A snowshoe spreads a heavy load over a wide area so it never sinks into the snow. Snowshoe spam does the same thing with mail: it sends a little from each of a great many IPs, spread across wide swathes of address space, often on freshly acquired ranges with clean histories. The goal is to keep every individual IP below the volume and complaint thresholds that would trigger a listing. It is an attack designed specifically to beat per-IP reputation, and the defenses built to counter it are the reason a legitimate sender's brand-new IP range can get blocked before it sends its first message.
Why Per-IP Reputation Is Not Enough
Classic IP reputation asks a question about a single address: how much mail does it send, how many complaints, is it on any lists. A snowshoe operation is engineered so that the answer for every one of its IPs is "not much, and nothing alarming." Two hundred IPs each sending a trickle look individually innocent. The abuse is only visible when you stop looking at single addresses and start looking at the ranges and patterns they sit in.
Single-IP view: Range view:
203.0.113.10 → 40 msgs 203.0.113.0/24 → 200 fresh IPs,
203.0.113.11 → 38 msgs all registered same week,
203.0.113.12 → 41 msgs all sending low volume,
... no rDNS, sequential PTR gaps
203.0.113.99 → 39 msgs → pattern screams snowshoe
Each row on the left is unremarkable. The block on the right is the tell.
How Filters Counter It: Range and Block Reputation
To catch load spread thin, reputation systems widened their unit of judgment. Alongside the /32, they score the surrounding block, the /24, and sometimes larger CIDR aggregates, and they weigh signals that correlate with snowshoe setups:
| Signal | What it flags |
|---|---|
| Range age | Recently allocated or reassigned blocks with no sending history |
| rDNS coverage | Large contiguous ranges with missing or auto-generated PTR records |
| Registration pattern | Many IPs in a block lit up at once, thin per-IP volume |
| Neighboring behavior | Bad mail from adjacent IPs in the same block |
| SWIP/allocation churn | Address space reassigned repeatedly through resellers |
Spamhaus and similar operators publish listings that cover entire ranges precisely because the abuse operates at range scale. The Spamhaus listing format reflects this: a listing can name a whole block.
Why This Blocks Legitimate Senders
Here is the uncomfortable consequence. A brand-new IP range has no sending history, thin per-IP volume as you ramp up, and often incomplete rDNS on day one. To a snowshoe-aware filter, a legitimate company standing up a new sending block looks a lot like a snowshoe operation warming up. You did nothing wrong, and you are treated with suspicion anyway, because the pattern is the signal and your pattern matches.
The filters are behaving correctly here: fresh, thin, history-less ranges are exactly what abusers use. The burden is on the legitimate sender to look unlike a snowshoe operation.
Looking Unlike an Abuser
The defense against being mistaken for a snowshoe is to send the signals a snowshoe operation cannot afford to send:
1. Set clean, purpose-named rDNS on every IP before you send.
2. Warm up gradually: predictable, rising volume from each IP.
3. Authenticate everything (SPF, DKIM, DMARC aligned).
4. Concentrate related mail on a consistent set of IPs.
5. Keep engagement high and complaints near zero from the first send.
The through-line is consistency and identity. A snowshoe hides; you should be legible. Proper reverse DNS on the whole block, covered in our piece on reverse DNS for mail servers, is one of the cheapest ways to separate yourself from the pattern.
Watch the Whole Block
Because range-level listings can catch you for your neighbors' behavior or your own newness, you need to know about them the moment they land. A tool that only checks your specific /32 will miss a /24 listing that is nonetheless filtering your mail. Generator Labs blacklist monitoring checks IPs, domains, and CIDR ranges up to a /19 against 150+ data sources, so a range-level listing that sweeps in your new block surfaces on the next check, whether it was aimed at you or at the address space around you. During a ramp-up, a spot blacklist check confirms a range is clean before you route real mail through it. Start monitoring your ranges.
