Skip to main content

Proxy 25

Diagnosing and Fixing Sudden Drops in Domain Reputation — Proxy25
Domain Reputation · Deliverability · Infrastructure · 2026

Diagnosing and Fixing Sudden Drops in Domain Reputation

Leila's domain reputation dropped from high to low in six days. She had not changed anything. Eleven months of careful work, undone by four events that accumulated while no monitoring practice caught any of them.

J
Jon
Proxy25
13 min read
2026

She had not changed anything. The graph moved anyway.

Leila had done everything the right way. She had warmed her sending domain slowly — fifty emails per day in week one, scaling carefully over eight weeks before reaching full volume. She had sourced her lists from reputable providers and verified them before importing. She had kept her sequences tight, her ICPs specific, her sending volume consistent. For eleven months, none of this had produced a deliverability problem worth mentioning.

Then in March, she opened Google's Postmaster Tools on a Tuesday morning and the domain reputation graph had moved from high to medium. By Thursday it was low. By the following Monday her open rates had dropped from 22 percent to 4 percent.

22%
open rate · 11 months
4%
six days later
Same domain. Same sequences. Same contact sources. Same volume. Whatever caused the graph to move had not come from any decision she recognized making. It had come from four events she could not see while they were happening.

What I found when I dug into her sending domain: the drop had not been caused by one thing. It had been caused by four things, across six days, none of which she had directly produced, none of which she had been able to see while they were happening. She had not failed at outbound. She had failed at monitoring. Those are different problems, and they have different fixes.


Why the graph moved on Thursday when the problems started on Saturday

Domain reputation in Gmail is a classification, not a score. The four levels reflect how Gmail's model has assessed the aggregate sending behavior of a domain across a rolling window. The model does not update in real time and it does not react to single events in isolation. It accumulates signal.

High
↓ March 4th
Start of Leila's story
Medium
↓ March 6th
Classification crossed
Low
↓ March 10th
Open rates: 4%
Bad
Near-total filtering
!

Most teams, when they see the classification drop on Tuesday, spend Tuesday looking for something that went wrong on Monday. When they cannot find anything on Monday, they conclude Google's model must be wrong. The real answer is almost always in the days before Monday. The cause that moved Tuesday's classification was already fully in motion by the previous Wednesday.

When I worked through Leila's situation, I went back ten days from the classification change and rebuilt what had happened to her sending domain, day by day. What I found was a sequence that started on February 28th and produced a visible consequence on March 4th. Four events. Each small. Together, threshold-crossing.


Four events. Six days. One classification change.

01
February 28th · Event One
A list that was fourteen months old

A sales partner sent Leila's team a list of contacts from a joint account database. The partner ran a legitimate operation. The list had been compiled carefully. Nobody had anything to gain from sending Leila bad data. The list was just old.

B2B contact data loses accuracy at roughly 2 to 3 percent per month. Over fourteen months, a list of 1,800 contacts accumulates somewhere in the range of 350 to 680 addresses that are no longer accurate. The verification audit run after the fact came back with 391 hard invalid addresses.

21.7%
Hard bounce rate on that cohort Gmail degradation starts becoming visible around 2% and accelerates above 5%. A 21.7% hard bounce rate is not a threshold approaching — it is a threshold crossed at significant speed.
A verification run on that 1,800-address list would have taken two hours. It would have removed 391 addresses before they produced hard bounces that started everything that followed.
02
March 2nd · Event Two
The contact who had already stopped listening

A VP of Operations had been in Leila's sequence for three weeks. He had opened the first two emails and then stopped engaging entirely. By touchpoint four he had not opened or clicked anything in seventeen days. The email arrived. He marked it as spam.

One complaint. Leila had no visibility into it. Gmail does not notify senders of individual spam complaints. But the complaint did not arrive in isolation — it arrived twenty-four hours after the bounce event, on a domain already accumulating negative signal. Gmail's classification model does not evaluate events in isolation. They compound.

17 days
He had not engaged in 17 days before the spam complaint The probability of a positive reply at touchpoint four was effectively zero. The probability of a spam signal was not.
Sequence exit conditions at touchpoint three with no engagement would have removed this contact before touchpoint four. The March 2nd spam complaint does not happen.
03
March 3rd · Event Three
Someone using her domain without her knowledge

An automated spoofing kit had added her domain to its rotation and began sending phishing emails claiming to originate from her domain. The volume was modest — 80 to 120 messages per day. Most were caught by Gmail's filters. But some got through, and recipients who received those messages and marked them as spam generated complaint signals attributed to her domain.

p=none
Her DMARC policy — for eleven months Under p=none, the spoofed messages reached inboxes with no policy consequence. Under p=quarantine, those same messages would have been routed to spam before ever reaching an inbox. No delivery. No complaint. No reputation impact.

Her DMARC reporting mailbox had been receiving daily aggregate reports showing every IP sending from her domain. The reports had been arriving for eleven months. She had never opened the mailbox. The spoofing had started March 3rd. It was in the report that arrived March 4th — the same day the classification changed.

A weekly 15-minute check of DMARC reports would have surfaced the spoofing within one week of it starting. Moving to p=quarantine would have stopped the complaint signals within 48 hours.
04
March 3rd onward · Event Four
The engagement floor dropped

When 391 addresses in a sequence receive an email and bounce, they count as sent messages against which zero engagement is recorded. Leila's domain had been running consistent open rates of 18 to 22 percent. The 391-contact bounce cohort injected a zero-engagement block into the same rolling window the domain reputation model uses to assess whether recipients want mail from this sender.

Four negative signals pushing in the same direction Each one individually would have produced a small, transient negative signal. Together they crossed the threshold that eleven months of careful sending had built.
None of the four events appeared in any dashboard Leila was watching. The graph drop that looked overnight was four events accumulated over six days.

The diagnostic sequence — ordered because earlier events explain later ones

1
Open Postmaster Tools for the 14 days before the classification change
Not the day of the change — the 14 days before it. The underlying metrics that feed the classification — delivery errors, spam rate, and authentication rate — tell you which signal started moving first and on which day. In Leila's case: delivery errors moved March 1st (bounce event), spam rate moved March 2nd (complaint and spoofing signals). The sequence was readable once the window was right.
Google Postmaster Tools
2
Open the DMARC reporting mailbox
If the policy is p=none and reports have been accumulating unread, this is where spoofing activity, unknown sending sources, and authentication failures appear. The aggregate report for any given day shows every IP that claimed to send from your domain, whether SPF and DKIM passed for each, and how the receiving server handled the message.
EasyDMARC · Postmark · DMARC Analyzer
3
Audit every list that entered a sequence in the 10 days before the drop
If there was a bounce rate spike, it came from a specific cohort. Pull that cohort, run it through verification retroactively, and establish what percentage were invalid. The age of the list is usually what explains the invalid rate — anything older than 90 days from an external source should be treated as requiring pre-send verification regardless of source reputation.
Proxy25 verification
4
Review active sequence contacts against engagement recency
Pull contacts who are past touchpoint three with no engagement signal — no open, no click, no reply — and count how many are still being sequenced. That number represents ongoing spam-signal risk from contacts who have already communicated through behavior that they are not interested. Exit them before the next send, not after the next complaint.
Your sequencing platform's engagement filter
5
Check the DMARC policy level
If it is at p=none and the reporting mailbox has not been reviewed in more than four weeks, move to p=quarantine after confirming through the reports that all legitimate sending sources are aligned and passing. This takes forty minutes and closes the spoofing complaint pathway permanently. A domain at permanent p=none is a domain whose owner has not committed to enforcement — and in 2026, enterprise mail gateways read that as a reduced-trust signal.
Your domain's DNS settings

Every one of those steps is a monitoring practice that should have been running continuously. The diagnostic process is what it looks like when all five checks happen reactively — after the drop — rather than proactively. Running them proactively would have caught each of the four events individually, before they had a chance to compound.


Seven weeks. Not permanent — but not fast either.

Leila ran all five steps in the week following the call. The 391 invalid addresses were suppressed. Engagement exit conditions went into every active sequence. The DMARC policy moved from p=none to p=quarantine. Every other list in her CRM was audited for age and re-verified before any further sends.

Day 1–2
Spoofing stopped producing complaint signals. The spoofing attempts continued — the kit kept trying — but messages were routed to spam by receiving servers under the quarantine policy before reaching inboxes. No delivery, no complaints.
Week 1–3
Recovery sends at reduced volume to most engaged, highest-confidence contacts — existing relationships, warm referrals, contacts with prior engagement history. High-engagement sends produce stronger positive signal per message, which accelerates the outweighing process.
Week 3
Classification returned to medium. Open rates climbed from 4% toward 11%. Not linearly — steadily, as the classification moved and Gmail's routing algorithm responded.
Week 7
Classification returned to high. Open rates back toward 19%. Seven weeks from the fix, eleven months of earned reputation was restored. Seven weeks is the number to anchor to for a recovery that is identified quickly, all contributing factors addressed, and sending behavior during recovery managed carefully.

A team that identifies the cause late, fixes only some of the contributing factors, or continues sending at full volume to unfiltered contact lists during recovery will take longer — sometimes significantly longer. Seven weeks was the result of doing it right after the diagnosis. Leila's eleven months of careful background work was the reason recovery was possible in seven weeks rather than seven months.


Three practices. None requiring a new tool or a technical hire.

📊
Weekly 15-minute DMARC report review
The spoofing that started March 3rd appeared in the March 4th report — the same day the classification changed. With a weekly review cadence, the March 4th report would have been the second one seen after the spoofing started. The DMARC policy would have moved to p=quarantine within 24 hours. The complaint signals from the spoofed messages would have been contained before they added to the accumulation. All it requires: a calendar reminder and a DMARC reader (EasyDMARC, Postmark, and DMARC Analyzer all have free tiers).
Per-cohort bounce check after the first 20% of any new list
The 1,800-contact partner list had 21.7% invalid addresses. If Leila had sent to the first 360 contacts and paused to check the bounce rate before continuing, the bounce event would have surfaced in the first 360 sends rather than across the full 1,800. 360 hard bounces on a domain with Leila's volume is recoverable without a classification change. 391 hard bounces across a full send in a week is not. The check: import 20% of any external list, send, check bounce rate. If above 3%, verify the full list before continuing.
🚪
Engagement-based exit at touchpoint three
The VP of Operations who marked the email as spam at touchpoint four had stopped engaging after touchpoint two. He had not opened or clicked anything in seventeen days. An exit condition removing contacts with no engagement signal after three sends would have taken him out of the sequence before touchpoint four. The March 2nd spam complaint does not happen. Sequence exit conditions are typically framed as a pipeline efficiency practice. That is the secondary benefit. The primary benefit is preventing the domain reputation cost of sending to contacts who have already said through behavior they are not interested.

None of these require a new tool. None require a technical hire or a budget allocation. They require calendar reminders and decision rules written into sequence setup. They are the difference between a team that catches individual events before they compound and a team that discovers what compounded after the graph moves.


Two things being built simultaneously — only one of them visible

She said she had not understood, until the graph dropped, that she had been building two things simultaneously for eleven months. She had been building pipeline through her outbound sequences. And she had been building domain reputation through every list decision, every verification choice, every send timing call, every engagement exit she did or did not make.

The pipeline results had been visible in her CRM every week. The domain reputation had been invisible — right up until it was not.

The gap between a domain that holds at high reputation across a year of consistent outbound and a domain that drops in six days is almost always in those background decisions — not in the sequence quality, not in the ICP, not in any of the foreground variables that get most of the attention.

Accurate results at the point before the damage is done

Leila's 391-bounce event began with a partner list that never went through verification before import. Two hours and a verification run would have caught every address in it. That is what Proxy25 is built for.

Start with 500 free credits → No credit card required