How can I find the source and purpose of emails originating from unrecognized IP addresses?
Michael Ko
Co-founder & CEO, Suped
Published 3 Jul 2025
Updated 16 Aug 2025
7 min read
Unrecognized IP addresses appearing in your email logs, especially in tools like Google Postmaster Tools, can be unsettling. It raises immediate questions about email security and unauthorized sending. Understanding why these unexpected IPs are sending mail on your behalf is crucial for maintaining good sender reputation and protecting your domain.
When you see unfamiliar IP addresses tied to your domain's email activity, it's natural to be concerned about potential misuse, spoofing, or a compromised account. These rogue IPs can negatively impact your email deliverability, leading to messages landing in spam folders or even your domain being added to a blocklist (or blacklist).
My approach to investigating such anomalies typically involves a systematic breakdown of email metadata, starting with identifying the IP's owner and then drilling down into the specific email traffic. It’s a detective process that combines technical analysis with internal inquiry.
Identifying the unrecognized IP address
The first step when encountering an unrecognized IP address is to determine its ownership. A simple WHOIS lookup can provide valuable information about the network block owner and associated contact details. This initial investigation helps confirm whether the IP belongs to a legitimate service provider, a hosting company, or something more suspicious.
For example, if you find an IP address like 160.34.113.112 and a WHOIS lookup points to a large cloud provider, it indicates that the IP is part of their broader infrastructure. This doesn't immediately tell you who within that organization is sending emails or why, but it narrows down the scope considerably. It's often an infrastructure IP, not a dedicated email service provider's (ESP) IP.
Beyond a simple WHOIS, you can also perform a reverse DNS (rDNS) lookup. This reveals the hostname associated with the IP address, which can sometimes give further clues about its purpose. For instance, an rDNS record might indicate a specific server name or a generic cloud instance, guiding your next steps.
Performing a WHOIS lookupBASH
whois 160.34.113.112
Deciphering email headers
Once you have identified the IP, the next critical step is to analyze the headers of emails supposedly originating from it. Email headers contain a wealth of information, detailing the path an email takes from sender to recipient. Every server involved in relaying the email adds a "Received" header.
The "Received" headers are crucial because they are added sequentially, with the most recent one at the top. To find the true origin, you need to look for the oldest "Received" header that contains an IP address associated with your sending domain or the mysterious IP. This often reveals the initial sending server. Additionally, look for headers like X-Originating-IP, though its presence and accuracy vary. For more information on this, you can check our guide on the utility of X-Originating IP.
Analyzing these headers can confirm if the unrecognized IP is indeed involved in sending emails associated with your domain. If the IP appears in a Received header where your domain is the supposed sender, it strongly suggests a connection, authorized or otherwise. This is a manual process, but it's very effective for pinpointing the exact source. Understanding the full email header content is vital for security analysis.
Legitimate header signs
Sender alignment: Both SPF and DKIM domains align with your legitimate sending domain, often with a passing DMARC policy.
Known ESPs: The IP address and associated reverse DNS clearly belong to your authorized Email Service Provider (ESP).
Expected pathways: The email routing shown in the Received headers follows expected paths for your email infrastructure.
Suspicious header signs
Mismatched IPs: An unfamiliar IP appears in the Received headers, especially the earliest ones, or in X-Originating-IP.
No alignment: SPF or DKIM fails to align, or the email is unauthenticated, indicating potential email spoofing.
Generic or unassigned IPs: The WHOIS lookup for the IP points to a generic hosting provider or an unassigned block, not a known ESP.
Leveraging DMARC reports
DMARC reports are invaluable for identifying the source and purpose of emails, especially those from unrecognized IPs. These reports, specifically the aggregate reports (RUA), provide a comprehensive overview of all email traffic purportedly sent from your domain, showing which IPs are sending mail, their authentication results (SPF and DKIM), and DMARC alignment status. For more on DMARC, see our guide on DMARC, SPF, and DKIM.
If you have a DMARC record set up, you will receive XML reports (often daily) that list every IP address sending email on behalf of your domain. You can parse these reports to find the specific unrecognized IPs that Google Postmaster Tools or other services flagged. These reports will tell you how many emails were sent from that IP and whether they passed SPF or DKIM authentication for your domain. This insight is essential for understanding if the traffic is legitimate but misconfigured, or outright malicious.
The key is to look for IPs that are sending significant volumes of email but are failing DMARC authentication. If an unrecognized IP is present and its emails are passing DKIM authentication with your domain, it suggests that someone within your organization or an authorized third party is using that IP. You should then ask your internal technical teams, "Who is using this IP address to send email?" and "Can you provide a list of DKIM selectors associated with our domain and confirm their usage?"
DMARC reports show all sending sources
DMARC aggregate reports (RUA) provide a complete picture of all IPs sending email under your domain. This includes legitimate sources, misconfigured services, and even unauthorized senders. Regularly reviewing these reports is the most effective way to identify unrecognized IPs and their authentication status. If you see unexpected IPs with a DMARC policy of p=none, consider hardening your policy to quarantine or reject.
Resolving and preventing future issues
Once you've identified the IP and its owner, and ideally corroborated it with DMARC reports, the next step is to understand the purpose of these emails. If it’s an internal system or a third-party service you were unaware of (e.g., password reset emails from an internal application hosted on a cloud server), you need to ensure it's properly authorized and configured for email sending. This might involve updating your SPF record, setting up appropriate DKIM keys, and ensuring DMARC alignment.
If the unrecognized IP is not authorized and is sending email on your behalf, especially with failing authentication, it points to unauthorized use or spoofing. In such cases, you need to take immediate action. This could involve contacting the IP owner (if identifiable through WHOIS) to report abuse, updating your DMARC policy to p=quarantine or p=reject to tell receiving mail servers what to do with unauthenticated mail, or initiating a security audit to find the source of the unauthorized sending. Tools for blocklist monitoring can help you keep an eye on your sending IPs.
To prevent these issues from recurring, establish a robust process for managing all email sending sources. This includes maintaining a comprehensive inventory of all services and systems authorized to send email from your domain, regularly reviewing your DNS records (SPF, DKIM, DMARC) for accuracy, and performing periodic audits of your email infrastructure. Proactive monitoring through Google Postmaster Tools and DMARC reporting tools are essential for continuous oversight.
Scenario
IP identification
Recommended actions
Authorized but unrecognized
WHOIS points to known cloud/hosting provider; DMARC shows passing DKIM for your domain.
Verify with internal IT teams. Update SPF and DKIM if needed for proper authentication.
Unauthorized/Spoofing
WHOIS points to suspicious entity or generic range; DMARC shows failed authentication (especially DKIM).
IP is listed on multiple public blacklists; WHOIS shows known spammer or proxy.
Immediately adjust DMARC policy. Monitor for new attacks. Ensure your domain reputation isn't suffering. Consider using a blocklist checker.
Views from the trenches
Best practices
Implement DMARC: Use DMARC reports to gain comprehensive visibility into all sending IPs associated with your domain, authenticating legitimate traffic and identifying suspicious sources.
Perform WHOIS and rDNS lookups: Utilize these command-line tools or online services to identify the owner and hostname of suspicious IP addresses.
Analyze email headers thoroughly: Examine "Received" headers to trace the email's true path and identify the earliest recorded IP, and check for `X-Originating-IP` if available.
Communicate internally: Engage with your IT and technical teams to identify internal systems or third-party services that might be sending emails from unexpected IPs.
Common pitfalls
Ignoring unknown IPs: Overlooking unrecognized IP addresses in monitoring tools can lead to reputation damage or indicate an ongoing security breach.
Misinterpreting IP ownership: Assuming an IP belongs to a major cloud provider means it's automatically legitimate without further investigation into its actual email activity.
Not leveraging DMARC: Failing to implement DMARC or properly analyze its reports means missing the most critical source of data for identifying unauthorized senders.
Over-reliance on external tools: While helpful, don't solely depend on external blacklists or reputation checkers without conducting your own detailed header and DMARC analysis.
Expert tips
Proactive monitoring: Continuously monitor your sending IP reputation in tools like Google Postmaster Tools for any anomalies.
DKIM verification: For suspicious IPs, verify if their emails are DKIM signed with your domain; if so, investigate internally about the private key usage.
Trap networks insights: Consider how trap networks or similar internal monitoring can reveal what types of emails are being sent from certain IP ranges.
VPN alerts: Set up alerts for logins to your VPN or other infrastructure if unexpected IP activity seems to stem from administrative access.
Expert view
Expert from Email Geeks says you cannot officially get a list of emails sent from an IP, but you can use services like Senderscore and Senderbase to get a list of domains. You can also perform an rDNS lookup and search for the hostname on Google.
2022-08-09 - Email Geeks
Marketer view
Marketer from Email Geeks says that if you have access to the server MTA where the IP resides, you can access all the logs. However, if you're using a platform to send emails, you'll need to ask your delivery manager for this information.
2022-08-09 - Email Geeks
Maintaining a clear sending footprint
Unrecognized IP addresses appearing in your email sending reputation reports or DMARC aggregate data demand immediate attention. By systematically investigating email headers, performing WHOIS and rDNS lookups, and most importantly, diligently analyzing your DMARC reports, you can pinpoint the source of these emails. Whether it's a legitimate, but unacknowledged, internal system or an outright malicious spoofing attempt, understanding the origin is the first step toward safeguarding your email ecosystem and ensuring optimal deliverability.
Google Postmaster Tools or other services flagged. These reports will tell you how many emails were sent from that IP and whether they passed SPF or DKIM authentication for your domain. This insight is essential for understanding if the traffic is legitimate but misconfigured, or outright malicious.
