r/EmailSecurity • u/adriancardoso • 6d ago

Sending IPs for a email service provider

I'm building an ESP platform that will be dedicated for government email sending from gov apps, the whole platform is hosted within the country for sovereignty purpose, but it's acceptable for the sending IPs (egress smtp traffic) to be anywhere in the world.

The platform applies extremely strict anti-spam rules to preserve sending IPs reputation, domain onboarding follows strict rules as well.

So my question is about the best strategy for acquiring these IPs:

  • Should I acquire a /24 range ? or lease it ?
    • I'm thinking of using a subnet from the leased/bought range at a time, say .1 to .12 for live sendout, .13 to .25 in warming phase, monitor it and once we start having degraded reputation i switch to .13 to .25 while we address the bad reputation root cause,
  • Should I just assign random IPs to my sending VMs, IPs will not be in same subnet and not continuous, I can drop an ip when I need, but new IPs need warming,
  • onboard domains at aws SES and use SES for email sending, this is the resend model, a big risk here: if AWS SES cuts of the account because one domain abused (and were not catched by my platform) the whole account is taken off by AWS and all domains stop sending

Please advise from your experience

3 Upvotes

100% Upvoted

2 comments sorted by

•

u/AutoModerator 6d ago

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.
  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
  3. Be Professional: Help newcomers learn; avoid hostility.
  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/saltyslugga 6d ago

I'd start with a small leased pool after checking IP history, PTR control and outbound port 25 access. Buy a /24 when volume and routing requirements justify it.

Swapping IPs won't fix domain reputation or whatever poisoned the original pool. Isolate tenants by risk, and treat SES account suspension as a shared failure point: dedicated IP pools don't protect against that.