Why is my e-commerce brand seeing bad IP reputation for unknown IPs and how will it impact deliverability?

Summary

A bad IP reputation and the appearance of unknown IPs can severely harm e-commerce email deliverability, leading to emails being marked as spam or rejected. This often stems from issues like SPF record misconfigurations, domain spoofing, compromised accounts, poor list hygiene, and shared IP risks. Implementing SPF, DKIM, and DMARC is critical, along with monitoring DMARC reports and IP reputation using tools like Google Postmaster Tools and Microsoft SRD. Regularly cleaning email lists, monitoring blocklists, and securing email servers are also essential. Proactive measures, such as subscribing to feedback loops and testing deliverability, help maintain a positive sender reputation and minimize negative impacts. Avoid adding TXT records to Sendgrid subdomains and be aware of potential over-complication of SPF records.

Key findings

  • SPF Configuration: Review and simplify SPF records, reducing unnecessary includes to stay within DNS lookup limits and prevent deliverability issues. Example needing review: `v=spf1 include:ca._<http://netblocks.mimecast.com|netblocks.mimecast.com> include:<http://_spf.google.com|_spf.google.com> include:<http://shops.shopify.com|shops.shopify.com> include:<http://email.prnewswire.com|email.prnewswire.com> include:<http://mailgun.org|mailgun.org> ~all`.
  • Domain Spoofing Detection: Unknown IPs may indicate domain spoofing; DMARC reports can help identify forged 'From' addresses and unauthorized use.
  • Authentication Importance: Implementing SPF, DKIM, and DMARC is crucial for verifying email sources and preventing domain spoofing and phishing attacks.
  • List Hygiene Benefits: Maintaining a clean email list through regular removal of inactive subscribers and invalid addresses protects IP reputation and improves deliverability.
  • Blocklist Impact: Being listed on blocklists severely impacts deliverability; proactive monitoring and prompt removal are essential.
  • Compromised Accounts: Unknown IPs could indicate compromised accounts; strengthen security measures like password policies and multi-factor authentication.
  • Shared IP Risks: Shared IPs can lead to reputation issues; consider switching to a dedicated IP if deliverability problems persist.
  • Sendgrid TXT Records: Avoid adding TXT records to SendGrid subdomains to prevent breaking CNAME records and disrupting SPF/MX validation.
  • DMARC Monitoring: Actively monitor DMARC reports to detect authentication failures and unauthorized email activity.

Key considerations

  • Proactive Reputation Management: Implement best practices for authentication, list hygiene, and sending behavior to proactively manage IP reputation.
  • Server Security: Secure email servers by updating software, implementing firewalls, and monitoring traffic for suspicious activity.
  • Dedicated IP Evaluation: Assess the need for a dedicated IP if shared IP issues are causing deliverability problems.
  • Deliverability Testing Cadence: Regularly test deliverability using tools to identify and resolve potential issues before significant impact.
  • Feedback Loop Utilization: Utilize feedback loops from mailbox providers to promptly identify and address spam complaints.
  • Tool Adoption: Employ monitoring tools like Google Postmaster Tools and Microsoft SRD to track and address negative trends.
  • Continuous Adaptation: Continuously adapt sending practices and authentication configurations based on monitoring data and evolving best practices.

What email marketers say
13Marketer opinions

The appearance of bad IP reputation for unknown IPs can severely impact email deliverability for e-commerce brands. This issue often stems from various factors, including compromised email accounts or servers, poor list hygiene practices, phishing attacks, and the use of shared IPs. Implementing email authentication protocols (SPF, DKIM, DMARC), monitoring DMARC reports, securing email servers, and regularly cleaning email lists are crucial steps to mitigate these issues. Additionally, monitoring IP reputation and considering switching to a dedicated IP can help maintain a positive sender reputation and ensure emails reach the inbox. Utilizing tools like Mail-Tester and GlockApps to test deliverability and avoiding actions that could break CNAME records are also important considerations.

Key opinions

  • DMARC Monitoring: Accessing and monitoring DMARC reports is crucial for identifying IPs sending on behalf of your domain and detecting potential phishing attempts.
  • Authentication Protocols: Implementing SPF, DKIM, and DMARC protocols is essential for authenticating emails and preventing domain spoofing.
  • List Hygiene: Regularly cleaning email lists by removing inactive subscribers and hard bounces improves IP reputation and reduces bounce rates and spam complaints.
  • Compromised Accounts: Unknown IPs with bad reputation can indicate compromised email accounts or servers, requiring checks for unauthorized access and strengthening security measures.
  • Shared IP Risks: Using shared IPs can lead to reputation issues due to the poor sending practices of other senders, necessitating close monitoring and potential migration to a dedicated IP.
  • Sendgrid TXT Records: Adding a TXT record to the SendGrid subdomain may break the CNAME record which will cause problems
  • GPT Validation: Checking the DKIM and SPF domains in GPT to identify potential abuse on authenticating subdomains may not be worth spending too much time on.

Key considerations

  • Proactive Management: Proactively managing IP reputation through best practices for email authentication, list hygiene, and sending behavior is crucial.
  • Security Measures: Securing email servers by updating software, implementing firewalls, and monitoring traffic is important to prevent unauthorized use.
  • Dedicated IP: Consider switching to a dedicated IP if deliverability problems persist due to shared IP issues.
  • Deliverability Testing: Regularly test deliverability using tools like Mail-Tester, GlockApps, and IsNotSpam to identify and address potential issues.
  • Monitoring and Responding: Continuously monitor IP reputation and address any issues promptly to mitigate negative effects.
Marketer view

Email marketer from Litmus shares that a poor IP reputation can severely impact email deliverability, leading to higher bounce rates, increased spam complaints, and emails being blocked or filtered into the spam folder. She emphasizes the importance of proactively managing IP reputation by implementing best practices for email authentication, list hygiene, and sending behavior. Litmus also recommends monitoring deliverability metrics and addressing any issues promptly to mitigate the negative effects of a bad IP reputation.

July 2024 - Litmus
Marketer view

Email marketer from Quora shares that using shared IPs can sometimes lead to reputation issues if other senders on the same IP engage in poor sending practices. They recommend monitoring your IP reputation closely and considering switching to a dedicated IP if deliverability problems persist. DigitalMarketer also advises warming up new IPs gradually and maintaining consistent sending habits to establish a positive reputation. As you may not be able to control the activity of other users on the shared IP, ensure that you have authentication in place to help protect your emails.

August 2023 - Quora
Marketer view

Email marketer from StackExchange emphasizes the importance of securing your email server to prevent unauthorized use and maintain a good IP reputation. He advises regularly updating server software, implementing firewalls, and monitoring outgoing traffic for suspicious patterns. EmailGuru also recommends setting up intrusion detection systems to identify and respond to potential security threats promptly. If you have multiple IPs setup, ensure that your DNS records have been configured correctly.

April 2021 - StackExchange
Marketer view

Email marketer from Neil Patel Blog shares that protecting IP reputation is crucial for email deliverability. He recommends implementing email authentication protocols (SPF, DKIM, DMARC), maintaining consistent sending volumes, and promptly removing inactive subscribers to avoid being flagged as spam. He also suggests monitoring bounce rates and spam complaints to proactively address potential issues.

December 2022 - Neil Patel Blog
Marketer view

Email marketer from Gmass details how important it is to test your deliverability. There are a number of tools such as Mail-Tester, GlockApps, and IsNotSpam which help provide information about your deliverability before you send to your main mailing lists.

December 2022 - Gmass
Marketer view

Marketer from Email Geeks recommends accessing the DMARC reports fed into Kickbox for more details about IPs sending on behalf of the domain.

March 2024 - Email Geeks
Marketer view

Email marketer from Reddit suggests that the appearance of unknown IPs with bad reputation could indicate a compromised email account or server. They advise checking for unauthorized access and reviewing server logs for suspicious activity. They also recommend strengthening password policies and implementing multi-factor authentication to prevent future breaches. They warn that this could heavily impact reputation.

December 2021 - Reddit
Marketer view

Marketer from Email Geeks advises against adding a TXT record to the SendGrid subdomain because it can break the CNAME and cause SPF and MX records to fail. If they aren't valid SendGrid will fallback to a shared domain.

December 2021 - Email Geeks
Marketer view

Email marketer from SendGrid explains that maintaining a positive sender reputation is essential for ensuring emails reach the inbox. They recommend warming up new IPs gradually, segmenting email lists based on engagement, and regularly cleaning email lists to remove inactive or invalid addresses. SendGrid emphasizes the importance of consistent sending habits and providing value to subscribers to foster a positive sender reputation. They also advise that seeing unknown IPs could be caused by compromised accounts or misconfigured DNS records.

October 2024 - SendGrid
Marketer view

Marketer from Email Geeks advises checking the DKIM and SPF domains in GPT to identify potential abuse on authenticating subdomains and agrees with Steve that it may not be worth spending too much time on the issue.

April 2021 - Email Geeks
Marketer view

Email marketer from Constant Contact answers that regularly cleaning email lists by removing inactive subscribers and hard bounces can significantly improve IP reputation. They explain that sending emails to engaged subscribers reduces bounce rates and spam complaints, signaling to mailbox providers that you are a legitimate sender. Removing unengaged subscribers helps maintain a healthy list and prevents your emails from being marked as spam.

July 2021 - Constant Contact
Marketer view

Email marketer from Email Marketing Forums notes that compromised user accounts are a common source of unexplained email traffic. MailBlaster suggests implementing stronger password requirements and enabling two-factor authentication to prevent account takeovers. He also advises monitoring user activity for unusual patterns, such as high email sending volumes from previously inactive accounts. As you may have a compromised account which is sending emails through your account, ensure you implement all of the recommended authentication standards.

May 2022 - Email Marketing Forums
Marketer view

Email marketer from Mailjet shares that preventing phishing attacks, which can damage your IP reputation, involves implementing DMARC policies. He explains that DMARC allows domain owners to instruct email receivers on how to handle emails that fail SPF and DKIM checks, helping to prevent malicious actors from spoofing your domain. Monitoring DMARC reports is essential for identifying and addressing potential phishing attempts.

January 2023 - Mailjet

What the experts say
8Expert opinions

Experiencing a bad IP reputation and encountering unknown IPs can significantly harm email deliverability. This often results from issues like SPF record misconfigurations, potential domain spoofing, or malicious actors using your domain. Cleaning up the SPF record, monitoring DMARC reports, and implementing SPF, DKIM, and DMARC for proper authentication are crucial steps. Regularly cleaning email lists and monitoring blocklists also help. Utilizing feedback loops enables prompt identification and resolution of spam complaints. Ensure no TXT record is added to the sendgrid subdomain which could cause problems.

Key opinions

  • SPF Record Cleanup: Cleaning up the SPF record by removing unnecessary includes can resolve issues related to exceeding DNS lookup limits. Example of SPF needing review: `v=spf1 include:ca._<http://netblocks.mimecast.com|netblocks.mimecast.com> include:<http://_spf.google.com|_spf.google.com> include:<http://shops.shopify.com|shops.shopify.com> include:<http://email.prnewswire.com|email.prnewswire.com> include:<http://mailgun.org|mailgun.org> ~all`.
  • Domain Spoofing: Unknown IPs may indicate someone is using the domain in their return path or forging it to send spam. DMARC reports can help identify these issues.
  • Authentication Implementation: Implementing SPF, DKIM, and DMARC is crucial for authenticating emails and preventing domain spoofing.
  • List Hygiene: Maintaining a clean email list by regularly removing inactive subscribers and invalid addresses protects IP reputation.
  • Blocklist Monitoring: Monitoring IP addresses and domains for inclusion on blocklists helps prevent significant impact on email deliverability.
  • Sendgrid TXT Records: Ensure you don't add a TXT record to your sendgrid subdomain, as this could invalidate your SPF records

Key considerations

  • DMARC Monitoring: Regularly check DMARC reports to understand email authentication issues and potential domain abuse.
  • Proactive Approach: Take corrective actions promptly to improve sending practices and maintain a good IP reputation.
  • Feedback Loops: Subscribe to feedback loops to identify and address spam complaints proactively.
  • SPF Configuration: Review and simplify SPF records to stay within DNS lookup limits and prevent deliverability issues.
  • Deliverability Impact: Address authentication and reputation issues promptly to minimize impact on email deliverability. Monitor for potential TXT record problems in Sendgrid.
Expert view

Expert from Word to the Wise responds that subscribing to feedback loops provided by mailbox providers allows you to identify and address spam complaints promptly. By receiving feedback on which of your emails are being marked as spam, you can take corrective action to improve your sending practices and maintain a good IP reputation. These also help detect if your email has been abused in some way by a third party.

December 2024 - Word to the Wise
Expert view

Expert from Email Geeks confirms with Francis that adding a TXT record to the sendgrid subdomain can cause validation problems.

April 2023 - Email Geeks
Expert view

Expert from Email Geeks suggests checking DMARC reports to identify the cause of the issue and highlights that even if Google reports issues, actual delivery problems should be monitored to gauge the severity.

March 2021 - Email Geeks
Expert view

Expert from Email Geeks advises cleaning up the SPF record, noting that several includes are likely unnecessary due to exceeding the maximum DNS lookups. Suggests reviewing: `v=spf1 include:ca._<http://netblocks.mimecast.com|netblocks.mimecast.com> include:<http://_spf.google.com|_spf.google.com> include:<http://shops.shopify.com|shops.shopify.com> include:<http://email.prnewswire.com|email.prnewswire.com> include:<http://mailgun.org|mailgun.org> ~all`

July 2024 - Email Geeks
Expert view

Expert from Spam Resource explains that maintaining a clean email list is essential for protecting your IP reputation. Regularly removing inactive subscribers and invalid email addresses reduces bounce rates and spam complaints. This demonstrates to mailbox providers that you are a responsible sender, improving your chances of reaching the inbox.

April 2022 - Spam Resource
Expert view

Expert from Email Geeks suggests someone might be using the domain in their return path or forging it to send spam and recommends cleaning up the SPF record to rule out authentication issues. Notes that if messages are forging the address in the 'from:' field, it would be visible in the DMARC reports, but SPF issues alone wouldn't.

January 2023 - Email Geeks
Expert view

Expert from Word to the Wise explains that implementing SPF, DKIM, and DMARC records is crucial for authenticating your emails and preventing domain spoofing. They emphasize that proper authentication helps mailbox providers verify that your emails are legitimate, improving your IP reputation and deliverability. She goes on to explain that all 3 should be implemented correctly.

July 2023 - Word to the Wise
Expert view

Expert from Spam Resource responds by explaining the importance of monitoring your IP address and domain for inclusion on blocklists. They explain that blocklists are used by mailbox providers to filter out spam, and being listed on one can severely impact your email deliverability. He advises using tools and services to track your blocklist status and take steps to remove yourself from any lists you are on.

February 2022 - Spam Resource

What the documentation says
5Technical articles

A bad IP reputation, potentially linked to unknown IPs, can cause emails to be marked as spam or rejected. Safeguarding IP reputation involves implementing SPF, DKIM, and DMARC for authentication to prevent domain spoofing and phishing attacks. Continuously monitoring IP reputation with tools like Google Postmaster Tools and Microsoft SRD helps in proactively addressing issues. Regular auditing and updating of authentication settings, along with ensuring correctly configured SPF records that don't exceed DNS lookup limits, are crucial for maintaining a good reputation.

Key findings

  • Google Postmaster Tools: Monitoring IP reputation in Google Postmaster Tools is essential for identifying and addressing issues affecting email deliverability.
  • SPF Records: SPF records authorize mail servers to send emails on behalf of a domain, preventing spammers from forging the 'From' address; improperly configured records can be exploited.
  • Sender Authentication: Implementing SPF, DKIM, and DMARC verifies authorized email sources, protecting against domain spoofing and phishing attacks.
  • Microsoft SRD: Microsoft's Sender Reputation Data (SRD) provides insights into sending volume, spam complaints, and other metrics, aiding in proactive issue resolution.
  • DMARC Policies: DMARC builds on SPF and DKIM to guide email receivers on handling unauthenticated emails, preventing domain spoofing and enhancing security.

Key considerations

  • Sending Practices: Ensure sending practices comply with sender guidelines to improve and maintain a good IP reputation.
  • Audit SPF Records: Audit SPF records to ensure only authorized sending sources are included, preventing attackers from exploiting vulnerabilities.
  • Authentication Settings: Regularly review and update authentication settings to prevent malicious actors from exploiting vulnerabilities in your email infrastructure.
  • Monitor Metrics: Use tools like SRD to track sending volume, spam complaints, and other metrics to identify and address negative trends.
  • Implement DMARC: Implement and monitor DMARC records to gain visibility into your email authentication ecosystem and protect your brand's reputation.
Technical article

Documentation from Microsoft explains that monitoring IP reputation through tools like Sender Reputation Data (SRD) is crucial for identifying potential issues. SRD provides insights into the sending volume, spam complaints, and other metrics associated with your IP address, enabling you to take proactive measures to address any negative trends. Unusual IP activity can indicate a compromise, or someone is using a DNS record incorrectly.

June 2021 - Microsoft
Technical article

Documentation from Google explains that a low IP reputation can result in emails being marked as spam or rejected. It advises monitoring IP reputation in Postmaster Tools and ensuring that sending practices comply with Google's sender guidelines to improve and maintain a good reputation. They do not elaborate on seeing unknown IPs, only that you should fix poor reputation.

January 2025 - Google
Technical article

Documentation from SparkPost explains that implementing SPF, DKIM, and DMARC for sender authentication is a crucial step to safeguard your IP reputation. These protocols help verify that emails are sent from authorized sources and protect against domain spoofing and phishing attacks. SparkPost advises that you should regularly review and update authentication settings to prevent malicious actors from exploiting vulnerabilities in your email infrastructure. They also recommend limiting the amount of includes in your SPF record to avoid DNS lookup errors.

May 2021 - SparkPost
Technical article

Documentation from DMARC.org explains that DMARC, which builds on SPF and DKIM, helps email receivers decide what to do with emails that fail authentication checks. This can prevent attackers from spoofing your domain. Implement and monitor DMARC records to gain visibility into your email authentication ecosystem, identify potential spoofing attempts, and protect your brand's reputation.

December 2022 - DMARC.org
Technical article

Documentation from RFC-Editor explains that SPF records authorize mail servers to send emails on behalf of a domain, preventing spammers from forging the 'From' address. They explain that you must audit SPF records to ensure only authorized sending sources are included to prevent spoofing. Improperly configured or overly permissive SPF records can be exploited by attackers to send malicious emails that appear to originate from your domain.

August 2021 - RFC-Editor.org