The Mechanics of Domain Reputation: How Gmail Builds Sender Scores

• July 2023
• Engineering Memo · External Release

Gmail's domain reputation system is the single most important sender scoring mechanism in email deliverability — it affects inbox placement for more recipients than any other ISP signal in most B2C and B2B sending programmes. It is also widely misunderstood, because Gmail publishes domain reputation data through Postmaster Tools at a category level (High, Medium, Low, Bad) that obscures the continuous numeric scoring that underlies it.

This note documents the known mechanics of how Gmail builds and updates domain reputation scores, what signals drive each reputation tier, how the scoring interacts with IP reputation, and what operators can and cannot influence through infrastructure and sending practice decisions. It is written from observational experience across hundreds of managed sending environments, not from Gmail's proprietary documentation — which does not exist publicly at this level of detail.

Domain Reputation vs. IP Reputation: The Gmail Priority

Gmail evaluates both domain reputation and IP reputation for every incoming message, but they do not have equal weight. Domain reputation — tied to the authenticated sending domain (the From: domain after DMARC alignment) — is the primary signal that determines long-term inbox placement trajectory. IP reputation provides a short-term modifier that can help or hinder delivery for a new domain but becomes less significant as domain reputation history accumulates.

The practical implication: a domain with High reputation that sends from a newly warmed IP will deliver to inbox reliably, even while the IP is still accumulating reputation history. Conversely, a domain with Medium or Low reputation that sends from a well-established, clean IP will still experience elevated spam classification, because the domain signal overrides the IP signal. Operators who focus exclusively on IP reputation management while neglecting domain reputation management are working on the secondary signal.

Domain reputation at Gmail is permanently tied to the authenticated domain — the organizational domain (eTLD+1) from which DMARC-aligned DKIM signatures or SPF authentication passes. Changing sending IPs, switching ESPs, or migrating to new infrastructure does not reset domain reputation. This is both a feature and a constraint: senders with strong domain reputation carry that reputation across infrastructure changes, but senders with damaged domain reputation cannot escape the damage by changing infrastructure.

The Signals That Drive Domain Reputation

Gmail's domain reputation model weights multiple signal types, and the relative importance of each is not publicly documented. The following is based on observed behavior across managed environments — what we have seen move domain reputation in specific directions, consistently, across multiple clients.

Complaint rate is the most directionally impactful short-term signal. When recipients at Gmail mark a message from a domain as spam, the complaint is attributed to the authenticated domain. Sustained complaint rates above 0.08% produce visible reputation deterioration in Postmaster Tools within 2–4 weeks. Complaint rates above 0.15% produce deterioration within 1–2 weeks. The relationship is not linear — the same absolute complaint rate affects a domain with High reputation less severely than a domain at the High/Medium boundary, because reputation inertia provides some protection for established senders.

Engagement rate — specifically the percentage of delivered messages that are subsequently opened or clicked by the recipient — is the primary positive signal that builds and maintains domain reputation. Gmail observes whether recipients interact with messages (open, click, reply, move to inbox from spam, add sender to contacts) and incorporates this engagement history into domain scoring. A domain where recipients consistently engage with messages accumulates positive reputation signals that provide a buffer against occasional complaint spikes. A domain where recipients rarely engage is more vulnerable to complaint-driven reputation deterioration because it lacks the positive signal baseline.

Authentication quality — DKIM signature strength, DMARC policy level, and SPF alignment — contributes to domain reputation through Gmail's authentication scoring. A domain that consistently sends with aligned DKIM signatures using 2048-bit keys and has a DMARC policy at p=quarantine or p=reject receives a higher authentication trust score than a domain at p=none or with 1024-bit DKIM keys. This authentication score is a positive contribution to domain reputation; authentication failures are negative contributions. Since 2024, authentication quality has increased in weighting as Gmail has formalized its bulk sender authentication requirements.

Sending pattern consistency is a less-discussed but operationally significant signal. Gmail's reputation model observes the historical pattern of sending from a domain — the volume range, timing patterns, and recipient overlap across campaigns. Domains that send within consistent volume ranges at consistent timing patterns accumulate stable reputation signals. Domains that send erratically — one week's volume being 10× the previous week's, or sends clustered at unusual times — generate pattern anomalies that the reputation model treats with increased scrutiny. This is not a primary signal, but it amplifies the impact of other signals during anomalous periods.

How Domain Reputation Updates

Gmail's domain reputation is not updated in real time — Postmaster Tools displays data with a 24–48 hour lag, and the underlying reputation model itself applies smoothing that prevents single-campaign events from immediately producing tier changes. The smoothing creates the lag between when a problem starts and when it becomes visible in Postmaster Tools — and conversely, the lag between when a problem is fixed and when the improvement appears in Postmaster Tools data.

The practical monitoring implication: Postmaster Tools domain reputation should be reviewed daily, and trends should be evaluated over 7-day windows rather than day-over-day. A one-day decline from High to Medium may reflect a single bad campaign the previous day; a consistent 7-day trend from High toward Medium indicates a structural sending practice problem. The 7-day trend is the actionable signal; individual-day fluctuations within the same tier are informational at most.

Domain reputation recovery after a deterioration event follows a slower timeline than the deterioration itself — this asymmetry is consistent with how ISP reputation systems are generally designed. A domain that deteriorates from High to Low over three weeks of elevated complaint rates may require 8–12 weeks of clean sending to return to High, even after the underlying problem is corrected. The recovery requires building sufficient positive engagement signal volume to outweigh the accumulated negative signals, and the smoothing model applies the same lag to positive signal accumulation as to negative.

What Infrastructure Can and Cannot Control

Domain reputation is built and damaged by sending behavior, and sending behavior is the intersection of infrastructure configuration and campaign decisions. Infrastructure controls the authentication quality (DKIM key strength, DMARC policy level, SPF alignment), the FBL complaint processing speed (which affects how quickly complainants are suppressed), the bounce handling (which affects how quickly invalid addresses are removed from the active list), and the retry configuration (which affects whether an ISP perceives the sender as aggressive).

What infrastructure cannot control: the content of campaigns (which affects complaint probability), the quality of the list (which determines the baseline complaint and engagement rates), the frequency of sends (which affects fatigue-driven complaints), and the targeting decisions (which determine whether highly engaged or marginally engaged contacts receive each campaign). The intersection of infrastructure decisions and campaign decisions determines domain reputation outcomes — one without the other is insufficient.

The practical collaboration implication: deliverability management requires input from both the infrastructure team and the marketing operations team. The infrastructure team ensures that authentication is correct, FBL processing is real-time, and bounce handling is immediate. The marketing operations team ensures that list quality is maintained, send frequency is calibrated to engagement levels, and new list segments are validated before integration into the main sending programme. When either side operates in isolation from the other, the resulting domain reputation reflects the weakest link.

The Relationship Between Domain and Subdomain Reputation

Gmail's domain reputation system operates at the organizational domain level (eTLD+1) — the root domain without subdomain prefixes. Reputation signals from mail.yourdomain.com, newsletter.yourdomain.com, and marketing.yourdomain.com are all attributed to yourdomain.com in Gmail's scoring model. This means that separate subdomains for different traffic types do not create separate domain reputation histories — they all contribute to the same organizational domain score.

This has a significant implication for the domain separation strategy recommended for traffic isolation: separate subdomains provide IP-level isolation and authentication record separation, but they do not provide domain reputation isolation at Gmail. If newsletter.yourdomain.com generates elevated complaint rates, those complaints affect the yourdomain.com domain reputation score, which in turn affects the inbox placement of mail.yourdomain.com transactional sends. True domain reputation isolation at Gmail requires separate organizational domains — yourcompany-marketing.com rather than newsletter.yourcompany.com.

The operational decision of when domain reputation isolation is worth the cost of maintaining a separate domain depends on the risk level of the traffic type. For cold email outreach — which routinely generates complaint rates 3–10× higher than opted-in marketing email — a separate organizational domain is essential to protect the primary brand domain's reputation. For marketing email to a high-quality, well-maintained opted-in list, subdomain separation with proper IP isolation is typically sufficient. For re-engagement campaigns to lapsed subscribers — which sit between these risk levels — the decision depends on the programme's volume and the company's tolerance for domain reputation risk.

Reading Postmaster Tools Data Correctly

Gmail Postmaster Tools provides domain reputation data through two views: domain reputation (the four-tier classification described above) and spam rate (the percentage of Gmail-delivered messages that were marked as spam by recipients). Both are useful but measure different things, and combining them provides more diagnostic value than either alone.

The spam rate view is more granular than the domain reputation view — it shows daily data that can be correlated with specific campaign dates. When the spam rate spikes on a specific date, that spike can be traced to campaigns that sent on that date or the 48 hours before (accounting for the Postmaster Tools data lag). The domain reputation view shows the aggregate classification level, which changes more slowly and reflects the cumulative effect of the spam rate trend over time.

Reading Postmaster Tools data correctly requires understanding the volume thresholds: Gmail only shows domain reputation and spam rate data for domains that send a minimum volume of messages per day to Gmail addresses. For low-volume senders, Postmaster Tools may show no data or show "Whitelisted" as the reputation classification, which means the domain has not accumulated enough sending history for Gmail to assign a category. The absence of data in Postmaster Tools is not confirmation of good reputation — it is confirmation of insufficient volume for the reputation model to score.

A common misinterpretation: a domain that was recently at High reputation and then shows "Not enough data" after a period of reduced sending has not improved its reputation — it has sent too little for the reputation model to update. When volume resumes above the threshold, the previous reputation signals re-emerge in the classification. Operators who interpret the "no data" period as a reset are surprised when reputation deterioration that preceded the low-volume period re-appears when they resume full volume sending.

The New Sender Domain Warmup at Gmail

A new sending domain — one that has never sent to Gmail addresses at scale — starts with no reputation in Gmail's model. The reputation system does not default to neutral for new domains; it defaults to increased scrutiny. The first sends from a new domain are evaluated more carefully than subsequent sends from an established domain, because Gmail has no historical engagement data to use as a baseline for classifying the new domain's traffic.

This increased scrutiny for new domains means that the warmup process for a new sending domain requires more patience than the warmup for a new IP address. The IP can be warmed in 4–8 weeks by sending progressively higher volumes. The domain requires 8–12 weeks of clean, engaged-list sending to establish enough reputation signal for the classification system to assign a reliable tier. During this period, even clean sending to a highly engaged list may produce spam classification rates of 3–8% — not because the list or content is problematic, but because the domain reputation model has insufficient history to confidently classify the domain's traffic.

The practical warmup sequence for a new sending domain: weeks 1–3, send to the top 10% of the engaged list by recency (30-day openers). Volume should start at 2,000–5,000 messages per day and scale by no more than 30% per week. Weeks 4–6, expand to the top 25% of the list. Weeks 7–10, expand to 50%. Full volume expansion should begin only after Postmaster Tools shows a stable Medium or High reputation classification, which typically appears in week 8–10 for a clean, engaged list. A domain that reaches High reputation in week 8 can accelerate the remaining volume ramp more aggressively than the 30% per week guideline suggests — but should maintain Postmaster Tools monitoring daily through the acceleration phase.

Domain Reputation as a Strategic Asset

A domain with High reputation at Gmail is a strategic asset that has economic value. The inbox placement differential between High and Medium reputation represents millions of additional impressions per year for high-volume senders. The stability of High reputation — its resistance to degradation from individual campaign events — accumulates over years of consistent clean sending. This stability is more valuable than the current placement advantage, because it means that occasional mistakes (a single campaign with elevated complaint rates, a brief authentication misconfiguration) do not produce immediate placement damage.

Protecting this asset requires treating every sending decision as a reputation asset allocation. High-risk sending — reactivation campaigns to lapsed subscribers, new list import testing, sends to segments with unknown engagement history — should be routed through traffic isolation designed to minimize exposure to the primary domain's reputation. The primary sending domain's reputation is protected by routing risky traffic through alternative domains or subdomains where the exposure is limited.

The long-term perspective: a domain that has maintained High reputation for three or more years has accumulated a reputation buffer that provides meaningful protection against the inevitable occasional adverse event. A domain that is chronically at Medium reputation has no buffer — a single bad campaign can push it to Low. The operational strategy of consistently prioritising domain reputation maintenance, even at the cost of short-term campaign reach, produces compounding returns in the form of increasingly stable, high-quality inbox placement over time.

How Gmail Reputation Interacts with DMARC Policy

DMARC policy level — p=none, p=quarantine, p=reject — interacts with domain reputation in ways that are not documented by Gmail but are consistently observable in production. A domain with p=reject DMARC policy and High reputation delivers messages that fail DMARC authentication directly to spam, with no inbox delivery exception. This is by design: DMARC p=reject instructs receiving servers to reject (or quarantine) unauthenticated messages, and Gmail complies. The domain reputation score does not override DMARC policy instructions.

The implication for infrastructure design: escalating DMARC policy from p=none to p=quarantine or p=reject must be done only after authentication coverage is verified to be complete across all sending sources. A domain with High reputation that escalates DMARC policy without first identifying and authenticating all legitimate mail streams will find that previously high-reputation messages from unidentified sending sources suddenly fail to deliver — not because domain reputation declined, but because DMARC policy now enforces rejection that was previously only monitored.

The correct sequence for DMARC escalation: (1) deploy DMARC at p=none with RUA aggregate reporting to a monitored mailbox; (2) review DMARC aggregate reports weekly for 4–8 weeks, identifying all sending sources appearing in the reports; (3) authenticate each identified sending source with aligned SPF or DKIM; (4) confirm in aggregate reports that alignment pass rates are above 98% across all sources; (5) escalate to p=quarantine; (6) monitor for 4 weeks; (7) escalate to p=reject. This sequence typically takes 3–6 months but produces a stable p=reject deployment that does not disrupt legitimate mail streams and contributes positively to domain reputation.

DMARC aggregate report analysis is a domain reputation maintenance tool, not just a compliance exercise. By reviewing which sending sources are appearing in DMARC reports, operators identify authentication drift — legitimate services that were previously authenticating correctly but have since changed their infrastructure in ways that broke alignment. Catching and correcting authentication drift through DMARC reporting prevents the domain reputation degradation that would otherwise result from sustained authentication failures from those sources. Operators who configure DMARC at p=none and never review the aggregate reports are leaving the primary value of DMARC — its diagnostic capability — unused.

The infrastructure that supports strong DMARC compliance — consistently sending with aligned DKIM signatures from all sending sources, correct SPF configuration for all authorized sending IPs, and PTR records that match EHLO hostnames — is the same infrastructure that contributes to High domain reputation at Gmail. The overlap is not coincidental: Gmail's authentication quality signal and DMARC compliance are measuring the same underlying property — whether the organization sending the email is operating sending infrastructure that meets the technical standards that distinguish legitimate senders from bad actors. Investing in authentication infrastructure quality is simultaneously a compliance investment, a domain reputation investment, and an inbox placement investment. The returns on each compound over time.

Gmail domain reputation is a composite signal built from complaint rate, engagement rate, authentication quality, and sending consistency. It is attributed to the organizational domain, not the subdomain or IP address. It updates with a 24–48 hour lag and recovers more slowly than it deteriorates. Infrastructure manages the authentication quality and complaint processing speed dimensions; campaign decisions manage the complaint rate and engagement rate dimensions. The complete picture requires both — and the operators who understand and manage both consistently produce the best long-term inbox placement outcomes for their sending programmes.