What should I do if an unexpected IP address appears in Google Postmaster Tools?

Email marketer from Sendgrid explains that it may be from a new vendor, or service. It's a good idea to contact new vendors about IP addresses to ensure they are legitimate.

Email marketer from Stackoverflow recommends checking the IP reputation of the unfamiliar IP using services like VirusTotal or Spamhaus. This will quickly tell you if the IP is associated with spam or malicious activity.

Email marketer from EmailGeeks responds that if DMARC is already setup, make sure you are checking the DMARC records. These will report IP addresses that are sending from your domain.

Email marketer from UserBlog shares that it is important to also check the domain reputation. Make sure that the emails being sent from the IP address do not have any harmful links which could affect the sender reputation.

Email marketer from Reddit suggests that you should check your email logs for any sending activity from that IP address. This can help you identify which emails were sent and potentially reveal the source of the unauthorized sending.

Email marketer from Litmus shares that you should review your authorized sender lists (e.g., in your ESP) to ensure that the IP address hasn't been mistakenly added. Also check for any recently added integrations or services that might be sending email on your behalf.

Email marketer from SparkPost explains that the most important thing to do is limit the amount of access to your Email Service Provider (ESP). This will help with mitigating the amount of people who can send from your domain.

Marketer from Email Geeks shares that you can also make a quick check via ActiveCampaign's DNS Verification Tool to confirm you got everything right for your domain(s)! <https://www.activecampaign.com/dkim-spf-check/>

Email marketer from Mailjet explains that analyzing email headers can reveal the path an email took and the originating IP address. Use header analysis tools to trace the unexpected IP and understand its source.

Email marketer from EmailMarketingForum.net says it is a good idea to look at adding security polices and rules within your firewall and network. This can help block any IP's you dont like the look of.

Expert from Spam Resource shares that it's crucial to investigate for compromised user accounts or systems. An unexpected IP could indicate a compromised account being used to send spam.

Expert from Email Geeks shares that you can punch your domain into <https://tools.wordtothewise.com/spf> and get a nice list of IP ranges to check against too.

Expert from Email Geeks confirmed Ken's answer, that the IP is registered to ActiveCampaign.

Expert from Email Geeks explains how to ID the IP address owner is to dig on the hostname, then an ARIN lookup on the IP address.

Expert from Word to the Wise responds that setting up proactive monitoring and alerts can help detect unexpected IP addresses quickly. This involves configuring alerts for changes in sending patterns or the appearance of unfamiliar IPs.

Expert from Email Geeks shares that if an IP address shows up in GPM that is not in your range of IPs, it means something authenticated as your domain. It’s likely either corporate mail or someone forwarding messages without altering the DKIM signature. First thing would be to go look at your DMARC reports for that IP address.

Documentation from Google Help explains that you should review the sending IPs listed in Google Postmaster Tools to identify any unfamiliar or unauthorized sources. This helps to spot potential spoofing or unauthorized sending from your domain.

Documentation from RFC-Editor explains that SPF records explicitly declare authorized sending IP addresses for a domain. An unexpected IP indicates a failure to properly include all sending sources in your SPF record, or potential unauthorized sending.

Documentation from DMARC.org explains that DMARC policies help mitigate unauthorized use of your domain by providing reporting on sending sources. Implementing DMARC will give you insights into which IPs are sending email using your domain and allow you to set policies to reject unauthorized mail.

Documentation from Microsoft Learn shares that DKIM signatures can help trace the origin of emails. Examine the DKIM signature of emails originating from the unexpected IP address to determine if it is legitimately signed with your domain's key, or if it is a spoof.

Documentation from AWS shares that the most important thing is that any IP addresses that are being used are secure with MFA. This helps ensure that there are no breaches that may cause IP issues.