212.25.240.76 is the IP our IT recognised as used by NS for sending emails, which is an IP they have

authorised

So maybe NS is using some other IP as well for emails ? I know this has changed some time ago and also changed when we have been moved from US to Amsterdam data centre