Start at the deciding receiver

If a message was rejected during SMTP, use the sender provider’s event to capture the remote host, connecting outbound IP, response, and time. If it was accepted, inspect headers added by the trusted recipient gateway. Received fields supplied before that boundary can be forged.

Authentication-Results or Received-SPF may identify the client IP observed for SPF. Match it to the nearest trusted Received hop. Record the statement as “receiver X observed IP Y for message Z,” not “the company’s permanent IP.”

Label infrastructure roles

Determine whether the address belongs to:

  • a dedicated sending MTA;
  • a provider shared pool;
  • an outbound security gateway;
  • a forwarder connecting to the final receiver;
  • an internal relay not exposed to the internet;
  • an end-user/device IP appearing earlier in the trace.

Only the peer at the relevant SMTP decision point should be tested against connection-time IP lists. Spamhaus explicitly warns against applying PBL to every IP in Received headers; legitimate user/client IPs can appear there and are expected to be in direct-to-MX policy ranges.

Cross-check ownership and timing

Use provider logs, rDNS/forward DNS, account/region configuration, and allocation records to confirm who controlled the observed IP at that time. Shared pools can rotate. A current provider range page cannot prove which IP sent an old message without message-specific evidence.

Do not resolve the visible From or website URL and use that A record. Link reputation and domain reputation are separate investigations.

Query with source-specific semantics

For each licensed dataset, use the operator’s documented reversed-IP query or API, parse exact return codes, and honor resolver/usage rules. Keep timeout and query-block responses unavailable. Record list purpose; a policy-range result is not a malicious-activity result.

Hand off the right scope

If a dedicated IP is affected, the organization may control remediation. If it is shared, provide the provider with message IDs, timestamps, pool/IP, responses, and sanitized evidence; the provider owns network-wide action. The investigation succeeds when the checked IP is tied to the affected SMTP connection and the responsible operator—not when a convenient website address returns a dramatic listing.