Google Postmaster Tools: how to read your domain reputation

If you send more than a couple hundred messages a day to Gmail users, Google Postmaster Tools (GPT) is the single most important dashboard you have. Unlike third-party reputation scores, it's reading directly off Gmail's internal metrics — it's what the filter actually sees when your mail arrives. And most senders misread it.

Setup: DNS verification and data lag

Sign in at postmaster.google.com with a Google account that owns the domain. Add your sending domain, then verify via a TXT record at the domain root. Propagation is fast — usually under an hour — but GPT won't show data until two things happen:

• You send at least ~100 authenticated messages per day to Gmail users. Below that threshold, Google considers the dataset too small to anonymise and shows nothing.
• At least 24-48 hours of data has accumulated after verification. GPT's charts lag by 1-2 days — today you're reading data through two days ago.

If you see "No data to display" after a week, it's usually because volume is below threshold. Add more sending sources (subdomains), not more messages — GPT scopes by the exact domain you add.

Dashboard: domain vs IP reputation

GPT reports two reputation scores side by side: Domain reputation (tied to the From/DKIM domain) and IP reputation (tied to the sending IP addresses).

• Domain reputation follows your domain across ESPs, IP changes, infrastructure migrations. Shared ESP? Your domain reputation is yours alone.
• IP reputation follows the IP, regardless of which domains use it. On a shared ESP pool, IP reputation is shared with every other customer on that pool.

Look at both but prioritise domain reputation — in 2026 Gmail weights domain more than IP. If your domain is High but IP is Medium, you're mostly fine. If your domain is Medium but IP is High, you have a content or engagement problem that will persist even if you move infrastructure.

Metric: Spam rate

Spam rate is user-reported complaints divided by delivered mail — the number of times Gmail users clicked "Report Spam" on messages from your domain. The thresholds Google publishes and enforces:

• Under 0.1% — healthy. Target.
• 0.1-0.3% — watch zone. Active investigation needed.
• Above 0.3% — non-compliant with 2024 sender requirements. Throttling and Spam routing start.

Critically, GPT's spam rate excludes mail that was already routed to Spam. It's only complaints from delivered mail. This means if you have bad placement (lots of mail going to Spam folder automatically), your reported spam rate might look deceptively low — because users can't complain about mail they never see in their inbox.

Metric: Domain reputation

Four buckets: High, Medium, Low, Bad. Rough translation to actual inbox performance:

• High — ~100% of otherwise-healthy mail reaches the inbox. Good content and engagement send you straight to Primary or Promotions as appropriate.
• Medium — 10-30% routes to Spam regardless of the specific message. Gmail is uncertain about you and hedges by sending a slice to Spam as an experiment.
• Low — 50%+ in Spam. Most of your mail is arriving but invisible. Engagement craters, which reinforces Low.
• Bad — 80%+ in Spam. Functionally blocked. Recovery takes weeks of clean sending at reduced volume.

The bucket can change day-to-day in Medium and Low, rarely in High or Bad. Don't panic over a single-day drop; look at the 14-day trend.

Metric: IP reputation

Same four buckets. IP reputation matters more if you're on a dedicated IP or a small shared pool. On a large ESP's shared pool, IP reputation mostly reflects the pool manager's own hygiene — not your behaviour. If you see Low IP reputation on a major ESP, complain to them; they may need to rotate you to a different pool.

Dedicated-IP senders: IP reputation is entirely yours. Warm it properly (4-6 weeks of progressive volume) or it stays at Low/Medium for months.

Metric: Authentication

Three sub-metrics: SPF pass rate, DKIM pass rate, DMARC pass rate. Each expressed as a percentage of messages that passed that specific check.

• Target: 99%+ for all three.
• 95-99% — misconfiguration somewhere in your sending pipeline. Often a forgotten third-party service (transactional mail, CRM integration, marketing tool) that isn't authenticated.
• Below 95% — major gap. Investigate immediately. Check your DMARC aggregate reports for the specific sources failing.

DMARC pass rate depends on alignment, not just SPF/DKIM pass. You can have SPF at 100% and DKIM at 100% but DMARC at 85% because the From domain doesn't align with the authenticated domain. Alignment failures are the #1 reason technically-authenticated mail still tanks reputation.

Metric: Encryption (TLS)

Percentage of outbound mail delivered over TLS. Target: 100%. Gmail requires TLS for bulk senders as of 2024, so anything below 99% is directly hurting you. Most modern MTAs default to opportunistic TLS, so sub-100% usually means a weird subset of traffic is using a misconfigured server or a cipher suite Google has deprecated.

Fix: check your MTA TLS config. Make sure TLS 1.2+ is enabled, and that you're not restricting to obsolete cipher suites. openssl s_client -starttls smtp -connect gmail-smtp-in.l.google.com:25 will show you the negotiated ciphers.

Metric: Delivery errors

Percentage of messages Google couldn't deliver, broken into temporary and permanent errors. The chart shows error categories like "IP reputation", "Domain reputation", "Spam content", "Unauthenticated", "Rate limited".

A sudden spike in "our system detected" errors is what you're looking for. That's Gmail telling you your reputation has degraded enough to start refusing mail. Pause, investigate, don't retry your way through the wall.

What Medium reputation actually costs

This is the metric most senders get wrong. They see Medium, think "not great, but not bad", and keep sending. The real cost of Medium on a typical list:

• 10-30% Spam routing on otherwise-healthy mail. That's a 10-30% reduction in opens, clicks, replies and revenue per campaign.
• Promotion tab bias. Medium-reputation senders land in Promotions at higher rates than High-reputation senders, even for Primary-eligible content.
• Reinforcement loop. Mail in Spam doesn't get opened. Lack of opens is a negative engagement signal. The signal keeps you at Medium or drops you to Low.

Medium is not stable — it either trends up or trends down based on your current behaviour. Treat it like a warning light, not a resting state.

How to move each needle

Prioritised actions by metric:

1. Low authentication → fix alignment. Read DMARC aggregate reports, identify every source, fix SPF/DKIM on each. Target 99%+ in 2 weeks.
2. High spam rate → segment, sunset inactive recipients, make unsubscribe prominent, audit list acquisition.
3. Medium/Low domain reputation → reduce volume 50%, send only to engaged recipients (opened in last 30 days) for 2 weeks, then expand gradually.
4. Low IP reputation on shared pool → escalate with ESP, consider dedicated IP if volume supports it (50k+/month).
5. Sub-100% encryption → audit MTA TLS config, verify modern ciphers, check for any relay or smart host that isn't TLS-enabled.
6. Spike in delivery errors → pause sending immediately, investigate before resuming. Do not retry through a block.

Known limitations

GPT isn't perfect. The gaps to know about:

• 100-message minimum. Below ~100 authenticated Gmail-targeted messages/day, no data shows. This is by design (anonymisation), not a bug.
• No per-campaign breakdown. GPT shows daily aggregates per domain. You can't isolate which campaign caused a spam-rate spike without your own analytics.
• Delayed data. 24-48 hours behind reality. For fast diagnosis of a live issue, your own bounce logs and inbox-placement tests are faster.
• Domain-only, not subdomain granularity in some views. If you send from news.acme.com and mail.acme.com, add each as a separate verified domain.
• No view into how you rank vs peers. The bucket system is absolute, not relative. Competitors in your space could all be Medium; you're still Medium.

Frequently asked questions