Domain reputation

Domain reputation is the score that mail providers, browsers, search engines, and threat intel services assign to your domain. It's not a single number; it's many overlapping signals tracked by different actors. A high-reputation domain has its mail delivered to the inbox; a low-reputation domain ends up in spam or rejected outright.

Where domain reputation lives

Email reputation

The biggest consumer of domain reputation. Providers (Gmail, Microsoft 365, Yahoo) track:

• Volume of mail sent over time (sudden spikes are suspicious).
• Bounce rate (high bounces signal poor list hygiene).
• Spam complaint rate (p=user-marked-as-spam events).
• SPF, DKIM, DMARC alignment rates.
• Engagement metrics (opens, clicks, replies).
• Time-on-list before unsubscribe.

Gmail Postmaster Tools surfaces some of this back to senders. Microsoft SNDS for Outlook does the same.

Browser safe-browsing reputation

Google Safe Browsing, Microsoft SmartScreen, Apple Safe Browsing, Mozilla. These check user-visited URLs against blocklists of phishing, malware, social-engineering sites. A flagged domain shows a full-screen warning in Chrome / Edge / Safari, killing usability.

Causes for flagging: hosting phishing pages, malware downloads, deceptive ads, social-engineering content. Recoverable through "Submit for review" but takes 1-7 days.

Search engine reputation

Google's web spam team and SafeSearch take domain reputation into account for ranking and adult-content classification. A flagged domain drops in SERPs. Penalties for: spam content, link schemes, hacked content, malware.

Threat intel reputation

VirusTotal, AbuseIPDB, Spamhaus DBL (Domain Block List), URIBL, SURBL. Various lists with various criteria. Used by mail filters, IDS/IPS systems, security analysts.

How reputation gets damaged

• One careless campaign blasted to a stale list = spike in complaint rate = inbox to spam folder for the next 3 months.
• A subdomain takeover gets your hostname listed in a phishing campaign = browser warnings on your domain.
• Compromised account exfiltrates user data via a subdomain = security flagging.
• Selling or transferring the domain to a sketchier owner = inherited bad reputation that the new owner has to rebuild.

How to monitor

• Mail. Gmail Postmaster, Microsoft SNDS, MXToolbox blocklist check.
• Browser. Google Search Console (manual actions, security issues).
• Threat intel. VirusTotal domain report, Spamhaus check, AbuseIPDB.
• Search. Google Search Console, Bing Webmaster Tools.

How to rebuild

Reputation lags behavior. Once damaged, it takes 30-90 days of clean behavior to fully recover. Steps:

1. Fix the underlying issue (clean the list, patch the takeover, remove the phishing page).
2. Submit for re-review at the affected service.
3. Reduce sending volume to a trickle, ramp slowly.
4. Tighten DMARC enforcement to prevent recurrence.

In a SaaS

If your platform sends mail on behalf of customers from their domain (white-label transactional), every customer's domain reputation is tied to your sending IPs. Your worst customer's spammy behavior can damage every customer's deliverability. Solution: per-customer subdomain sending (DKIM with a customer-specific selector), separate IP pools for tiered customers, and ruthless complaint-rate monitoring.