Nine ways to repair sender reputation, in the order that actually works

Sender reputation is not one number. It is a private judgement each mailbox provider keeps about a domain, an IP, and the content and behaviour behind them. When it drops, the fix works only if you do the steps in an order that matches how providers actually re-evaluate you.

What actually damaged it

Before touching anything, find the trigger. The usual causes, in rough frequency:

• A list that was not recently verified, producing a spike in hard bounces
• A sudden volume jump on a domain or mailbox that had been sending quietly
• A spam-trap hit, usually from a purchased or very old list
• A broken or missing authentication record after a DNS change
• A complaint spike tied to one campaign or one segment

Pull your last 30 days of bounce and complaint data before you guess. Guessing and fixing the wrong layer is the single most common way a repair takes a month instead of a week.

Fix authentication first

If SPF, DKIM, or DMARC is broken, nothing else you do matters, because providers can't reliably attribute the mail to you in the first place. Check in this order:

1. SPF record resolves and includes every system that actually sends for the domain (fewer than 10 DNS lookups)
2. DKIM selector is published and signing is active on the sending platform
3. DMARC policy is p=quarantine or p=none while you're investigating, not p=reject until you're confident, with rua reports going somewhere you read

A DMARC aggregate report that shows alignment failures is the fastest way to find a sending source you forgot was still active.

Stop sending to bad addresses

Run every active list through a verification pass before you send again. Remove hard bounces, remove anything that has not opened or clicked in six months unless it's transactional, and remove role addresses (info@, sales@) that were never going to engage. This step alone resolves a large share of reputation drops, because bounce and spam-trap rate are the two signals providers weight most heavily early in an investigation.

Slow the ramp back down

Once the list is clean, send less, not more. Cut volume to roughly a third of what triggered the problem and hold it for a week before increasing again. A domain in recovery is treated by filters the same way a brand-new domain is: it has to re-earn trust gradually, and a fast ramp back to full volume reads as exactly the behaviour that caused the problem.

Separate the domain that got hurt

If one domain or subdomain took the damage, do not keep sending transactional and marketing mail from the same place while it recovers. Splitting traffic by purpose means a bad marketing send can't drag down the password-reset emails your product depends on, and it gives you a clean domain to warm up in parallel.

Watch complaint and bounce rate daily, not weekly

Reputation checks that happen weekly catch problems a week late. During a recovery, check bounce rate, complaint rate, and any blocklist listings daily for at least three weeks. Gmail's Postmaster Tools no longer shows a domain or IP reputation chart, so the signal to watch is your own spam-rate reporting from Google Postmaster and the delivery data from your sending platform, not a third-party score.

What not to do

• Don't increase volume because "it's been a few days and nothing bad happened." Reputation recovery is measured in weeks.
• Don't buy a list to replace the one that caused the problem. That is how the next drop starts.
• Don't rely on a warm-up pool to manufacture opens and clicks as a shortcut. Pools built to fabricate engagement are now the specific target of blocklists like Validity's Heatwave, launched 3 September 2026 against domains used for synthetic reputation warming — and no vendor can promise your domain is exempt from a list like that.
• Don't change five things at once. If the recovery works, you want to know which fix did it.

MailPilot helps with the parts of this that are mechanical rather than judgement-based: it warms mailboxes gradually over OAuth or SMTP/IMAP, checks SPF, DKIM, and DMARC on your sending domains, and tracks per-mailbox reputation daily so a new drop shows up the next morning instead of the next invoice cycle.