Should I use shared IP addresses for phishing simulation emails?

Email marketer from SearchSecurity explains that using shared IP addresses for phishing simulations could lead to the IP being blacklisted if recipients report the emails as phishing, affecting other users on the shared IP.

Email marketer from Mailjet emphasizes that maintaining a good sender reputation is key for email deliverability. Using shared IPs for phishing simulations may damage this reputation if the emails are flagged as spam, thus impacting other users sharing the same IP.

Email marketer from Heimdal Security responds that if phishing simulations are not conducted carefully, they can backfire and lead to a negative impact on the company's reputation and the trust of its employees. Always use a dedicated IP to isolate these tests.

Email marketer from Email Geeks shares that sending should be limited to one receiving domain used by test subjects as a safety net, and that this is something they would do as an ESP employee after confirming the legitimacy of the case.

Email marketer from SaneBox responds that poorly planned phishing simulations can backfire, leading to employee frustration and potentially damaging the company's reputation if the simulation is too realistic and causes undue stress. They suggest careful planning and communication.

Email marketer from Reddit shares that performing phishing tests on shared IP addresses is risky, as negative feedback (spam reports) can negatively impact the IP's reputation, affecting the deliverability of other users' emails. They recommend using a separate IP range.

Email marketer from SecurityStackExchange discusses the ethics of phishing tests, noting that even if the test is for a good cause, it may have unintentional consequences, like the IP address used being reported and blacklisted by users.

Email marketer from Proofpoint shares that using dedicated infrastructure for phishing simulations ensures that any negative impact on IP reputation does not affect legitimate email traffic. They also recommend segmenting users for targeted simulations.

Email marketer from InfoSec Institute explains that performing simulated phishing attacks from the same infrastructure as production emails is not a good idea. You could potentially flag your domain and IP address as malicious, especially if there is no warning to the targets of the simulation.

Expert from Word to the Wise explains that sending any type of mail, including phishing simulation, from shared IP addresses carries the risk of damaging sender reputation if the messages are misclassified by recipients, hurting deliverability for other senders on the shared IP.

Expert from Email Geeks advises that if a client is on a dedicated IP, don't use an include: use the actual IP because includes are AWFUL and a security risk.

Expert from Word to the Wise notes that using a dedicated IP allows more control over sender reputation, which is crucial for managing any potential negative impact from sending phishing simulations. If you are sending these types of email, ensure you isolate it to a dedicated IP.

Expert from Email Geeks explains that shared IP ranges should never be used for phishing simulations. The client should have their own IPs, domains and not host landing pages on the infrastructure.

Expert from Email Geeks warns to be very careful not to add tracking to links or open tracking URLs. This is partly because it may mess up their test, but mostly to ensure there’s no trace of the hostnames.

Documentation from Microsoft explains that phishing simulations should comply with organizational policies and legal regulations. They advise using dedicated infrastructure to prevent unintended consequences like IP blacklisting, which can affect genuine email traffic.

Documentation from Google emphasizes that bulk sender guidelines should be followed for all emails, including phishing simulations. If an IP address is flagged as sending unwanted mail, it will hurt the deliverability of the sender. Google recommends all email simulations be done on a separate dedicated IP.

Documentation from RFC Editor explains that SPF records help establish sender legitimacy. However, even with SPF, if a shared IP is used to send phishing simulations, it can still negatively impact the sender's reputation and cause deliverability issues.

Documentation from AWS explains that dedicated IP addresses provide more control over sender reputation, which is crucial when conducting activities that might be perceived as undesirable, such as phishing simulations. They recommend monitoring reputation metrics to ensure deliverability.

Documentation from Spamhaus details that shared IPs used for sending unsolicited emails (even in the context of phishing simulations) may be added to their blocklists. This can significantly impact deliverability for all users on that IP.