Autonomous System Number (ASN)

An autonomous system number (ASN) identifies a network that is operated under a single, consistent routing policy. It is the unit that the Border Gateway Protocol (BGP) uses to route traffic between networks: every route on the internet carries the list of ASNs it passed through.

For email, the relevant point is that the ASN is the largest unit at which a sender can be identified. An IP address can be swapped in minutes and a domain registered in seconds, but an ASN belongs to an organisation with a contract at a Regional Internet Registry — which makes it the level at which reputation is hardest to escape.

Who assigns ASNs?

Regional Internet Registries (RIRs) assign them: RIPE NCC in Europe and the Middle East, ARIN in North America, APNIC in Asia-Pacific, LACNIC in Latin America and AFRINIC in Africa. The number space is 32-bit, so values run from 1 to 4294967294, with a reserved private range (64512–65534 and 4200000000–4294967294) for use inside a single organisation.

Does every network have an ASN?

No, and this is where the common misconception lies. An ASN is only needed by a network that speaks BGP to more than one other network — that is, one that is multi-homed or that provides transit to others.

A company with a single upstream provider does not need one. Its addresses are announced by that provider and therefore appear under the provider’s ASN. This matters directly: if you rent a server, its reputation at ASN level is your hosting provider’s reputation, not yours, and you inherit whatever the other customers on that network are doing.

How do I find the ASN for an IP address?

whois on the address returns the responsible ASN along with the range and the abuse contact:

$ whois 192.0.2.25 | grep -iE 'origin|netname|abuse-mailbox'
origin:         AS64500
netname:        EXAMPLE-HOSTING
abuse-mailbox:  abuse@example-hoster.net

Cymru’s DNS-based service maps an address to its ASN without a whois query, which is what most tooling uses because it is fast enough for per-connection lookups:

$ dig +short 25.2.0.192.origin.asn.cymru.com TXT
"64500 | 192.0.2.0/24 | DE | ripencc | 2019-04-11"

And a query on the ASN itself returns the operator:

$ dig +short AS64500.asn.cymru.com TXT
"64500 | DE | ripencc | 2019-04-11 | EXAMPLE-HOSTING, DE"

Do ASNs have a reputation?

The number itself does not, but the network behind it accumulates one, and several systems act on it.

Spamhaus publishes ASN-DROP, a list of autonomous systems considered to be under the control of, or wholly rented out to, spam operations. Traffic from a listed ASN is commonly discarded at the network edge rather than filtered at the mail server. Reputation services more generally use the ASN as a feature: a previously unseen IP address inside a range whose neighbours send spam starts with a worse score than one in a clean network.

This is the mechanism behind snowshoe spam. An operator spreads low volumes across many IP addresses and many domains so that no single address crosses a threshold. What the addresses have in common is the ASN, which is why correlating at that level catches campaigns that per-IP scoring does not.

What does this mean if you run a mail server?