diff --git a/infra/mail/filings-subdomain.md b/infra/mail/filings-subdomain.md
index 28bcbe2..fd3d2fb 100644
--- a/infra/mail/filings-subdomain.md
+++ b/infra/mail/filings-subdomain.md
@@ -42,10 +42,49 @@ v-add-dns-record justin performancewest.net filings TXT '"v=spf1 …"' '' '' no
 - Live send → GMX accepted; OpenDKIM log: `DKIM-Signature field added (s=filings, d=filings.performancewest.net)`
 - All 5 records resolve via `ns1.he.net`.
 
+## Dedicated sending IP: .90 (mta01)
+
+To also get a fresh *IP* reputation (not just domain), filings sends bind to
+**207.174.124.90** (`mta01.performancewest.net`), isolated from the
+reputation-damaged .94 trucking IP.
+
+- **Interface:** `.90/23` bound on ens18, persisted 3 ways (the Jun-24-outage
+  pattern): `/etc/network/interfaces` up/down hooks + `pw-mail-ips.service` +
+  `pw-mail-ip-watchdog` cron (all now include .90).
+- **PTR/FCrDNS:** `.90 -> mta01.performancewest.net -> .90` (already valid).
+- **Postfix transport `outfilings`** (master.cf): binds `.90`, HELO
+  `mta01.performancewest.net`, 3s rate delay.
+- **Routing:** `sender_dependent_default_transport_maps=hash:/etc/postfix/sender_transport`
+  maps `@filings.performancewest.net -> outfilings:`. NOTE: the old
+  `transport_maps = ..., randmap:{out05:}` catch-all was moved to
+  `default_transport = out05` so the sender map can win (recipient `transport_maps`
+  outranks the sender map, so a catch-all there would have forced everything to
+  out05/.94). Everything non-filings still egresses .94.
+- **SPF** for filings now lists `.90` first: `v=spf1 ip4:207.174.124.90 ip4:.94 ip4:.107 -all`.
+
+## Deliverability test results (2026-07-01, from .90)
+
+| Receiver | Result |
+|---|---|
+| GMX (non-Google) | 250 accepted ✓ |
+| Microsoft/Outlook | connection accepted (no reputation block) ✓ |
+| **Gmail** | 550 "likely unsolicited mail" ✗ (cold-start, NOT reputation) |
+
+**Key finding:** the fresh IP fixed the *reputation* signal — Gmail's error
+changed from "very low reputation of the sending domain" (on .94) to "likely
+unsolicited mail" (on .90). That is Gmail's **cold-start** block: it will not
+accept cold outreach from a zero-history IP/domain on day one, independent of
+auth (which all passes). Non-Google receivers deliver fine.
+
+**Implication:** send the CT campaign to NON-Google recipients first (warm .90
+with clean, low-bounce mail), and treat Gmail cold-start as a hard, slow wall —
+only trickle Gmail in small batches over weeks once .90 has history + Postmaster
+Tools signal.
+
 ## Warm-up plan (do NOT repeat the 34%-bounce mistake)
 
 1. Send ONLY smtp_valid, non-Google leads first (CT clean pool ~3,106).
-2. Start ~50–100/day, ramp over 2–3 weeks.
+2. Start ~100/day, ramp over 2-3 weeks.
 3. Watch Google Postmaster Tools (domain already verified) + DMARC rua reports.
 4. Keep bounce <1% and complaints <0.1%; verify catch-alls at send time before
    widening to the 38k CT catch-all reserve.
diff --git a/infra/network/interfaces b/infra/network/interfaces
index 1449938..aff9d5c 100644
--- a/infra/network/interfaces
+++ b/infra/network/interfaces
@@ -22,6 +22,18 @@ iface ens18 inet static
 	# (one IP at a time, days apart, only after Postmaster Tools shows green).
 	address 207.174.124.94/23
 	address 207.174.124.107/23
+	address 207.174.124.90/23  # filings subdomain (mta01) - fresh-reputation cold stream
+	# Secondary IPs: classic ifupdown only applies the FIRST address line, so
+	# bring these up explicitly (survives reboot; the bare address lines above
+	# are kept as documentation + for ifupdown2 compatibility).
+	up   ip addr add 207.174.124.72/23  dev $IFACE || true
+	up   ip addr add 207.174.124.94/23  dev $IFACE || true
+	up   ip addr add 207.174.124.107/23 dev $IFACE || true
+	up   ip addr add 207.174.124.90/23  dev $IFACE || true
+	down ip addr del 207.174.124.72/23  dev $IFACE || true
+	down ip addr del 207.174.124.94/23  dev $IFACE || true
+	down ip addr del 207.174.124.107/23 dev $IFACE || true
+	down ip addr del 207.174.124.90/23  dev $IFACE || true
 	gateway 207.174.124.1
 	# dns-* options are implemented by the resolvconf package, if installed
 	dns-nameservers 8.8.8.8 8.8.4.4