IP Reputation Crashed: Causes and Step-by-Step Recovery

Diagnosis: What Happened?

Check These (In Order)

1. Google Postmaster Tools → IP Reputation tab

• Shows: High / Medium / Low / Bad
• If dropped from High/Medium to Low/Bad = reputation crash

2. Microsoft SNDS → Dashboard

• Shows complaint rate and filter results
• High complaint rate = reputation problem

3. Cisco Talos → Enter your IP

• Shows: Good / Neutral / Poor
• Poor = confirmed reputation issue

4. MXToolbox Blacklist → Enter your IP

• Check against 70+ blacklists
• Any major blacklist (Spamhaus, Barracuda) = urgent

Common Causes

Cause	How It Happens	Fix
Spam complaint spike	Mailing unengaged list, purchased list, or controversial content	Clean list, engagement-based segmentation
Spam trap hits	Old addresses recycled as traps on stale list	Sunset policy, remove 180+ day inactive
Blacklisting	Complaints, traps, or security compromise triggered listing	Fix cause, request delisting
Volume spike	Went from 5K to 50K emails in one day	Gradual warmup, consistent volume
Sending to unvalidated list	Imported list without validation, high bounce rate	Validate before import
Another sender (shared IP)	Someone on your shared pool sent spam	Contact ESP, request IP change
Security compromise	Account hacked, sending spam through your SMTP	Change passwords, audit access

Recovery Plan

Phase 1: Stop the Bleeding (Days 1-3)

1. Reduce volume immediately to 20-30% of normal
2. Send only to engaged contacts (opened/clicked in last 30 days)
3. Check blacklists and begin delisting requests
4. Fix authentication if any SPF/DKIM/DMARC issues exist
5. Audit account security (change SMTP passwords, API keys)

Phase 2: Clean (Days 4-7)

1. Validate your entire list through ZeroBounce or NeverBounce
2. Remove: hard bounces, spam complaints, unengaged (90+ days)
3. Implement sunset policy for contacts inactive 180+ days
4. Review recent campaigns for anything that might have triggered complaints

Phase 3: Rebuild (Weeks 2-8)

1. Send to top engaged segment only (opened in last 30 days)
2. Volume: Start at 500-1,000/day, increase 20% daily
3. Monitor daily: Postmaster Tools, SNDS, blacklist status
4. Target metrics: Bounce rate < 1%, Complaint rate < 0.05%
5. Gradually expand segments: 30-day → 60-day → 90-day engaged

The full daily monitoring checklist during rebuild:

Indicator	Source	Target
Domain reputation	Postmaster Tools	Trending up from current state
IP reputation	Postmaster Tools	Trending up
Spam rate	Postmaster Tools	< 0.3%, ideally < 0.1%
SNDS color	SNDS dashboard	Green, or yellow trending green
Bounce rate	ESP delivery report	< 2% per send
Blocklist status	MXToolbox/HetrixTools	No new listings

If any indicator deteriorates during recovery, reduce volume immediately and investigate.

What NOT to Do During Recovery

• Don't mail dormant subscribers. They're the most likely to complain or ignore, which depresses recovery.
• Don't switch IPs hoping for a fresh start. A new IP has no reputation and needs its own warmup — and the unfixed root cause will damage it too.
• Don't change ESP mid-recovery. It adds infrastructure variability while ISPs are watching closely.
• Don't try to "make up volume" later. Compressing missed sends into one high-volume blast wrecks the recovery.
• Don't run promotional content during recovery. Use the recovery window for transactional and high-engagement subscribers only.

Phase 4: Prevention

1. Engagement-based sending permanently (guide)
2. Real-time validation on all new signups
3. Blacklist monitoring with automated alerts (guide)
4. Monthly list cleaning cycle
5. Consistent sending volume — no spikes

Shared IP Recovery

If you're on shared IPs and the reputation crash wasn't caused by your sending:

1. Contact your ESP immediately. Explain the situation.
2. Request: Move to a different shared IP pool
3. Or request: Upgrade to a dedicated IP (if volume supports 50K+/month)
4. If ESP can't help: Evaluate switching providers. Shared IP contamination is the #1 reason to leave an ESP.

Timeline Expectations

Severity	Recovery Timeline
Domain reputation Medium → Low	2-3 weeks clean sending
IP reputation dropped	2-4 weeks
Single blacklist listing	1-3 weeks (delisting + reputation rebuild)
Multiple blacklists + Bad reputation	4-8+ weeks
Domain reputation Bad → High	6-12 weeks

When to Consider IP Migration

If recovery fails after 8+ weeks of disciplined sending, ask:

1. Has the root cause actually been fixed? (Re-audit.)
2. Is the IP shared with bad neighbors you can't influence?
3. Is the IP on a netblock with historical bad reputation?

If yes to any, migration may be faster than continued recovery — a new IP plus warmup takes 4-6 weeks, often less than fighting a permanently damaged IP.

Practitioner note: The most common pattern: company imports a "leads list" they bought from a data vendor. 30% bounces. Spam traps triggered. Blacklisted on Spamhaus within 48 hours. IP reputation crashes. Recovery takes 6 weeks. The $500 list purchase cost them $50K+ in lost email revenue. Never buy lists.

Practitioner note: A complaint spike usually shows in Postmaster Tools 5-7 days after the offending send — by the time you notice, the campaign that caused it is forgotten. Pull the complaint timing from Postmaster Tools and correlate it with your send history to identify the source. The fix often isn't obvious without that correlation.

Practitioner note: If you're on shared IPs and this keeps happening despite clean sending practices, the shared pool is the problem. Move to dedicated IPs or switch ESPs. Some ESPs are better at maintaining pool quality than others. Postmark's transactional pools are the cleanest in the industry.

If your IP reputation has crashed and you need a recovery plan, schedule a consultation — I'll diagnose the root cause, build the recovery timeline, and implement prevention measures.

Sources

• Google: Postmaster Tools
• Microsoft: SNDS
• Cisco: Talos Intelligence

---

v1.0 · March 2026