why the answer depends on the mail system
Modern webmail providers commonly relay messages through their own servers and may not expose the sender's home IP in the headers a recipient sees. Self-hosted systems, older mail clients or unusual configurations can behave differently, so the header path matters more than a blanket yes-or-no answer.
What to inspect in an email header
Received headers describe the sequence of mail servers that handled a message. An IP found there may belong to a mail provider, filtering service or relay rather than the person who wrote the email. Use RDAP and ASN data to identify the network before drawing conclusions.