How do you recover a damaged sender reputation?

A damaged sender reputation shows up as mail in spam folders, deferrals and outright rejections, often at several mailbox providers at once. Recovery is a sequence, not a single fix, and doing it out of order wastes time. This plan pulls together what Google, Yahoo, Microsoft and Apple tell senders at the time of writing (November 2026) into six phases you can follow.

How do you recover a damaged sender reputation?

You recover sender reputation by removing the cause first and then proving, over weeks of steady mail, that recipients want what you send. Sender reputation is the trust mailbox providers place in mail from your domain and sending IPs, built from complaints, bounces, authentication and engagement. Our guide to what sender reputation is explains how it's calculated; this guide is the repair plan.

The phases, in order:

1. Stop the damage.
2. Find the cause.
3. Fix authentication and infrastructure.
4. Clean your list.
5. Rebuild volume slowly.
6. Request delisting and mitigation.

Spamhaus describes the stakes well: "It is much, much easier to drive reputation down than it is to fix a damaged one" (Spamhaus). Plan for recovery to take weeks, not days.

How do I know my sender reputation is damaged?

The clearest signs are new bounce codes that mention reputation, complaints or rate limits, and a drop in replies or clicks from one provider. Check each provider separately, because reputation is tracked per receiver.

If only one provider complains, focus there. If all of them do at once, suspect a compromised account or a bad list import, because those affect everyone.

Phase 1: How do I stop the damage?

Pause bulk and marketing mail as soon as you see a reputation problem. Every campaign sent while reputation is falling adds complaints and bounces that make recovery longer. Keep essential mail, such as invoices and password resets, flowing at normal volume, and keep an eye on whether it's affected too.

Then check whether someone else is sending as you:

• Compromised mailboxes. Look for accounts with unusual sent volume, new inbox rules or sign-ins from unexpected places. See signs an email account is compromised. In Microsoft 365, an account caught sending spam may already be blocked from sending.
• Website forms and scripts. A contact form abused by bots can send thousands of messages from your server.
• Your mail queue. Yahoo's error page tells senders whose servers don't primarily send bulk mail to "examine your outbound queues" for abuse, and for unknown-recipient errors warns your server "may be an open relay or open proxy."

If you find a compromise, contain it first: reset the password, revoke sessions, remove malicious rules and stop the script. Nothing else in this plan works while spam is still leaving your systems.

Phase 2: How do I find the cause?

Match the evidence to a cause before you change anything. The bounce codes and the timing usually point to one of these.

Spam traps deserve a mention. They're addresses that never signed up for anything, or old addresses that a provider has reclaimed, so mailing them shows your list contains addresses nobody gave you consent for. Our guide to spam traps covers the types.

DMARC aggregate reports are useful here. They show every server sending mail as your domain and whether it passes. Open a week of reports in the DMARC Report Analyzer and look for unknown sources and failing services; see unknown sources in DMARC reports.

Phase 3: How do I fix authentication and infrastructure?

Make sure every message you send can prove where it came from. Mailbox providers now require it, and failed authentication on legitimate mail looks the same as spoofing to a receiver.

1. SPF lists the servers allowed to send for your domain. Include every service you use, keep one record and stay under 10 DNS lookups; see SPF too many DNS lookups.
2. DKIM signs each message with your domain. Turn it on for every sending service, with your own domain rather than the provider's.
3. DMARC ties them to your From address. Publish at least p=none with reporting, then tighten it; our DMARC none to reject plan shows the steps.
4. Reverse DNS (a PTR record) must exist for any IP you run yourself. Yahoo says it's "more likely to downgrade an IP's sending reputation if there isn't a reverse DNS entry."
5. TLS encryption for outbound connections, which Google requires for all senders to Gmail.
6. One-click unsubscribe for marketing mail, using the List-Unsubscribe and List-Unsubscribe-Post headers; see one-click unsubscribe.

Check everything at once with the Email Health Check, then send a real message to the Deliverability Test to confirm SPF, DKIM and DMARC pass on actual mail.

Phase 4: How do I clean my list?

Remove every address you shouldn't be mailing before you restart. Providers measure complaints and bounces as a share of what you send, so a smaller, cleaner list recovers faster than a large, stale one.

• Remove hard bounces. Yahoo says list managers should remove addresses that produce 5xx errors. Our hard vs soft bounce guide explains which codes mean "remove."
• Remove purchased, rented or scraped addresses. Google says "don't purchase email addresses from other companies," and Apple's postmaster page asks for mail only to recipients who "explicitly subscribed."
• Suppress complainers. Anyone who reported you through a feedback loop should never receive marketing mail again.
• Set aside unengaged recipients. Apple recommends you "periodically suppress inactive or disengaged subscribers from your mailing list." Define inactive by clicks, replies, purchases or log-ins, not opens alone, because Apple's Mail Privacy Protection loads content in the background.
• Never re-add unsubscribed addresses. Apple lists this explicitly.

Going forward, use confirmed (double) opt-in for new subscribers. Microsoft's sender troubleshooting page recommends it, so that "no one can claim that they unintentionally signed up."

Phase 5: How do I rebuild sending volume?

Restart small and grow slowly, sending first to the recipients most likely to want your mail. Google's sender guidelines put it simply: "Start with a low sending volume to engaged users, and slowly increase the volume over time," and avoid "sudden volume spikes if you do not have a history of sending large volumes."

A practical approach:

1. Start with recipients who clicked, replied or bought recently.
2. Send at a steady rate spread through the day, not in one burst.
3. Increase volume only when the previous sends showed no new deferrals, complaints or bounces. Spamhaus advises that "increasing rates of volume and speed should depend on the results of each previous deployment."
4. Watch each provider separately. If Gmail is fine but Yahoo defers, slow down for Yahoo only.
5. Add older segments last, and suppress anyone who doesn't engage.

This is the same discipline as warming up a new domain; our email warm-up guide has more detail. Microsoft says a new IP can be "fully ramped within a couple of weeks or less depending on volume, list accuracy, and junk email complaint rates." That figure is about new IPs. Our inference, not Microsoft's statement, is that recovery at Microsoft can take a similar time once the cause is gone.

Phase 6: How do I request delisting and mitigation?

Ask providers for help only after phases 1 to 5 are under way. Requests from senders who haven't fixed the cause tend to be refused, and Google says so directly: senders who fail to follow best practices "may not be considered for deliverability mitigations."

The details for each are in our guides to Gmail blocking emails from your domain, Yahoo Mail blocking emails, Outlook.com deliverability, iCloud Mail deliverability, the 550 5.7.606-649 reference and blocklist removal.

How long does sender reputation recovery take?

No provider publishes a recovery timeline, and anyone who promises one is guessing. A few documented markers help you plan:

• Gmail needs your spam rate below 0.3% for 7 consecutive days before you're eligible for mitigation, and Postmaster Tools' compliance view uses a rolling average, so fixes can take days to appear.
• Microsoft says a new IP can be fully ramped "within a couple of weeks or less." That is about warming new IPs, not recovery, so treat it as a rough guide only (our inference).
• Microsoft also says throttling from suspicious activity is lifted after it evaluates the messages and determines "everything is OK."

In practice, authentication fixes take effect quickly, while complaint and engagement history improves only as you send good mail over several weeks.

Should I switch domains or IPs instead?

Usually not. Starting fresh feels faster, but a new domain or IP has no history, and Microsoft notes that mail from new sources is "more likely to experience delivery issues." You'd be warming up from zero, and if the cause wasn't fixed, the new domain is damaged in turn.

There are legitimate reasons to separate mail streams, though. Google recommends using "a different IP address for each message type" if you send from several IPs, and Apple asks senders to separate marketing from transactional mail. Moving marketing to its own subdomain protects invoices and password resets from future campaign problems; see separate subdomains for transactional and marketing email.

Next steps

• Pause campaigns and check for compromised accounts today.
• Run the Email Health Check and the Blacklist Checker to see where you stand.
• Open your DMARC reports in the DMARC Report Analyzer to find unknown senders.
• Clean your list, then rebuild volume to engaged recipients over the following weeks.
• Request mitigation or delisting only after the fixes are in place.
• Phishing that leads to a hacked mailbox is a common root cause. iBlockSpam filters inbound mail at the MX level for each domain; see how it works.

Browse more guides on running email day to day.