How to Find Who Owns the IPs in a Bounce or Email Header

Pull the IP addresses out of the bounce or header, then look each one up two ways: its reverse DNS hostname and the network that owns it. Paste the text into the bulk reverse DNS lookup, which takes the first IP from each line, and the same IPs into the bulk IP to ASN lookup. Together they tell you whose server it was.

Look up the IPs from a bounce →

Look them up in bulk

1. Copy the bounce message, blocklist notice or full headers.
2. Paste the text into the bulk reverse DNS lookup and press Look up PTR records. Each line's first IP gets its PTR hostname and a forward check.
3. Paste the same IPs into the bulk IP to ASN lookup and press Look up networks. Each row shows the ASN, the network name and the routed prefix.
4. Read the two together: the hostname says what the server calls itself; the ASN says whose network it's on.

Do it by hand

For this example we wrote two Received-style lines into headers.txt, using the hostnames and IPs of a real Google and a real Microsoft outbound server. Paste your own header lines instead:

cat > headers.txt <<'EOF'
Received: from mail-yw1-f169.google.com (mail-yw1-f169.google.com [209.85.128.169])
Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2052.outbound.protection.outlook.com [40.107.22.52])
EOF

grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' headers.txt | sort -u > found.txt

while read -r ip; do
  rev=$(echo "$ip" | awk -F. '{print $4"."$3"."$2"."$1}')
  asn=$(dig +short txt "$rev.origin.asn.cymru.com" | head -1 | cut -d'|' -f1 | tr -d '" ')
  name=$(dig +short txt "AS$asn.asn.cymru.com" | cut -d'|' -f5 | tr -d '"' | sed 's/^ //')
  echo "$ip,$(dig +short -x "$ip" | head -1),AS$asn,$name"
done < found.txt
# 209.85.128.169,mail-yw1-f169.google.com.,AS15169,GOOGLE - Google LLC, US
# 40.107.22.52,mail-am6eur05on2052.outbound.protection.outlook.com.,AS8075,MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

We ran this on 9 November 2026. The grep pattern takes IPv4 addresses only and will also match version strings that look like IPs, so glance at found.txt before the loop. The ASN data comes from Team Cymru's IP to ASN service, which asks that you use DNS or its bulk mode for volume.

What the answer tells you

• Your own server's IP (your hosting provider's ASN, your hostname): the problem is on your side. Check its reverse DNS with find IPs with no reverse DNS and its listings with the IP blacklist check.
• Your ESP's or mailbox provider's IP (Google's AS15169, Microsoft's AS8075, an ESP's network): the sending side is shared. Contact the provider, and check that your own authentication passes.
• The receiving provider's IP: the server that rejected you. The bounce text is the part to read; see mailbox provider bounce messages.
• An IP on a network you don't recognise in your own Received chain: a forwarder, a security gateway or a spoofed header line. Only the lines your own provider added can be trusted.

For how Received headers stack up, see email headers explained. For a fuller ownership lookup, including the registered IP range, see find which company owns an IP address.

Next step: stop the bounces at the source

Most hard bounces come from addresses that stopped existing. Upload your list at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: how to get off a blacklist, hard bounce vs soft bounce.