Sh4mefulIP Address: 209.85.220.97
This server, mail-sor-f97.google.com, belongs to Google's IP range, specifically used for Gmail SMTP servers. In the context of DMARC and email authentication, this IP is commonly seen in reports as a source IP that handles mail for Gmail users, requiring proper alignment with SPF or DKIM to pass DMARC checks.
Key Details About mail-sor-f97.google.com
- SPF Alignment: It is generally authorized to send mail for Google-linked accounts. DMARC failures related to this IP often occur during email forwarding or misconfigurations in SMTP relay setups.
- DMARC Reports: It appears frequently in aggregate reports (rua) as a trusted sender (pass) when SPF and DKIM are configured correctly.
- Failures: If you see this IP failing DMARC with a none or fail policy, it is often due to forwarded emails or if the smtp.mailfrom domain does not align with the header_from domain.
Sources: Gemini (retrieved 16-Mar), Google Help
This is (part of) the GCP public cloud. Some email protection services run in GCP, but it is also an attack/spam vector.
This page shows DMARC authentication failure data for this IP address. Learn more about this data.
Geolocation Information
- Country:
- US United States
- Coordinates:
- 37.751, -97.822
WHOIS Information
- Network Name:
- CIDR:
209.85.128.0/17- Owner:
- Google LLC
- Org ID:
GOGL- Address:
- 1600 Amphitheatre Parkway, Mountain View, CA 94043
- Reverse DNS:
-
mail-sor-f97.google.com
Last updated: 2/5/2026
Analysis
This IP was first observed on March 12, 2024 and most recently on November 21, 2025. It has been associated with 40 failed authentication events affecting 130 messages, representing significant volume. The IP belongs to GOOGLE (Google LLC), a cloud hosting provider with activity associated with United States. 4 other IPs in the same /24 subnet (209.85.220.*) also appear in this dataset.
Network Topology
Failures Detected from this IP
Showing 1-40 of 40 failures, affecting 130 messages| Date ▼ | Messages |
|---|---|
| 11/21/2025 | 3 |
| 11/20/2025 | 5 |
| 10/24/2025 | 3 |
| 10/23/2025 | 5 |
| 10/10/2025 | 3 |
| 10/9/2025 | 6 |
| 10/3/2025 | 3 |
| 10/2/2025 | 5 |
| 9/30/2025 | 2 |
| 9/25/2025 | 2 |
| 9/23/2025 | 2 |
| 9/19/2025 | 3 |
| 9/18/2025 | 5 |
| 9/16/2025 | 2 |
| 9/12/2025 | 4 |
| 9/11/2025 | 6 |
| 9/9/2025 | 2 |
| 9/2/2025 | 2 |
| 7/31/2025 | 2 |
| 7/30/2025 | 7 |
| 7/22/2025 | 2 |
| 7/17/2025 | 7 |
| 7/16/2025 | 2 |
| 7/10/2025 | 2 |
| 7/8/2025 | 4 |
| 7/1/2025 | 9 |
| 6/30/2025 | 8 |
| 6/26/2025 | 2 |
| 6/24/2025 | 3 |
| 6/18/2025 | 1 |
| 6/12/2025 | 1 |
| 6/11/2025 | 3 |
| 5/13/2025 | 1 |
| 5/8/2025 | 1 |
| 4/30/2025 | 2 |
| 4/29/2025 | 1 |
| 4/24/2025 | 3 |
| 4/10/2025 | 3 |
| 2/13/2025 | 2 |
| 3/12/2024 | 1 |
External Reputation Lookups
Look up this IP in external threat intelligence and reputation databases (opens in new tab):
Nearby IPs
Other IPs in the 209.85.220.0/24 range observed failing DMARC:
209.85.220.41 (367 failures), 209.85.220.69 (257 failures), 209.85.220.101 (16 failures), 209.85.220.65 (5 failures)