Your VPS neighbor is ruining your reputation

Shared IP hosting is cheap for a reason. DigitalOcean, Linode, Hetzner, OVH, and the long tail of budget VPS providers place many customers on the same /24. The IP block has a reputation at Gmail and Outlook. Your reputation inherits from the block. So does the spammer three VMs over.

When your mail starts landing in spam and your own authentication is clean, your sending volume is reasonable, and nothing changed on your side — it is time to look at the neighbourhood.

Step 1: figure out your neighbourhood

Find your sending IP (the one your MTA uses for outbound SMTP, not necessarily the IP your web server binds to).

# Your public IP (from the perspective of SMTP peers)
curl -s https://ifconfig.me

# Or, more reliably, the IP in the Received header of sent mail
# Open a sent message, look at "Received: from ... ([1.2.3.4])"

Then enumerate the /24 it lives in:

IP=192.0.2.42
# /24 block: 192.0.2.0 - 192.0.2.255
NET=${IP%.*}

for i in {0..255}; do
  PTR=$(dig +short -x ${NET}.${i} 2>/dev/null)
  [[ -n "$PTR" ]] && echo "${NET}.${i}  ${PTR}"
done

A healthy /24 at a mail-focused host has PTRs like mail-42.host.com. A shared VPS /24 has PTRs like sgp-1-vps-042.hosterX.net — anonymous, generic, and hundreds of customers live there. That second pattern is a reputation risk.

Step 2: check subnet reputation

Spamhaus DROP and Barracuda sometimes list entire /24 or /25 blocks for chronic abuse. Query a few IPs across your block:

#!/usr/bin/env bash
# Scan /24 for blacklist listings
set -euo pipefail

NET="${1%.*}"  # e.g. 192.0.2 (pass IP, we strip the host octet)
LISTED_COUNT=0

for i in 10 50 100 150 200; do
  IP="${NET}.${i}"
  IFS=. read -r a b c d <<< "$IP"
  REV="$d.$c.$b.$a"

  # Check against Spamhaus ZEN
  if [[ -n "$(dig +short +time=2 "${REV}.zen.spamhaus.org.")" ]]; then
    LISTED_COUNT=$((LISTED_COUNT + 1))
    echo "$IP listed on Spamhaus ZEN"
  fi
done

echo "Listed in subnet sample: $LISTED_COUNT / 5"
if (( LISTED_COUNT >= 2 )); then
  echo "Subnet has reputation risk; consider migrating off shared IP"
fi

Step 3: Gmail Postmaster Tools

If you have enough volume for Gmail Postmaster Tools to report on your domain, the IP reputation chart tells you how Gmail rates your sending IP specifically. If it reads "Low" or "Bad" while your domain reputation is "High," the IP is the problem.

• High/medium IP reputation + high domain reputation = healthy setup.
• Low/bad IP reputation + high domain reputation = shared IP neighbour problem.
• Low IP + low domain reputation = your own problem; the IP is a symptom.

Step 4: Microsoft SNDS

Microsoft's Smart Network Data Services (SNDS) exposes reputation for every IP sending to Outlook/Hotmail. Sign up, add your IPs, wait 48 hours for data. The status column tells you "Green" (clean), "Yellow" (some complaint activity), or "Red" (significant problem). If your IP is Yellow or Red and your sending behaviour is clean, suspect neighbours.

What to actually do about it

Option A: Migrate to a dedicated IP

If your monthly send volume is above ~50k messages, a dedicated IP with the same ESP (SendGrid, Mailgun, Postmark, SES) costs $80—200/month and gives you a reputation you own. Warm it over 4—6 weeks before switching full volume.

Option B: Move to a mail-focused host

Shared hosting at Mailgun, Postmark, or SES puts you on a shared pool that the ESP actively grooms. Spammer detection is aggressive; bad tenants get kicked. Your reputation still depends on the pool but the floor is much higher than a budget VPS shared /24.

Option C: Ask your host to move you

Most reputable VPS providers will move you to a different block on request if you can show your current block has reputation issues. Open a support ticket with evidence (Spamhaus listings, Gmail Postmaster screenshots) and ask politely.

Step 5: monitor continuously

Whether you migrate or stay, monitor the subnet's reputation on a schedule. If you stay, you want to know when the neighbourhood tips over. If you migrate, you want to know if the new IP is trending well.

# /etc/cron.d/subnet_reputation_daily
# Check /24 sample every morning
0 7 * * * /usr/local/bin/subnet_blacklist_scan.sh 192.0.2.42 >> /var/log/subnet-rep.log 2>&1

Feed the output into the same Slack / Nagios / Prometheus channel you use for your other email monitoring.

A note on ESP shared pools

ESP shared pools (SendGrid Essential, Postmark shared, Mailgun Foundation) are not the same as VPS shared IPs. The ESP actively monitors tenant behaviour, throttles spammers, and rotates IPs when pools degrade. You still share reputation, but the management is competent.

If you are on an ESP shared pool and placement is bad, the problem is usually your content or list quality dragging the pool down, not the other way around. The ESP will tell you politely before they tell you rudely.

FAQ