As mentioned earlier, IP reputation is a good defense against obvious spam emails and spamming, but spammers are an ingenious group (uh!). They believe there are quite a few trusted IPs that can piggyback on malicious email.

A few years ago, most spam came from free webmail accounts. The Cork Bicycle Rent zone IPs that belong to these servers tend to have a good reputation or are on the allow list for most recipients. Anti-spam experts have realized that they need to complement IP reputation along with domain reputation and look for additional signals to feed into the reputation algorithm.

Domain reputation is based on the sending domain, not the IP address. This means that brands take precedence when it comes to making MBP filtering decisions.

Around this time, authentication was also promoted (the adoption of IPv6 accelerated this), and more and more email service providers (ESPs) are signing email using security protocols such as DKIM and DMARC. Email authentication helped reduce the spoofing of regular "sender" addresses, and recipients had several domains in trusted headers.