Defaults.Exposed

Defaults.Exposed › Reports

Domain Reputation: What It Is and How to Check Yours

Published

Domain reputation is the trust score that mailbox providers such as Gmail and Outlook attach to mail sent from your domain — a running judgement, built from your sending history and the authentication records you publish, that decides whether your email lands in the inbox, the spam folder, or nowhere at all. The part of that score you can see and control from outside is your authentication posture: whether your domain publishes SPF, DKIM, and an enforcing DMARC policy that stops anyone else from sending in your name. On this measure most of the internet is quietly bleeding reputation. The August 2026 defaults.exposed census graded 376,928,750 domains for email authentication and found that 90.7% — 341,945,132 — publish no enforcing DMARC policy, and 56.8% (214,276,774) publish neither SPF nor DMARC at all. A domain that cannot stop impersonation cannot protect its own reputation, because a spoofer’s spam is spent in its name.

If you have watched your open rates sag, or found your invoices landing in customers’ spam folders, domain reputation is usually the hidden variable. It is not one number you can look up — each mailbox provider keeps its own — but it rests on signals that are entirely public, and one of them is whether your domain can be forged. The figures throughout come from the defaults.exposed August 2026 census, an independent scan of 432,127,908 domains graded as of 2026-08-16.

The short answer: what domain reputation means

Domain reputation is a mailbox provider’s opinion of your domain as a sender. Every time your domain sends mail, receivers such as Gmail, Outlook, and Yahoo record what happens next: was the message authenticated, did recipients open it or mark it as spam, did it hit a spam trap, is the domain on a blocklist. Those observations accumulate into a score that determines placement for your next message.

That score has two layers. The first is behavioural — complaint rates, engagement, sending volume and consistency, blocklist and spam-trap hits. This layer lives inside each provider and is not directly published. The second is identity — can the provider prove the mail genuinely came from you, and can anyone else send mail that appears to. This layer is entirely public, because it is published in your DNS, and it is the foundation the behavioural layer is built on.

defaults.exposed grades the identity layer. It cannot see Gmail’s internal complaint counters, but it can read exactly what Gmail reads first: your SPF record, your DKIM keys, your DMARC policy, your TLS and certificate posture. Those are the signals that tell a provider whether to start trusting you — and whether a criminal can quietly erode that trust from the outside.

The practical takeaway is simple: you cannot manage a reputation you cannot authenticate. A domain with no enforcing DMARC has handed anyone on the internet a licence to send in its name, and every phishing run or spam blast that goes out under that name is charged to the real owner’s reputation.

The signals that build (or break) reputation

Reputation is not one lever but a stack of them. Some you control through how you send; some you control through what you publish. The public, publishable ones are where a free scan can tell you where you stand today.

Read that list top to bottom and a pattern emerges: the behavioural signals only work in your favour once the identity signals are in place. A domain that never authenticates never accrues positive reputation, and a domain that never enforces DMARC cannot stop negative reputation being manufactured for it.

Why missing SPF/DMARC silently tanks reputation — 56.8% publish neither

Here is the mechanism most senders never see. Your domain publishes no enforcing DMARC. A spoofer picks it up — spoofable domains are trivial to find, because the posture is public — and sends a phishing or spam campaign with your domain in the From: line. Recipients mark it as spam. Blocklists and provider reputation systems record spam “from your domain.” Your genuine mail, sent weeks later, now inherits a reputation you never earned. You did not send the spam; you simply left the door open, and the reputation cost lands on you.

The scale of that open door is the headline finding of the census. 214,276,774 domains — 56.8% of the graded web — publish neither SPF nor DMARC, so there is no authenticated identity and no anti-forgery policy at all. Another large tranche publish something but stop short of protection: only 20.0% (75,571,248) publish any DMARC record, and of those a majority sit at p=none, which monitors forgery but does nothing to stop it. Net of all that, 90.7% (341,945,132) have no enforcing DMARC and can be impersonated at will. The profile of the completely silent majority is measured in The Silent Domain: 56.8% of the internet has no email authentication.

The reverse failure is just as damaging. A domain can publish SPF but choose the weaker soft-fail (~all) setting, which tells receivers to accept-but-mark forged mail rather than reject it — a permissive stance that lets impersonation through while looking configured. We measured how many domains settle for the weaker option in SPF hard-fail vs soft-fail: why 82 million domains use the weaker setting, and defaults.exposed grades the distinction in the SPF policy strength methodology.

The consequence is that reputation damage is often invisible until it is expensive. There is no alert when a spoofer starts sending in your name — unless you have published DMARC with a reporting address and are actually reading the reports. Without that, the first sign is deliverability quietly collapsing: newsletters to spam, password resets never arriving, an invoice a customer swears they never got. The exact same forgeability that damages reputation is what powers impersonation fraud; the attack itself is unpacked in Email spoofing explained: why 90.7% of domains can be forged.

How to check your domain reputation right now

You cannot read Gmail’s private score directly, but you can check every public input to it — and the public inputs are where nearly all reputation problems actually originate. Work through these four checks in order.

  1. Check your authentication posture first. This is the fastest, highest-signal step, and it is free. Check your domain free at defaults.exposed — it reads your live SPF, DKIM, and DMARC records straight from public DNS and tells you whether your domain is authenticated, whether your DMARC policy actually enforces, and whether anyone can send mail in your name. It takes about 30 seconds and needs no account. If this comes back weak, no amount of list hygiene will fix your placement.
  2. Enrol in the providers’ postmaster tools. Google Postmaster Tools and Microsoft SNDS expose the provider-side reputation and spam-complaint data for domains you send to at volume. They report their view; the scan above tells you why that view is what it is.
  3. Check blocklist and spam-trap status. Query the major public blocklists for your domain and sending IPs. A listing you did not expect is frequently the fingerprint of a spoofer who has been sending in your name — which loops straight back to whether you enforce DMARC.
  4. Read your DMARC aggregate reports. If your DMARC record carries a rua= address, receivers send daily XML summaries of everyone sending as you — legitimate services and impostors alike. This is the single richest reputation signal you own, and most domains that publish DMARC never point the reports anywhere useful, as covered in Who reads the world’s DMARC reports. The grading logic is in the DMARC reporting methodology.

Steps 2 to 4 tell you how you are currently perceived. Step 1 tells you whether that perception can even be trusted, or whether a stranger is contributing to it. Start with step 1, because it is the only one that reveals whether your reputation is yours to manage at all.

How to fix a damaged domain reputation

Repairing reputation is mostly about closing the identity gaps so that good sending accrues to you and bad sending in your name is stopped. The sequence is well-trodden and low-risk when done in order.

  1. Publish a correct SPF record. List every service that legitimately sends for you and end the record with hard-fail (-all), so receivers reject anything else. If you are unsure what an SPF record contains, start with What is an SPF record, then confirm the grading in the SPF methodology.
  2. Turn on DKIM for every sender. Each mail platform, CRM, and invoicing tool should sign with a DKIM key published in your DNS. DKIM survives forwarding where SPF breaks, and it is half of the alignment DMARC checks. See the DKIM methodology.
  3. Publish DMARC at p=none with a reporting address. This changes nothing about delivery but starts the flow of aggregate reports, so you can see exactly who is sending as you — the ones you authorised and the ones you did not. Reading these is how you discover a spoofer before your reputation does.
  4. Fix alignment, then enforce. Over two to four weeks, bring every legitimate sender into SPF and DKIM so it aligns. Then tighten DMARC to p=quarantine and finally p=reject, at pct=100, with a matching sp= for subdomains. Forged mail is now refused and can no longer be charged to your reputation. The full grading of each stage is in the DMARC policy methodology, and the field-by-field walkthrough is in DMARC checker explained.
  5. Clean the behavioural side. With identity fixed, address the rest: prune unengaged and bounced addresses, remove any list you cannot prove opted in, warm up new sending domains gradually, and keep volume steady. This is where blocklist delistings and complaint-rate recovery come from — but only once the mail is authenticated enough for providers to attribute the improvement to you.

The whole first four steps are DNS edits and sender configuration; none of them touch your outgoing mail flow if sequenced correctly. The reason to start today, even if you cannot enforce today, is that the reporting phase in step 3 is time — you cannot compress the weeks of listening that precede safe enforcement.

Reputation vs deliverability: why your emails land in spam

Reputation and deliverability are often used interchangeably, but they are cause and effect. Deliverability is the outcome — did the message reach the inbox. Reputation is the score that drives the outcome. When your mail lands in spam, the proximate cause is almost always a reputation the receiving provider has already formed about your domain, long before this particular message arrived.

Authentication is the largest single lever on that reputation, which is why the two topics are inseparable. A provider that cannot authenticate your mail has no basis to trust it; a provider that sees your domain forged elsewhere has an active reason to distrust it. The specific inbox-placement failures and their fixes are unpacked in Why are my emails going to spam — but the root cause it keeps returning to is the same posture the census measures here.

The rules have also hardened. Since 2024, Google and Yahoo require bulk senders to authenticate with SPF and DKIM and to publish a DMARC policy — no longer a best practice but an entry ticket to the inbox at scale. Two years on, most domains still have not met the bar; where enforcement actually stands is measured in The Google and Yahoo deadline, two years on. If you send marketing or transactional mail in any volume, an unauthenticated domain is now a deliverability problem by policy, not just by reputation.

What this means

For marketers and SMB owners, domain reputation is the invisible tax on every campaign you send. You can write the perfect subject line and still land in spam if your domain reads as untrustworthy — or as forgeable — to the receiving provider. At a 9.3% DMARC-enforcement rate across the internet, most domains are in exactly that position and do not know it, because there is no dashboard that warns you a spoofer is spending your reputation. The fix is free, it is DNS, and it is the highest-leverage deliverability work you can do. Checking where you stand is a 30-second scan.

For IT and security teams, reputation reframes email authentication as an operational metric, not a compliance checkbox. Every day your domain sits at p=none or with no DMARC at all is a day anyone can manufacture negative reputation in your name, undetected, and a day your legitimate mail carries the cost. The remediation is not a project — it is publish SPF and DKIM, publish DMARC, read the reports, and enforce. Fewer than one domain in ten has finished that job; being one of them is a durable deliverability advantage.

FAQ

What is domain reputation? Domain reputation is the trust score that mailbox providers like Gmail, Outlook, and Yahoo assign to mail sent from your domain. It is built from two things: your sending behaviour (spam complaints, engagement, volume, blocklist hits) and your published identity (SPF, DKIM, and an enforcing DMARC policy). The behavioural half lives inside each provider; the identity half is public in your DNS and is the foundation the rest is built on. A domain that cannot authenticate its mail earns no positive reputation, and one that cannot stop impersonation cannot prevent negative reputation being created in its name — the position 90.7% of domains are in.

How do I check my domain reputation? Start with the public inputs, because that is where most problems begin. Run a free authentication scan such as defaults.exposed to see whether your SPF, DKIM, and DMARC are present and enforcing and whether your domain can be spoofed — it reads live DNS and takes about 30 seconds. Then enrol in Google Postmaster Tools and Microsoft SNDS for the providers’ own reputation view, check the major blocklists for unexpected listings, and read your DMARC aggregate reports to see exactly who is sending as you. The scan tells you whether that reputation is even yours to manage.

Why is my domain reputation low? The most common causes, in order: your mail is not authenticated, so providers cannot attribute good sending to you; your domain has no enforcing DMARC, so spoofers send spam in your name and the complaints land on you; you are on a blocklist, often as a symptom of that spoofing; or your list hygiene is poor — high bounces, spam-trap hits, low engagement. The census shows how widespread the first two are: 56.8% of domains publish neither SPF nor DMARC, and 90.7% cannot stop impersonation. Fixing authentication is nearly always the first and largest lever.

How do I improve my domain reputation? Close the identity gaps first, then the behavioural ones. Publish a correct SPF record ending in -all; enable DKIM for every service that sends for you; publish DMARC at p=none with a reporting address; read the reports for two to four weeks to bring every legitimate sender into alignment; then enforce with p=quarantine and finally p=reject. Only then does behavioural clean-up — pruning dead addresses, warming up volume, cutting complaint rates — reliably pay off, because providers can now attribute the improvement to you. Each authentication step is a single DNS edit and none of it disrupts legitimate mail when sequenced in order.

Data to cite

See where your own domain stands

Domain reputation begins with a question you can answer in seconds: is your mail authenticated, and can anyone else send in your name. For 90.7% of domains the honest answer is that they cannot stop impersonation — and most owners have never seen it stated plainly, because the damage shows up only later as mail quietly landing in spam.

Check your domain free at defaults.exposed — it reads your live SPF, DKIM, and DMARC records from public DNS and tells you instantly whether your domain is authenticated, whether your DMARC policy actually enforces, and whether your domain can be forged. Takes about 30 seconds. No account needed. If you want the gaps closed and kept closed — SPF, DKIM, and an enforcing DMARC policy done right, then monitored — see how the fix works.

Read the flagship census report: The State of Domain Security 2026 →

Related from this series: The Silent Domain · DMARC Checker Explained · Why Are My Emails Going to Spam · Email Spoofing Explained: Why 90.7% of Domains Can Be Forged

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 376,928,750 domains graded from 432,127,908 scanned. All figures are counts of graded domains. References: RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC).

How to cite this report

Press / blog: defaults.exposed (2026). Domain Reputation: What It Is and How to Check Yours. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/v9/articles/domain-reputation-what-it-is-and-how-to-check-yours

Academic: defaults.exposed. (2026, August 21). Domain Reputation: What It Is and How to Check Yours. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/v9/articles/domain-reputation-what-it-is-and-how-to-check-yours

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,750 graded domains)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,750 of them for email authentication using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/v9/methodology Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Data sourced from the August 2026 grading methodology (v9) — 34 checks, 376 million domains. Browse the census statistics or the Census Explorer, or see all August 2026 research →