Skip to content
Duva Duva

← All articles

Sending reputation: how it is built, lost and repaired

· 6 min read

Two identical emails sent on the same day can be treated very differently depending on the sender. The difference is reputation: the picture mailbox providers have of you, based on what they have already received from you. Nobody publishes the formula, and no service controls the inbox. But the large providers say plainly what they look at. Here is what matters, what hurts, and what you can do.

One reputation, or several?

A provider does not score an abstract "sender". It observes several identities at once:

  • the domain that appears in the sender address and in DKIM signatures, that is, yours;
  • the IP address of the sending server, which may be shared among several senders;
  • sometimes the links and domains cited in the message.

The practical consequence: your domain follows you from one sending service to another, while the IP address belongs to the service. When you send through a provider whose IP addresses are shared, other customers' conduct affects you a little, and yours affects them. Google puts it this way: the reputation of a shared IP address is influenced by every sender using it, and a negative reputation can hurt delivery. That is why a good sending service monitors its customers, and why Duva's terms of use set thresholds (more on that below).

What providers look at

No list is complete, but these are the signals the providers themselves cite most.

Complaints

When a person clicks "Report spam", it is the strongest signal. Google asks all senders to keep the spam rate reported in Postmaster Tools below 0.3%, and recommends staying below 0.1%. Beyond that, the effect on delivery is greater, and since June 2024 a high-volume sender above 0.3% can no longer get mitigation for delivery problems. The percentage looks small, and it is, but it is measured on messages received by that provider's users, and a few reports are enough when your volume is low.

Bounces

A message sent to a mailbox that does not exist is a sign of carelessness: you are writing to mistyped, outdated or invented addresses. A serious service removes these addresses automatically after the first permanent refusal. Insisting on an unknown address costs reputation and gains nothing. To tell the causes of a bounce apart, see the article An email did not arrive: how to find out why.

Sudden changes

A volume that doubles overnight, a new type of message, a new sending infrastructure: anything that breaks with your habits looks like what a compromised account or a spammer does. Google advises raising volume gradually, sending at a steady pace rather than in bursts, starting with the most engaged recipients, and ramping up separately any traffic whose format or infrastructure has changed. It warns in particular that suddenly doubling previous volumes can result in rate limiting or reputation drops.

Authentication

SPF, DKIM and DMARC do not create a good reputation, but their absence prevents one: without them, the provider cannot tie your messages to a domain, and so to a history. Google also requires an encrypted connection (TLS) and valid forward and reverse DNS records for the sending IP addresses. Setting it up is described in SPF, DKIM and DMARC: setting up a sending domain.

The kind of email, and what the recipient expects

A receipt, a sign-in code, a password reset: the person expects it, opens it and does not report it. A message they do not remember asking for is the one they report. The line between the two is explained in Transactional or marketing email. Duva is a transactional service: it is not made for newsletters or bulk sending, which its terms forbid without prior written agreement.

Blocklists

Third-party organizations publish lists of IP addresses or domains associated with spam, and some receiving servers consult them before accepting a message. Three points to remember:

  1. Not all lists are equal. Some are widely used, others hardly at all. Being on an obscure list generally blocks nothing.
  2. A listing has a cause. Removing the address from the list without fixing the cause (sending to unverified addresses, a compromised account, a sign-up form open to anyone) is pointless: it will be listed again.
  3. Removal is requested from the organization, following its procedure, after the fix. There is no shortcut.

If you use a sending service, it manages its own IP addresses. What you control is the quality of your own sending, and what you can do is tell it if your messages are refused with a reputation reason (5.7.x code).

Building a reputation

A reputation is built through regularity. Concretely:

  • Start small with a new domain, and increase in steps rather than sending the planned volume at once.
  • Write only to confirmed addresses: a sign-up form should require the person to confirm their address before any further sending.
  • Separate your streams: a domain or subdomain dedicated to transactional email protects these essential messages from the ups and downs of other uses.
  • Remove addresses that bounce and never retry them. With Duva, a bounce caused by the address itself adds it to the domain's suppression list, and a complaint suppresses it too; a reputation or content block (5.7.x) does not (see the API reference).
  • Listen to complaints: a rising rate points to a problem of content, frequency or consent, to fix at the source.

Monitoring

Three tools, at no extra cost:

  • Your sending service's events: bounces, complaints, deferrals. Duva exposes them through the API, by webhook and in the dashboard.
  • Google Postmaster Tools, free, once your domain is verified: it shows the reported spam rate, authentication and delivery errors to Gmail.
  • Your own statistics: a bounce or complaint count that doubles from one week to the next deserves attention before a provider takes care of it for you.

Duva's terms measure complaints and bounces, per account and per domain, from 100 accepted emails: a complaint rate of 0.10% triggers an alert (written notice and time to fix), and a rate of 0.30% is critical. For bounces, the alert is at 5% and the critical threshold at 10%. These thresholds protect the IP addresses shared by all customers; a lower rate is not a guarantee, because a provider may tolerate less than these thresholds.

Recovering a damaged reputation

There is no button. Providers judge over time, and Google notes that improvements take time to show. The safest sequence:

  1. Stop the cause: stop writing to addresses that bounce, remove what generates complaints, close an open form.
  2. Reduce volume until the errors stop, then raise it slowly, as Google recommends.
  3. Send first to the most engaged people: those who open, click and do not report.
  4. Check authentication and fix what is missing.
  5. Wait. One clean week does not replace months of history.

A checklist

  • My sending domain has SPF, DKIM and DMARC in place.
  • I write only to confirmed addresses.
  • I remove any address that bounces permanently.
  • My volume rises in steps, not jumps.
  • I look at my complaints and bounces every week.
  • My transactional emails are separate from everything else.

This article is general information, not a guarantee: no service can promise that your emails will reach the inbox.

Sources