IP Reputation

What it is

IP Reputation tracks the public addresses tied to your organization and checks them daily against blocklists and threat-intelligence sources. Addresses come from two places: derived addresses, read automatically from the DNS of domains you have proven you own (Domain Posture), and declared addresses, which you type in yourself for infrastructure DNS alone can't reveal — a bare load balancer, a VPN endpoint, an office egress IP. Every address, either way, is checked once a day against DNSBLs, AbuseIPDB, GreyNoise Community and Shodan InternetDB, and its result history is kept so you can see when a listing appeared and when it cleared.

This is distinct from an outside-in business rating like SecurityScorecard or Bitsight (see Vendors (TPRM) for those, applied to your vendors) — IP Reputation looks at addresses, not a company's overall security posture. Its results feed the Reputation Score on the Exposure overview, /exposure.

When to use it

Addresses derive automatically the day after you verify a domain in Domain Posture — there is nothing to set up. Declare an address yourself when you want CMDash tracking infrastructure that doesn't appear in your domain's DNS records at all. Check the inventory after a mail-delivery problem or a spam complaint to see whether a sending IP is listed somewhere, and check an individual address's history page while working a delisting request to confirm it cleared.

Before you start

How to

Where addresses come from

Derived rows come from each verified domain's own daily DNS scan: its apex and www A/AAAA records, the mail hosts named in its MX records — but only when a host's own domain matches the scanned domain, so a Google Workspace or Microsoft 365 mailbox never counts as yours — and the ip4/ip6 mechanisms of its own SPF record. SPF's include:/redirect= targets are never followed; they describe another company's infrastructure, not yours. A block wider than /24 (IPv4) or /120 (IPv6) — the SPF record for a large provider, say — is shown as a range so you know it's there, but is never enumerated or queried address by address.

Declared rows are typed by you. CMDash checks only that an address or CIDR is public — never that you control it — and every declared row is labelled "declared, unverified" everywhere it appears. Declaring is refused, with a specific reason, when the address is private, reserved, carrier-grade NAT, multicast, loopback or link-local space; when it's wider than /24 or /120; or when it overlaps something you've already declared.

A derived address is never deleted when it disappears from a scan — it's marked inactive and kept in the history, so the record of "this was ours, then it wasn't" survives. A declared address you remove is deactivated the same way and frees its slot in the cap immediately. Derived rows can't be removed directly: they leave the inventory only when their domain does, or when the record that produced them stops publishing.

Declare an address

Click Declare address, which shows how much of your cap is already used. Type a single address or a CIDR up to /24 (IPv4) or /120 (IPv6), add an optional label, and confirm. A rejected address explains exactly why — not public, too broad, or already declared.

What each source tells you

• DNSBLs (SpamCop, UCEPROTECT Level 1, Mailspike BL, PSBL, GBUdb Truncate, blocklist.de) — free lists that answer public DNS resolvers directly. Most are spam-source lists that expire a listing automatically within days once the reported activity stops; blocklist.de instead reports attack sources (SSH brute force, web scanning) reported by its fail2ban network.
• Spamhaus ZEN — the single most authoritative blocklist, but its public mirror refuses every query sent from a shared resolver like the one CMDash's checks use, by Spamhaus's own design. It's queried only once you add your own Spamhaus DQS key (see below); without one it shows "Could not check", never Clean.
• AbuseIPDB — a confidence score (0–100) plus report and reporter counts, drawn from a shared platform key with a limited daily allowance across every CMDash tenant. Add your own key to stop sharing that budget.
• GreyNoise Community — classifies internet-wide scanning noise. An address flagged RIOT (a known business service — Google, Slack, and similar) always reads Clean regardless of scanning activity. No key needed.
• Shodan InternetDB — open ports and any CVEs Shodan has tagged against them. This is exposure, not reputation, and usually the most actionable line on the page: an unexpectedly open port is worth investigating on its own.

"Could not check" is not Clean

A source that refused the query, hit its daily budget, or isn't configured shows "Could not check" — never folded into Clean. Hovering the badge explains which of those applied. This keeps "nothing was found" distinct from "nothing was looked at."

Add your own key

Only AbuseIPDB and Spamhaus ZEN take a key; every other source needs none. Open the sources panel and store your key — it's encrypted at rest and write-only: no screen, including this one, ever shows it back, only whether one is stored. Removing your AbuseIPDB key falls back to the shared platform key; removing your Spamhaus key stops Spamhaus from being queried at all.

Delisting

Each current listing links to that list's own delisting or dispute page next to the result. Several of the free DNSBLs clear on their own within a few days once the reported activity stops; others need you to work through the linked page. Check the address's history page after requesting delisting to confirm the next day's check came back clear.

The address history page

/exposure/ips/<id> lists every source's results for one address, newest first, so you can see exactly when a listing started and how long it lasted. A day a source couldn't check is skipped when deciding whether an address was newly listed — it's never mistaken for either a new listing or a listing clearing.

CMDash sends a notification the moment an address becomes newly listed somewhere it wasn't before, and again if Shodan reports a newly opened port — never on the first check of a new address (that check only establishes the starting point) and never following a day a source couldn't check. There's no notification yet when a listing clears on its own; use the history page to confirm that.

Common questions

Why does my declared address still say "declared, unverified"? That label doesn't change — CMDash confirms an address is public before accepting it, never that you actually control it.

Why is Spamhaus missing from an address's results? No Spamhaus DQS key is stored for your organization. Its public mirror can't be queried at all through CMDash's shared resolver; add your own key in the sources panel to include it.

Can I declare a /16 or a whole provider's range? No — declarations are capped at /24 (IPv4) or /120 (IPv6) so the module can't become a bulk lookup service. A wider block from an SPF record is shown as a range, not enumerated.

What happens to a derived address if I remove its domain, or its verification lapses? It stops being looked up immediately and, once the domain is gone, leaves the inventory with it.

Related

• Domain Posture (DNS & E-mail Security)
• Reputation Score
• Vendors (TPRM) & Questionnaires
• Assets & Discovery