Sender Reputation the score that decides inbox or spam

What goes into the score

Each mailbox provider keeps the exact formula private and weights the inputs differently, but the main signals are well understood. They cluster into four buckets.

Engagement signals (the loudest input on Gmail and Yahoo)

Opens, clicks, replies, and "move to inbox" actions are positive. Deletes without open, "mark as spam", and "unsubscribe" are negative. Gmail in particular leans heavily on this bucket because it's the cleanest proxy for "does this recipient actually want this email". Spam complaint rate over 0.1% starts hurting you. Over 0.3% is a hard ceiling that mailbox providers treat as a problem they need to solve.

Hygiene signals

Hard bounce rate (target below 0.5%) tells the provider whether you maintain your list or just blast at scraped addresses. Spamtrap hits (recycled traps that used to be real users, or pristine traps that have never been real) are catastrophic for reputation because they prove your list isn't permission-based. One pristine trap hit can drop you a reputation tier overnight.

Authentication signals

Did the message pass SPF? Did DKIM verify? Did DMARC alignment succeed? Authentication is a binary input but it's table stakes. A domain without a published DMARC policy or with consistent SPF failures will struggle to ever build positive reputation, no matter how good the engagement looks.

Consistency signals

Sudden volume changes are penalized. A domain that sent 5,000/day for six months and then sends 50,000 in one day reads to mailbox providers as "compromised account or new spam operator". This is why IP warmup exists, and it's also why aggressive scaling on an established domain can torch reputation just as fast as a poorly-warmed new IP.

Domain reputation vs IP reputation

Both exist, both matter, both can be damaged independently. Domain reputation moves with the sending identity (the visible From domain and the DKIM signing domain). IP reputation moves with the connecting IP that handed off the message to the receiving server. On a dedicated IP, the two move together. On a shared IP pool, your domain reputation can be clean while the IP gets polluted by someone else's bad sending, and vice versa.

Modern mailbox providers (post-2020 or so) weight domain reputation more than IP reputation, because domains are harder to rotate than IPs. If a sender has a bad domain reputation, they can't just buy new IPs and start over. This shift is part of why "warming up an IP" is necessary but no longer sufficient. The domain attached to the sending behavior is what carries the long-term trust.

How to actually move the number

In order of impact:

• Send only to people who opted in. Permission is the foundation. Bought, scraped, or appended lists are the single fastest way to destroy reputation.
• Remove unengaged subscribers. Recipients who haven't opened in 6+ months are dragging your engagement score down. Suppress them, or move them to a quarterly re-engagement track.
• Authenticate cleanly. Published SPF, valid DKIM signatures aligned with the visible From, and a DMARC policy in monitoring or enforcement mode.
• Ramp volume gradually on new domains and new IPs. Doubling daily volume is usually safe; quadrupling is risky; 10x is almost always punished.
• Watch the bounce rate. Above 0.5% hard bounces tells you your list hygiene is broken before the mailbox provider tells you the same thing more expensively.
• Take complaints seriously. A complaint is worth roughly 100 unopened emails of reputation damage. Make the unsubscribe link easy. The marginal recipient who would otherwise click "mark as spam" is more valuable as a clean unsubscribe.

How to measure where you stand

Two free signals worth checking weekly. Gmail's Postmaster Tools dashboard shows your domain and IP reputation in four buckets (Bad, Low, Medium, High) plus your spam rate. Outlook's Smart Network Data Services (SNDS) reports IP-level data for the Microsoft mailbox ecosystem. Neither covers every provider, but together they cover roughly 70% of business email recipients in most regions.

The Cortex engine on sendmsg.io tracks a continuous temperature (0–100) per domain and per IP, sampled every 30 seconds against the live event stream from the sending pipeline. When the temperature dips below a threshold, the system applies graduated throttle controls automatically. The point is that you don't have to find out you're in trouble from Gmail's bucket flipping to Low three days later, by which time the damage is done.