Inbound Abuse Monitor FAQ

What is Inbound Abuse Monitor?

Inbound Abuse Monitor identifies the most problematic or "top offending" IPs for Postmasters on a daily basis and displays pertinent information about those IPs in a simple and clear user interface. This reduces the need for Postmasters to search through thousands of IPs and allows them to quickly obtain the information necessary to make informed decisions around filtering and blocking. 

How do we choose 'Top Offending' IPs? 

Return Path goes through all the Inbound IPs that contribute to spam for each Mailbox Provider and finds those with the highest complaint count (“this is spam” votes). The IPs are then sorted by highest complaint rate. This allows for visibility into the IPs that have a high complaint rate (high complaint/volume ratio) without including IPs with low volumes.

Why Top 30 IPs? 

Data analysis finds that complaint rates start to taper off at/around the top 30 IP mark. Complaint rates usually drop significantly below 1% and start to become consistently low along with low complaint counts and volume.

Why don't I see our Mailbox Provider (MBP) IPs?

Inbound Abuse Monitor only shows inbound IPs (IPs sending mail to your MBP from outside entities) rather than outbound IPs.

Why can't I see any data for volume and complaint rate? 

In the event that volume and complaint rate data is not populating in the dashboard, it is likely that your MBP does not provide Return Path a volume feed (i.e. log data showing inbound volume to your MBP). In that case, we can not present volume or complaint rate metrics. If you’re interested in learning more about providing a feed for access to this valuable data within Inbound Abuse Monitor, please contact

If your MBP currently provides Return Path with a volume feed, it may be that those metrics have not yet been received by our system. Please check back in an 1-2 hours to see if those metrics have populated. If you do not see those metrics in more than 6 hours, there may be an issue with the feed. Please contact

Why do I only see volume and complaint rate data for some IPs and not others? 

In the event that volume and complaint rate data is only populating for some IPs it is likely that we have not yet received volume metrics from your MBP that corresponds to that IP (i.e. we have complaint counts, but no volume data). In some cases, we may not receive all volume data from your MBP.

If there is a significant gap in coverage, please contact

Why is there more than one organization or subscription for an IP in the subscriptions column?

The subscription column in Inbound Abuse Monitor references subscriptions to the Universal Feedback Loop (UFBL). Sometimes senders create different organizations and subscriptions within the UFBL for their IPs depending on clients, regions, or departments. This is why you may click on an organization and see multiple subscriptions for a single IP. You may also see "no organization." This means there are UFBL subscriptions maintaining this IP but the sender has not provided the organization name. 

How is the tool populating the domain?

We perform an rDNS lookup to generate the domain you see under the IP. Due to the dynamic nature of DNS, you may see the domain change when the data is updated. 

Why can't I see all IPs when I search in the tool? Why just 'Top Offending?'

Since thousands of IPs contribute to your spam everyday, a UI search through that many IPs over a 30 day span is implausible. 

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request