Reputation and warm-up: earning the trust of mailbox providers

Reputation is the score each mailbox provider assigns to a sending IP address and to a sending domain, based on the history of traffic it has received from them. It decides whether a message is accepted, throttled, placed in the inbox or sent to spam. Warm-up is the period during which a new IP or domain builds that reputation by increasing its volume gradually.

What mailbox providers measure#

Every provider computes its own reputation, which it does not share, from signals it observes directly:

• Complaints: the share of recipients who report the message as junk. This is the heaviest signal. Since 2024, Google and Yahoo require a rate below 0.3%.
• Invalid addresses: a high rate of 550 5.1.1 User unknown reveals an old, purchased or never-cleaned list.
• Spam traps: addresses that never subscribed to anything. A single delivery to a trap run by a major provider can be enough to damage an IP's reputation.
• Engagement: opens, replies, moves to a folder, additions to the address book, and conversely deletion without reading. These signals weigh more every year and are specific to each provider.
• Authentication: SPF, DKIM and DMARC aligned with the visible domain. Unauthenticated traffic can no longer build domain reputation.
• Infrastructure consistency: reverse DNS, TLS, EHLO name, and the stability of IPs and domains over time.

Reputation comes in two kinds. IP reputation belongs to the infrastructure and is shared among every sender using that address. Domain reputation follows the DKIM signing domain and the From domain: it travels from one provider to the next and, since DMARC became widespread, it is the one that counts most with the large mailbox providers.

Why warm-up is necessary#

From a provider's point of view, an IP with no history is indistinguishable from a compromised machine that has just started emitting. Providers therefore apply strict limits to unknown senders: a few hundred messages a day are accepted, the rest is deferred with a 421 or 451 code. A sender pushing 500,000 messages on day one will see almost all of them deferred and then, if the MTA insists, blocked.

Warm-up means sending a little at first, to the most engaged recipients, and roughly doubling the volume every two or three days as long as the indicators stay healthy. An indicative schedule for a dedicated IP:

The schedule is split per provider: each one judges the IP independently, and a volume Microsoft accepts may be deferred by Gmail the same day. It then adapts to the replies: a spike in 4xx codes or a rise in complaints calls for a pause of a day or two at the previous volume.

Warming up a domain follows the same logic but usually takes longer, because providers wait to see engagement signals over several weeks. A new domain on an already reputable IP is still a new domain.

What to check during and after#

• The rate of 4xx and 5xx replies per provider in the MTA logs, every day.
• The complaint rate from feedback loops and Google Postmaster Tools.
• The invalid address rate, which should stay below 1 to 2%.
• Placement: a drop in opens at one specific provider, at constant volume, signals a move to the spam folder that the MTA cannot see.
• DMARC alignment on every message, so that the effort benefits the domain and not only the IP.
• Regularity: a reputable IP that stops sending for a month is back to almost zero.

Common mistakes#

• Starting the warm-up with the least active contacts or a list that was never mailed, which produces complaints from day one.
• Ignoring 4xx codes and letting the MTA retry aggressively.
• Switching IP or domain after every incident, hoping for a clean slate: providers correlate DKIM signatures, content, links and neighbouring IP ranges.
• Mixing transactional mail and bulk marketing on the same IP, or a clean customer and a dubious one.
• Confusing reputation with the absence of DNSBL listings: an IP can be on no list at all and still land in spam every time.
• Assuming reputation is earned once and for all: it is recomputed continuously, and a single badly targeted campaign can undo months of work.

Further reading#

Tracking a domain's reputation day after day, provider by provider, means cross-referencing MTA logs, DMARC reports, feedback loops and the providers' own tools. Postmastery describes this approach to monitoring a sending domain for teams that run their own infrastructure.