How to recover a damaged sender reputation

Reputation damage shows up as deferrals and rejections at one or more mailbox providers, or as mail that is accepted and filed in spam. A typical case: a domain a few weeks old sends a campaign to a few hundred people, then a second one shortly after, and Gmail throttles or rejects a large share of the messages with 421 4.7.28 and 550 5.7.1. The recovery has the same shape at every provider: stop adding to the damage, remove the cause, then rebuild a clean history.

Confirm it's reputation and not authentication

Read the rejection text before you change anything. Gmail's SMTP error reference separates the cases:

• 421 4.7.28: Gmail saw an unusual rate of mail, or of unsolicited mail, from your IP, domain or link domain, and is rate limiting or temporarily blocking it.
• 550 5.7.1 with "likely unsolicited": the message was blocked as probable spam.
• 421 4.7.0 naming the very low reputation of the sending IP: rate limited on IP reputation.
• 550 5.7.26, 421 4.7.30, 421 4.7.32: authentication or alignment failures. These are DNS problems, and fixing the records clears them. See DKIM verification failing and SPF record not found.
• 550 5.1.1: the address doesn't exist. That's a list problem, covered in email list hygiene.

At Outlook.com, mail from high-volume senders that fails Microsoft's authentication requirements goes to Junk and may be rejected with 550 5.7.515 (Outlook.com sender policy). Yahoo returns temporary TS-series deferrals when mail draws complaints from Yahoo users or comes from an IP with poor reputation (Yahoo error codes). Email bounces explained has the longer list.

Step 1: stop the bulk sends

Pause every running and scheduled campaign. While a provider is throttling you, each extra message is another sample of the behavior that got you throttled. Google's sender guidelines say that when messages start bouncing or being deferred, you should reduce volume until the error rate drops, then increase slowly again.

Let transactional mail (password resets, receipts, security alerts) keep flowing at its normal rate: people asked for it and it rarely draws complaints. If it shares a domain with your marketing it may be delayed too, which is a reason to move marketing to its own subdomain once you've recovered. Don't resend rejected messages by hand. Your sending service already retries 4xx deferrals, and manual resends only add volume.

Step 2: find and remove the cause

Damage usually traces back to specific sends. Look at the campaigns from the day the deferrals started and the day before, and note which provider is refusing you. The usual causes:

• A list that was old, imported from another tool, or never opted in. A high hard-bounce count on that send gives it away.
• A volume jump: a young domain mailing its whole list, or an established one sending far more than a normal day.
• Mailing the same people again too soon, which turns into complaints. See how often to send marketing email.
• Mail people didn't expect: a new kind of content sent to an old signup list, or a misleading subject line. See email copy that hurts deliverability.
• A leaked API key or SMTP credential. Look for sends you don't recognize, and rotate keys if you find any.

Fix the cause before you resume: remove the segment that bounced, suppress everyone who complained, and drop addresses you can't trace to a signup. Resuming the same list at a slower pace spreads the same damage over more days.

Step 3: confirm authentication passes

Gmail has been ramping up enforcement on non-compliant traffic since November 2025, with temporary and permanent rejections. Microsoft requires domains sending more than 5,000 emails a day to Outlook.com to pass SPF, DKIM and DMARC. A reputation problem on top of an authentication gap won't recover until the gap is closed.

Send a message to an address you control, open the original, and check that Authentication-Results shows spf=pass, dkim=pass and dmarc=pass. Then confirm a DMARC record exists:

dig TXT _dmarc.yourdomain.com +short

The full rules are in Gmail, Yahoo and Microsoft bulk sender requirements.

Step 4: read Google Postmaster Tools

Postmaster Tools is Gmail's view of your domain. To set it up, add the domain your mail authenticates with (the DKIM d= domain or the SPF Return-Path domain) and publish the TXT or CNAME record Google gives you. Dashboards stay empty until the domain is verified, and on days when your Gmail volume is low, Google leaves data out to protect user privacy. It doesn't publish the cut-off.

The dashboards to watch while you recover:

• Spam rate: the share of your inbox-delivered mail that Gmail users marked as spam. Google's guidelines say to keep it below 0.3% and aim for below 0.1%. It counts only user reports, so mail Gmail already filtered to spam can make it look lower than your real problem.
• Delivery errors: the share of authenticated mail Gmail rejected or temporarily failed, with the reason. It should fall as you slow down and clean up.
• Compliance status: whether you meet each sender requirement, marked Compliant, Needs work or No data found.
• Authentication and Encryption: the share of your mail passing SPF, DKIM and DMARC, and the share sent over TLS.

If you meet every sender requirement and your spam rate stays below 0.3% for 7 consecutive days, you can ask Gmail for mitigation through the sender contact form, according to Google's sender FAQ. Above 0.3% you aren't eligible.

Step 5: check Microsoft SNDS and the feedback loops

Microsoft's Smart Network Data Services (SNDS) reports how Outlook.com sees individual sending IPs. Access is per IP range, and you get it by proving you control the range: Microsoft sends the authorization request to addresses it derives from reverse DNS, RDAP and routing data (SNDS FAQ).

For each IP, SNDS shows traffic, a complaint rate (complaints divided by recipients) and a filter result: green when under 10% of the IP's mail was judged spam, yellow between 10% and 90%, red above 90%. Data is processed daily and kept for 90 days. The same site enrolls you in the Junk Mail Reporting Program, which sends you a report when Outlook.com users mark your mail as junk. Suppress those addresses.

If you send through a provider's shared IPs, you can't register them, and the provider sees that data instead. If you follow Microsoft's policies and still have problems, Microsoft asks you to contact Outlook.com deliverability support, and warns that it may not be able to help senders who don't comply.

Yahoo's Complaint Feedback Loop is domain-based and covers DKIM-signed mail, so it works on shared IPs. It reports each complaint, and you should suppress every address it reports.

Step 6: warm back up

Neither Gmail nor Microsoft publishes a recovery schedule. Google's guidance is to start with low volume to engaged users and increase it slowly. Our guidance, the same ramp we give for a new domain:

1. Start with the people most likely to want your mail: those who clicked, replied or bought recently.
2. Send a few hundred messages on the first day, not your whole list.
3. Grow the volume over about a week, and only after a clean day: no new deferrals, almost no hard bounces, no complaints.
4. If deferrals come back, hold the volume where it is, or step back, until they clear. M3AAWG's sender practices say the same about deferral spikes.
5. Add older segments last, after a re-permission message if they haven't engaged in a long time.
6. Return to your normal cadence. One large catch-up send after weeks of silence is another volume jump.