How sender reputation works

20 May 2026 · 12 min read

Every time you send an email, an invisible scoring process runs before your message reaches an inbox. Mailbox providers like Gmail, Outlook and Yahoo do not simply deliver whatever arrives. They ask a question first: do we trust the source of this message enough to place it in front of the recipient? The answer to that question is your sender reputation, and it is the single largest factor in whether your legitimate mail lands in the inbox, drops into spam, or gets refused at the door entirely.

Sender reputation is not one number on one scoreboard. It is a moving estimate, held privately by each receiving provider, built from how recipients react to your mail and how cleanly your sending infrastructure behaves over time. You cannot see most of these scores directly, and you certainly cannot edit them. What you can do is understand the inputs, avoid the behaviours that wreck them, and put authentication in place so that the reputation you build actually attaches to you and cannot be hijacked by someone else. This guide explains how domain and IP reputation work, what raises and lowers them, how warming up a new sender fits in, and why email authentication is the foundation that holds the whole thing together.

Reputation is the receiver's bet on your next message

Think of a mailbox provider as a casino that has watched you play thousands of hands. It has no contract with you and owes you nothing. Its only job is to protect its own users from spam, scams and clutter. So it builds a profile of every sender it sees and uses that profile to predict what your next message is likely to be. If your history says "this sender's mail is opened, read and replied to", the provider bets on the inbox. If your history says "this sender's mail is ignored, deleted unread or marked as spam", it bets on the spam folder. If it has barely seen you before, it hedges, watching closely and limiting how much of your mail it accepts at once.

Two facts follow from this. First, reputation is earned through behaviour over time, not declared. You cannot buy your way to a good reputation or argue your way out of a bad one. Second, reputation is contextual. The same volume and content might be fine from a long-established sender and alarming from a brand-new one. The provider is always asking "is this normal for this sender?" rather than judging against a fixed universal threshold.

Reputation lives at two main levels, and it helps to keep them separate in your head: the IP address your mail is sent from, and the domain in the address it claims to come from.

IP reputation: the address your mail leaves from

Every email is transmitted from a sending IP address, the network address of the mail server that hands your message to the receiver. Mailbox providers track the behaviour of each IP and the surrounding blocks of addresses around it. An IP that has historically sent clean, wanted mail develops a good reputation. An IP that has spewed spam, or that suddenly changes behaviour, develops a poor one or gets listed on a blocklist.

IP reputation depends heavily on whether the address is dedicated or shared.

• A dedicated IP is used by one sender only. Its reputation is entirely yours: you reap the benefit of good behaviour and you alone suffer the consequences of bad behaviour. Dedicated IPs make sense at high, steady volume, typically tens of thousands of messages a day or more, because you need enough consistent traffic to establish and hold a reputation.
• A shared IP is used by many senders at once, which is the default on most email platforms and hosted services. Your reputation rides along with everyone else on that address. A reputable provider polices its shared pools hard, removing bad senders quickly, so the pool stays healthy. For low and moderate volume, a well-managed shared IP usually outperforms a dedicated one, because the steady aggregate traffic keeps the address warm and trusted in a way your modest volume alone never could.

A handful of signals feed IP reputation directly:

• Spam complaints. When recipients hit the spam button, that complaint is often reported back to the sending platform through a feedback loop. A complaint rate above roughly 0.1 percent, meaning one complaint per thousand delivered messages, is a serious warning sign, and 0.3 percent is the kind of figure that gets mail throttled or blocked.
• Hard bounces. Sending to addresses that do not exist tells the receiver you are not cleaning your list, which is exactly what spammers fail to do. A rising hard-bounce rate is read as a list-hygiene problem and drags reputation down.
• Spam-trap hits. Some addresses exist only to catch senders who scrape or buy lists. Mail to a trap is a strong negative signal because no genuine opt-in could have produced it.
• Sending consistency. Smooth, predictable volume looks human and organised. Huge unexplained spikes look like a compromised account or a fresh spam run, and receivers respond by tightening the tap.
• Blocklist status. Public DNS blocklists (DNSBLs) record IPs observed sending spam. Many receivers consult them. A listing can hurt delivery immediately, and getting removed takes time and clean behaviour.

Domain reputation: the name you send under

Where IP reputation is about the network address, domain reputation is about the domain in your sending identity, the part after the @ in your address and the domains used in your authentication. Over the last decade domain reputation has steadily become the more important of the two for most senders, because domains are far harder to discard and replace than IPs. A spammer can rent a fresh IP cheaply, but a domain carries history, costs money and is bound to a brand. So receivers increasingly anchor trust to the domain.

Domain reputation accumulates across several related identifiers:

• The From domain, the visible domain your recipients see.
• The DKIM signing domain (the d= value in your DKIM signature), which can be the same as the From domain or a delegated subdomain.
• The Return-Path domain, used for SPF and for bounce handling, often a subdomain managed by your sending platform.

Because reputation attaches to domains, the alignment between these identifiers matters enormously, and this is exactly where authentication stops being a checkbox exercise and starts being a reputation tool. We will come back to that.

One practical consequence of domain reputation is the question of subdomains. Many organisations deliberately separate streams of mail onto different subdomains: transactional mail (receipts, password resets) from one, marketing campaigns from another, perhaps mail.yourbrand.com versus news.yourbrand.com. Transactional mail tends to be wanted, opened and rarely complained about, so it earns a strong reputation. Marketing mail is more likely to draw complaints. Splitting them means a bad marketing week cannot poison the deliverability of your critical password-reset emails. Each subdomain builds its own reputation, which is a feature, not a bug, when used on purpose.

What recipients do is the loudest signal of all

Underneath the complaint rates and bounce counts sits something more fundamental: engagement. Mailbox providers watch how their users interact with your mail, because nothing predicts whether the next message is wanted better than what people did with the last one.

Positive engagement signals push you towards the inbox:

• Opening messages, and especially opening promptly.
• Replying, which is a very strong trust signal.
• Moving a message out of spam and into the inbox, or adding you to contacts.
• Clicking links, scrolling, and not deleting without reading.

Negative engagement signals push you towards spam:

• Deleting without opening, message after message.
• Ignoring mail that piles up unread.
• Marking as spam, the single most damaging action a recipient can take.

This is why list hygiene and genuine opt-in matter so much, and why buying lists is self-defeating. People who never asked to hear from you do not engage, and low engagement is itself a reputation killer even before anyone complains. Sending less mail to people who actually want it beats sending more to people who do not, every single time. If you take one operational lesson from this article, let it be that pruning disengaged recipients improves the reputation that determines whether your engaged recipients ever see you.

Warm-up: building reputation from a standing start

A brand-new domain or a brand-new dedicated IP has no reputation. To a receiver, no reputation is not neutral so much as unproven, and unproven senders are treated cautiously. If a fresh sender suddenly blasts fifty thousand messages on day one, that pattern looks exactly like a compromised account or a spam operation, and the receiver will throttle, defer or junk much of it. The damage from that first impression can linger.

Warm-up is the practice of starting small and increasing volume gradually so the receiver can observe good behaviour and build trust at a pace it is comfortable with. A typical warm-up runs over several weeks and follows a few principles:

1. Start with your best recipients. Send the first batches to the people most likely to engage positively: recent customers, active users, anyone who opted in eagerly. Strong early engagement teaches the receiver that your mail is wanted.
2. Increase volume gradually. Roughly speaking, send a modest amount on day one and increase by a sensible factor each day, watching the results. There is no single official curve, because each provider reacts differently, but the principle is steady, observable growth rather than a sudden flood.
3. Spread across providers in proportion. Warm up against the mix of mailbox providers your real list contains, rather than hammering one and ignoring another.
4. Watch the metrics and slow down if they wobble. If bounces, complaints or deferrals climb, hold volume steady or pull back until they settle. Warm-up is a conversation with the receiver, not a fixed schedule you push through regardless.
5. Keep sending. Reputation decays with silence. A domain that warmed up beautifully and then went quiet for two months has to re-establish itself. Consistent ongoing volume maintains the trust you built.

Warm-up applies whenever you introduce a new sending identity: a new domain, a new subdomain, a new dedicated IP, or a migration to a new sending platform. It is less of a concern on a well-managed shared IP pool, where the established aggregate reputation cushions a new sender from the cold-start problem.

Authentication is what makes reputation yours to keep

Here is the part that ties everything to the rest of email security, and the reason a reputation conversation belongs on a platform about DMARC, SPF and DKIM. Reputation is only valuable if it reliably attaches to you and cannot be stolen, copied or spoofed by someone else. Authentication is the mechanism that makes that true.

Consider what happens without authentication. Reputation is built on an identity, your domain. If anyone can put your domain in the From address and send mail that receivers accept as plausibly yours, then your hard-won reputation is a shared resource for every spammer and phisher who decides to impersonate your brand. Their complaints, their spam-trap hits and their abuse all land on your domain's record. You spend months earning trust and a single spoofing campaign spends it. The three core protocols exist precisely to prevent this.

• SPF lets you publish which servers are allowed to send for your domain, so a receiver can check whether the sending IP is one you authorised. Learn more on the SPF product page, and verify your own record with the SPF checker.
• DKIM attaches a cryptographic signature to each message, tied to your domain via a key published in DNS. A valid signature proves the message genuinely came from your domain and was not altered in transit. Check yours with the DKIM checker.
• DMARC ties the two together and adds the crucial concept of alignment: it requires that the authenticated domain actually matches the visible From domain, closing the gap that lets attackers pass SPF or DKIM on some unrelated domain while still showing your brand in the From line. Inspect any domain's policy with the DMARC checker, and read the deeper explanation in DMARC alignment explained.

Alignment is the bridge between authentication and reputation. Receivers attribute reputation to the domain that is both authenticated and aligned, because that is the domain they can trust as the true origin. When your DKIM d= and your From domain align, the reputation you build accrues to the identity your recipients actually see, and it is protected: an impersonator cannot align to your domain without your private DKIM key and your authorised servers. With a DMARC policy of p=reject in place, mail that fails authentication for your domain is refused outright, so spoofed messages never reach inboxes to generate complaints against you in the first place. Authentication does not directly raise your reputation, but it builds the fence that keeps your reputation yours. For the full picture of moving from monitoring to enforcement, see DMARC policy: none, quarantine, reject.

Monitoring: you cannot manage what you cannot see

Because reputation is largely invisible from the outside, the practical challenge is detecting trouble before it becomes a delivery crisis. DMARC aggregate reports (RUA) are the most useful free signal you have. Every day, mailbox providers send back XML summaries of the mail they saw claiming to be from your domain, how much passed authentication, how much failed and which sources sent it. Read correctly, those reports reveal three reputation-relevant things at once: legitimate sending sources you forgot to authorise, authentication failures quietly eroding trust, and spoofing attempts trying to ride on your domain. The trouble is that raw RUA XML is unreadable by hand. The DMARC report analyzer turns those reports into something you can act on, and the difference between reports and inbox visibility is covered in DMARC reports vs the inbox.

Beyond DMARC reports, watch the metrics inside your sending platform: bounce rate, complaint rate, delivery rate and engagement. Set a personal alarm at a complaint rate of 0.1 percent and treat anything approaching 0.3 percent as an emergency. Keep an eye on whether your sending IPs or domains appear on major blocklists. The earlier you catch a downward trend, the cheaper it is to reverse, because reputation falls faster than it climbs.

A working checklist for protecting reputation

Pulling the threads together, the senders who keep their mail in the inbox tend to do the same handful of things consistently:

• Authenticate everything. Publish correct SPF, DKIM and DMARC, keep them aligned, and progress to an enforcing DMARC policy so nobody can spoof you. Start by checking your current state across all five protocols on the tools page.
• Send only to people who asked. Use genuine opt-in, never buy or scrape lists, and make unsubscribing easy so unhappy recipients leave quietly instead of hitting the spam button.
• Clean your list continuously. Remove hard bounces immediately and prune recipients who have not engaged in a long time. A smaller engaged list beats a large indifferent one.
• Warm up new senders. Introduce new domains, subdomains and dedicated IPs gradually, starting with your most engaged recipients.
• Send consistently. Avoid wild volume spikes and avoid long silences. Steady, predictable behaviour is what trust is built on.
• Separate your mail streams. Keep transactional mail on a different subdomain from marketing so one cannot drag down the other.
• Monitor the signals you can see. Watch complaint and bounce rates, read your DMARC reports, and check blocklists, so you catch problems while they are still small.

The takeaway

Sender reputation is the running judgement that mailbox providers make about whether your next message deserves the inbox, and it is built from real behaviour: engagement, complaints, bounces, consistency and clean list hygiene, measured at both the IP and the domain level. You earn it slowly through good practice and a sensible warm-up, and you can lose it quickly through carelessness or a single spoofing campaign run under your name.

Authentication is the part of this you can put right today, and it is the foundation everything else rests on. Without aligned SPF, DKIM and DMARC, the reputation you work to build is exposed to anyone willing to impersonate you. With them, that reputation is fenced off, attributed to the identity your recipients actually see, and protected at enforcement. Start by seeing where you stand: run your domain through the DMARC checker and the wider free tools to find the gaps. If you would rather have the whole authentication layer set up correctly, monitored and taken safely to p=reject without an email outage, that is exactly what the done-for-you DMARC service and ongoing monitoring with change alerts are built to do. Protect the identity, and the reputation looks after itself.