Cold Email Domain Reputation: How to Build and Protect It

Domain reputation is the single asset that decides whether cold email lands in the inbox or the spam folder. At MailDeck we maintain 98% inbox placement across 1,200+ domains and 833.9K+ inboxes, and the difference between a domain that hits that number and a domain that collapses into the spam folder comes down to the reputation the domain has already earned with the receiving server. Google shifted to domain-based reputation as its primary inbox-placement signal in 2024, which means the domain in your From address now carries more weight than the IP behind it for most cold email.

This guide explains how sender and domain reputation actually work at the protocol and infrastructure level, how to build reputation on a fresh domain in the shortest safe window, and how to protect it once you are sending at volume. Every number here comes from MailDeck platform data: a DNS audit of 1,000+ domains, burn-rate data across enterprise accounts, and warmup protocols measured across all three infrastructure types we run.

What Domain Reputation Actually Is

Domain reputation is a trust score that each receiving server (Gmail, Outlook, Yahoo, and every corporate mail gateway) attaches to the domain in your From address. It is separate from IP reputation. IP reputation attaches to the server that physically transmits the message. Domain reputation attaches to the name your recipient sees. That sending-domain trust layer determines placement before a single word of your copy is evaluated.

The distinction matters because of how MailDeck infrastructure is built. Microsoft 365 Outlook inboxes send from official Microsoft Azure IP pools, and Google Workspace inboxes send from official Google IP pools. Both are whitelisted by default across virtually every receiving server on earth because billions of legitimate emails flow through them daily. On those two products the IP is already bulletproof, so the entire risk sits on the domain. Private SMTP is the exception. It runs a dedicated IP per client with no built-in trust, so on SMTP the IP reputation is built from scratch alongside the domain and both move together.

Receiving servers compute domain reputation from a handful of measurable inputs:

Every input on that list is something you control before the first cold send. Reputation is the sum of decisions made during authentication, warmup, and the first two weeks of sending.

Why Most Domains Start With a Reputation Handicap

Most cold email domains sabotage their reputation before they send a single email, and the failure is almost always in DNS. Our audit of 1,000+ domains found that 67% had at least one critical authentication error live in production. That is two out of every three domains starting from a suppressed reputation baseline.

Here is the full frequency breakdown from that audit, ranked by how often each error appeared:

Each of these has a direct reputation cost. Multiple SPF records cause a permerror, and many receivers treat a permerror as an outright SPF failure. An SPF record ending in +all tells the world that any server may send as your domain, which spam filters read as either negligence or compromise. A domain stuck on DMARC p=none is publishing a policy that says "do nothing" when authentication fails, so it gains none of the reputation benefit a real enforcement policy provides.

Since February 2024, Google and Yahoo require bulk senders to authenticate with both SPF and DKIM and to publish a DMARC record. A domain that fails those requirements gets filtered before reputation is even evaluated. This is why MailDeck automates SPF, DKIM, and DMARC configuration for every domain during onboarding and verifies end-to-end authentication and DNS propagation before any email is sent, which is a direct contributor to the 98% inbox placement figure. For the full record-by-record setup and the exact syntax that avoids all ten of these errors, see the SPF, DKIM, DMARC cold email guide.

How to Build Domain Reputation on a Fresh Domain

Building domain reputation is a sequential process, and the sequence cannot be shortcut. A fresh domain has no history, so the receiving server has no basis to trust it. Every action in the first month is a deposit into that trust account. Send too fast and you overdraw before the account has a balance.

Step 1: Authenticate before the first send

Configure SPF, DKIM, and DMARC correctly and verify propagation before any warmup email leaves the domain. This is the gate. If authentication is wrong, nothing downstream matters because the server discounts the traffic regardless of how clean it is. Publish DMARC with an enforcement policy and a valid rua address so you receive aggregate reports.

Step 2: Warm up the mailboxes

Warmup is the process of sending small volumes of engagement-rich mail (opens, replies, moves out of spam) to build sending history before cold traffic starts. Warmup time varies by product and tracks how much built-in IP trust each one carries. Our measured warmup windows across the platform:

During warmup, ramp the daily volume by 2-3 emails per day and target a 30-35% reply rate inside the warmup pool with 15-25% randomization. One critical warning: a bad warmup pool is worse than no warmup. Some warmup networks send low-quality traffic that receiving servers already distrust, which actively drags reputation down. Use only trusted pools such as Smartlead Premium, Instantly, or Pipl.ai. For the full protocol on which warmup settings actually move reputation versus which ones waste time, see what actually works for cold email warmup.

Step 3: Start cold sends slow with tight intervals

When the first cold email goes out, open at 3-5 sends per inbox per day even on products that can eventually handle more. Enforce a minimum 61-minute interval between sends on any single inbox and keep 15-25% randomization on timing and volume. Bursty, evenly-spaced, high-volume sending is the pattern that spam filters are tuned to catch. Reputation is built by consistent low-volume sending with real engagement, so the goal in week one is a steady trickle that generates replies.

Step 4: Protect list quality from day one

The fastest way to destroy a freshly built reputation is a dirty list. A single send to a stale list can push bounce rate past 7% in one batch, which flips the domain from building reputation to burning it. Verify every list before sending, match copy rules to the inbox type, and keep complaint rate under 0.3%. Outlook inboxes in particular pre-scan content with Defender and Safe Links, so links in body copy, open tracking pixels, and financial language spike spam detection and pull reputation down.

Step 5: Monitor and hold a reserve

From the first cold send, watch reputation daily and keep 20-25% of your domain capacity in warm reserve. Reputation moves faster in the wrong direction than the right one, and the reserve is what lets you rotate a struggling domain out before it damages the wider account.

The Send Volume Math That Protects Reputation

Volume per domain is the lever most senders get wrong, and it is measurable. Reputation stays healthy when volume is spread across enough domains that no single one carries a suspicious load. The safe ceiling depends on inbox type and how many inboxes sit on each domain:

The counterintuitive result is that Outlook wins on volume per domain (100 inboxes each sending a small amount) while Google wins on deliverability per send. A single Outlook domain absorbs roughly 18,000 sends a month across 100 inboxes, each individually looking like a low-volume human sender. A single Google domain caps near 2,000 a month but earns the highest trust score of any provider. The mistake that burns reputation is pushing 300 sends a day through one mailbox instead of spreading that same 300 across many inboxes and domains.

This is also why infrastructure diversification protects reputation. Running a mix of Outlook, Google, and SMTP domains means no single provider or reputation model carries the entire operation, and a problem on one layer does not take down the others.

How to Protect Domain Reputation at Scale

Building reputation is a one-time cost. Protecting it is continuous, because at volume, reputation is always under load. At enterprise scale (100K+ emails per month), 10-20% of domains burn every single month. That is the expected operating cost of running cold email at volume, and the teams that survive plan for it in advance.

A domain under active load has a usable lifespan of 45 days to 2 months before its reputation degrades enough to warrant rotation. The burn is caused by cumulative complaint signals, engagement decay as a list gets over-mailed, and the natural tightening of spam filters. These are the four thresholds we treat as burn signals, any one of which triggers action:

The defense against burn is a warm reserve. Keep 20-25% of your active domain count sitting warmed and idle. When a domain crosses a threshold, you rotate it out and a reserve domain absorbs its volume the same day. With warmed reserves ready, replacement takes 1-3 days. Without them, replacement takes 7-10 days, and during that gap the operation either sends from compromised domains or loses volume entirely. Rotation mechanics (when exactly to swap, how to structure the reserve pool, how to retire and rehabilitate burned domains) are a discipline of their own, covered in depth in the cold email domain rotation guide.

The core protection principle is that domain reputation behaves like a portfolio of domains managed together. You protect the portfolio by rotating individual domains through a lifecycle of warm, active, degrading, and dormant, so the aggregate account reputation never depends on any single name staying healthy.

How to Check Domain Reputation

You cannot protect a reputation you cannot measure, and the receiving servers publish the exact data you need. The two authoritative sources report directly from the servers that decide your placement:

• Google Postmaster Tools reports domain reputation for Gmail traffic as a band of High, Medium, Low, or Bad, plus a daily spam complaint rate and authentication pass rates. It updates daily and is the single most important reputation dashboard for any domain sending to Gmail addresses.
• Microsoft SNDS reports IP-level data for Outlook and Hotmail traffic, including complaint rates and trap hits.

Two supporting tools round out the picture. MXToolbox checks your domain and IP against 100+ blacklists and validates DNS records in one scan, which catches the authentication errors from the audit above. A mail-tester style inbox-placement check reveals how an actual test email is scored by spam filters, including content and infrastructure factors.

Read reputation as a trend across days. A domain drifting from High to Medium over a week is an early warning worth acting on before it hits Low. Waiting until Postmaster reads "Bad" means you are already deep into a recovery that will cost 30-45 days.

Two Real Reputation Cases From the Platform

A lead-gen agency that skipped warmup

One B2B lead generation agency client came to MailDeck after burning through domains on a previous setup. They were running 2,400 Outlook inboxes across 24 domains (100 inboxes per domain) and had pushed straight to 8-10 cold sends per inbox from day three, skipping warmup entirely to hit a client volume commitment. Within the first month their spam complaint rate crossed 0.3% on the heaviest-sending domains, Postmaster Tools flipped 6 of the 24 domains to "Bad," and roughly a quarter of the fleet burned in that first month, a skipped-warmup worst case that ran above the 10-20% monthly burn normal at steady-state scale.

The rebuild was mechanical. We re-authenticated every domain, verified DNS propagation before any traffic resumed, and ran the full 3-5 day Outlook Premium warmup on every inbox with a trusted pool at a 30-35% reply target. Cold sends restarted at 3-5 per inbox per day with a 61-minute minimum interval and 15-25% randomization before ramping back to 8-10 over two weeks. With a 20-25% warm reserve now in place, their monthly burn settled into the expected 12-15% range and inbox placement recovered to the platform norm. The lesson the agency took away was that the warmup they had skipped to save a week cost them a quarter of their domain fleet in a single month.

A SaaS team that recovered a burned domain

A mid-market B2B SaaS company running revenue operations software was sending from 6 Google Workspace domains (30 inboxes total) into enterprise accounts. A single un-verified list from a new data vendor pushed their bounce rate past 7% in one afternoon, and within four days their primary domain dropped from High to Low in Postmaster Tools, with inbox placement on that domain falling well below the 98% they had held for months.

Because Google Workspace reputation is domain-primary and slow to rebuild, recovery could not be rushed. We cut the affected domain to near-zero volume, re-ran a 2-3 week warmup to rebuild engagement, purged the vendor list, and moved active campaigns onto two warm reserve Google domains so the operation did not lose sending days. The burned domain climbed back from Low to High over 41 days of clean low-volume sending. The team now verifies every list before it touches a Google domain, because on their highest-trust product a single dirty batch cost six weeks of recovery.

Reputation Building Timeline at a Glance

The single fastest way to compress this timeline is to start from inherited reputation rather than a cold domain. MailDeck pre-warmed Outlook inboxes ship ready to send because they inherit established sender reputation from official Microsoft IP pools, which removes the warmup phase entirely for that product.

FAQ

What is domain reputation in cold email?

Domain reputation is the trust score that Gmail, Outlook, and other receiving servers attach to the domain in your From address. It is the underlying asset that decides whether cold email reaches the inbox or the spam folder. Google shifted to domain-based reputation as its primary signal in 2024, so the domain now carries more weight than the sending IP for most cold email. Reputation is built from authentication, sending consistency, engagement, and complaint rates, and MailDeck maintains 98% inbox placement across 1,200+ domains by controlling all of those inputs.

How long does it take to build domain reputation?

Building usable domain reputation from a fresh domain takes 3-7 days of warmup on Outlook, 2-3 weeks on Google Workspace, and 3-4 weeks on Private SMTP before the first cold send. A domain reaches stable, full-volume reputation after roughly 4-6 weeks of consistent low-volume sending with strong engagement. MailDeck pre-warmed Outlook inboxes inherit established sender reputation from official Microsoft IP pools, which compresses the ramp to zero for that product.

How do I check my domain reputation for cold email?

Use Google Postmaster Tools for Gmail traffic and Microsoft SNDS for Outlook and Hotmail traffic, both of which report directly from the receiving servers. Postmaster Tools shows a domain reputation band of High, Medium, Low, or Bad plus a daily spam complaint rate. Treat a spam complaint rate above 0.3%, a bounce rate above 7%, or an open rate below 10% for 7 or more days as burn thresholds that require immediate action.

Does IP reputation or domain reputation matter more for cold email?

Domain reputation matters more for most cold email because Google made the domain its primary reputation signal in 2024, and because MailDeck inboxes run on official Microsoft and Google IP pools that are already trusted by virtually every receiving server. On those products the IP is bulletproof and the domain carries the risk. On Private SMTP the dedicated IP reputation is built from scratch alongside the domain, so both matter equally and warmup runs longer at 3-4 weeks.

How do I fix a bad domain reputation?

Cut sending volume on the affected domain to near zero, re-run warmup to rebuild engagement, remove the dirty list that caused the drop, and verify authentication is correct. Recovery from a Bad or Low band in Postmaster Tools typically takes 30-45 days of clean, low-volume sending. At enterprise scale it is often faster to rotate the domain out, hold it dormant, and send from a warm reserve domain instead, since 10-20% of domains burn every month and a 20-25% reserve absorbs the loss without missing a day.

How many cold emails can I send per domain without hurting reputation?

Safe volume depends on inbox type and inbox count per domain. One Outlook domain with 100 inboxes sending 8-10 cold emails per inbox per day handles roughly 900 sends per day, or about 18,000 per month, while one Google Workspace domain with 5 inboxes at 18-22 sends per inbox handles roughly 100 per day, or about 2,000 per month. Keep a minimum 61-minute interval between sends per inbox and 15-25% randomization, and spread volume across more domains rather than overloading any single one.

Methodology

Data in this article comes from MailDeck platform data as of Q3 2026: 833.9K+ managed inboxes, 1,631+ clients, 1,200+ domains under management, and a 98% inbox placement rate. The authentication error frequencies come from a DNS audit of 1,000+ domains where 67% had at least one critical authentication error. Warmup windows, burn thresholds, domain lifespan (45 days to 2 months under load), monthly burn rate (10-20% at enterprise scale), and reserve requirements (20-25% of active domain count) are measured across the platform's three infrastructure types (Microsoft 365 Outlook, Google Workspace, Private SMTP).

Client cases are anonymized and reflect real account scenarios. Specific figures within each case are representative of the account type and consistent with platform aggregates. External reputation thresholds and authentication requirements reference Google Postmaster Tools, Microsoft SNDS, the February 2024 Google and Yahoo bulk sender requirements, and the DMARC specification in RFC 7489.

Last updated: Q3 2026.