# Mailgun leaking server's real IP behind Cloudflare

**URL:** <https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128>\
**Category:** Product Support\
**Created:** [March 15, 2017, 3:01am UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128 "2017-03-15T03:01:37Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![anon67292109](https://avatars.discourse-cdn.com/v4/letter/a/ed655f/32.png) [@anon67292109](https://meta.discourse.org/u/anon67292109)\
**Post date:** [March 15, 2017, 3:01am UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/1 "2017-03-15T03:01:37Z")

</div>

Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks.

`Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UTC)`

No DDoSers have discovered this yet.

Additionally, a security researcher just pasted me the following information and told me it was pulled using “linux dig”

```
IP address **REAL IP HERE**
Reverse DNS (PTR record) sposting.com
DNS server (NS record) ns3.digitalocean.com (198.41.222.173)
ns1.digitalocean.com (173.245.58.51)
ns2.digitalocean.com (173.245.59.41)
ASN number 393406
ASN name (ISP) Digital Ocean, Inc.
IP-range/subnet 138.197.80.0/20
138.197.80.0 - 138.197.95.255

```

So it may be leaking in other ways as well but I can’t totally confirm that.

Any ideas?

---

_[View the full topic](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128)._