Email Sender Reputation: How Mailbox Providers Score Your Domain

Sender reputation is the score mailbox providers assign to your domain and IP address, and it decides whether your emails reach the inbox or vanish into spam — regardless of how good your content is. Authentication records (SPF, DKIM, DMARC) prove your identity; sender reputation decides whether you're trusted. Without a solid reputation, authenticated mail still lands in spam.

Most senders discover this the hard way: they set up their DNS records correctly, send their first campaign, and watch most of it hit the spam folder. The records are right — but they have no reputation yet, and "no data" reads as "caution" to Gmail, Outlook, and Yahoo.

How mailbox providers build your score

Each major provider maintains its own reputation system. There's no single public "reputation number" you can look up — Gmail, Outlook, Yahoo, and Apple Mail each build their own score from signals they observe directly. The inputs overlap but the weighting differs.

Gmail — the strictest provider — scores your domain on four measurable signals:

• Spam complaint rate — the percentage of recipients who click "Report spam." Gmail's hard ceiling is 0.3%; above that, delivery collapses. The ideal target is under 0.1% — one complaint per 1,000 messages.
• Bounce rate — the percentage of messages sent to invalid addresses. Above 2-3%, Gmail reads it as list-buying or scraping behavior.
• Volume patterns — consistent daily sends build trust. A domain that sends 10 messages on Monday and 500 on Tuesday triggers the same signals as spam campaigns.
• Recipient engagement — opens, replies, folder moves (to Primary), and "Not Spam" votes improve your score. Deletions without opening and long stretches of ignored mail degrade it.

Microsoft (Outlook/Hotmail) uses similar signals but adds its own proprietary SmartScreen filter, which weighs content patterns more heavily than Gmail does. Yahoo blends authentication compliance with historical engagement data and has its own blocklist infrastructure.

The key difference from authentication: SPF, DKIM, and DMARC are binary — they either pass or fail, and they work immediately when you publish the records. Reputation is a rolling average of your sending behavior over time. There's no switch to flip; it compounds or erodes with every send.

Domain reputation vs. IP reputation

Your reputation lives in two places, and senders on shared infrastructure need to understand the distinction.

Domain reputation attaches to your From address — yourcompany.com. This is the primary signal for Gmail and Yahoo (as of 2024, both weight domain reputation more heavily than IP reputation). You control your domain's reputation entirely through your sending practices. A bad domain reputation follows you even if you change email providers or sending tools.

IP reputation attaches to the server that physically transmits your email. If you send from a dedicated IP (common with enterprise email platforms), you own both the domain and IP reputation. If you use a shared service — which includes most platforms like SendGrid, Mailgun, Amazon SES, and any marketing automation tool — the IP reputation is shared among all senders on that server. A bad neighbor sending spam from the same IP can drag your delivery down even if your domain is pristine.

This is why shared-IP senders should focus obsessively on domain reputation: it's the one signal they fully control. IP reputation on shared infrastructure is a risk managed by the ESP (most major providers isolate high-reputation senders and rotate IPs to manage listings).

How reputation damages — and how it recovers

Reputation is easier to lose than to build. Three common patterns cause the most damage:

Spam complaints above threshold. One recipient clicking "Report spam" in Gmail carries real weight — and it's permanent in the short term. Gmail counts complaints over a rolling 30-day window. If your complaint rate exceeds 0.3% even once, delivery to Gmail drops immediately. The fix: clean your list (remove disengaged addresses), double-opt-in new subscribers, and make your unsubscribe link impossible to miss.

Sending to invalid addresses. Every bounce is a hit. High bounce rates tell providers that you're either purchasing lists or not cleaning your data. Hard bounces (invalid addresses) should be removed from your list immediately. Soft bounces (temporary failures) warrant watching but aren't as damaging. Aim for a bounce rate under 1%.

Spam trap hits. Spam traps are email addresses maintained by blocklist operators and mailbox providers specifically to catch senders with poor list hygiene. Hitting even one spam trap means you're sending to addresses that were never legitimately opted in — either scraped from the web, purchased from a list vendor, or retained long after the address was abandoned. Providers and blocklist operators publish no spam trap data, so the only defense is rigorous list hygiene: confirmed opt-in, regular pruning, and never buying contact lists.

Recovery timeline: With consistent clean sending, expect 2-8 weeks for reputation to improve. Gmail is relatively fast (2-3 weeks of good signals). Outlook can take 4-6 weeks — its system is more cautious about restoring trust. Yahoo falls in between. During recovery, focus exclusively on your most engaged recipients — people who have opened or replied in the last 30 days. Once your reputation lifts, you can gradually expand to broader segments.

How to check your reputation right now

Three free checks tell you most of what you need to know:

1. Google Postmaster Tools (postmaster.google.com) — add your domain and verify via DNS. Gmail shows you: domain reputation (High/Medium/Low/Bad), spam rate (the exact percentage of reported spam), authentication pass rates (SPF, DKIM, DMARC), and delivery errors. This is Gmail's own data about your domain — more accurate than any third-party tool.

2. Public blocklist check — search for your domain and sending IP on Spamhaus (spamhaus.org), Barracuda (b.barracudacentral.org), and SORBS. A listing on any of these affects delivery to providers that query that list. Most blocklists offer a delisting form once you've fixed the underlying issue.

3. DNS authentication scan — verify that your SPF, DKIM, and DMARC records are published, correctly formatted, and aligned. Poor authentication directly damages reputation — providers score unauthenticated domains lower before they even look at sending behavior. Run a free scan at EmailSecurityGrade to check all four record types (SPF, DKIM, DMARC, MX) in seconds with a letter grade and fix instructions for anything failing.

Building reputation from zero

A new domain has no reputation, and most providers treat that as "filter until proven otherwise." The standard approach is warmup — sending increasing volumes of messages that recipients actually open and engage with.

Week 1: 10-20 messages per day, only to verified addresses of people who expect your mail. Week 2: 50-100/day. Week 3: 200-500/day. Each week, if your spam complaint rate stays under 0.1% and bounce rate under 1%, the next increase is safe. If either metric ticks up, hold volume steady until they stabilize.

The catch: during warmup, your open rates look artificially high (you're sending to your best addresses) and your reputation is still growing. Don't cut the warmup short because the numbers look good — the real test is whether bulk-volume sends to your full list maintain inbox placement, and that only shows up at week 3-4.

Some senders use deliverability tools to accelerate warmup. A tool like InboxAlly generates real engagement signals — opens, replies, folder moves — from a network of active mailboxes, which teaches Gmail and Outlook to trust your domain faster than organic-traffic warmup alone. This is especially useful for cold outreach domains that don't have an existing subscriber base to send warm-up messages to.

Reputation is not a one-time fix

Your reputation shifts with every send. A domain can be "High" reputation in Gmail's Postmaster Tools today and "Medium" in two weeks if you mail to a stale segment. The signals are continuous, and providers average them over rolling windows.

Check Postmaster Tools monthly. Scan your DNS records quarterly. Treat any sudden drop in open rates as an early warning — it usually means a reputation problem is forming before the spam folder becomes permanent.

Authentication gets your mail authenticated. Reputation gets it delivered. Fix both, and you've solved 90% of deliverability.

Check your grade free

Don't guess what's broken — see it. Scan your domain free at emailsecuritygrade.com and get an instant A-F grade on your SPF, DKIM, DMARC, and MX records, with a plain-language fix for anything failing. No signup, no install — it runs in your browser.

If your emails are still landing in spam after fixing the records, a deliverability tool like InboxAlly can train mailbox providers to trust your sending — worth a look once your grade is solid.