Reputation online — a working reference

Reputation, online, is a prediction: given what this domain, this sender or this address has done before, how should I treat what it sends me now? Mailbox providers, search engines, DNS resolvers and security tools each keep their own answer, and most of them never publish it directly. What they publish is the consequence — a message in the spam folder, a page missing from results, a connection refused.

Three things carry reputation separately, and they move at different speeds. A domain carries it through everything that uses the name: the web site, the mail it signs, the links other people make to it. An email sender carries it through the mail stream itself: how recipients react, whether authentication passes, how many addresses turn out not to exist. An IP address carries it through the traffic seen from it, and inherits some of the history of whoever held it before.

The notes that follow describe each of these, name the public sources that measure them, and say what moves them — in both directions.

A domain's reputation is the sum of what has been seen under its name. Age counts: a name registered years ago with a steady history is trusted more than one registered last week, which is why newly registered domains are a category of their own in many filters. Behaviour counts more: hosting phishing pages, sending unwanted mail, or appearing in abuse reports moves a name onto blocklists that mail servers and resolvers consult.

The public sources are blocklists and abuse programmes. Domain blocklists (Spamhaus DBL, SURBL, URIBL) list names seen in spam and malware; registries and registrars act on abuse reports under their contractual obligations, and programmes such as NetBeacon route those reports to the right party. Search engines keep their own view of a site's trustworthiness, described in the note on search.

What moves it: keep the name in continuous, legitimate use; make sure its mail is authenticated so nobody can borrow the name to send; fix compromised pages fast; and, when the name changes hands, expect the buyer to inherit its past — a history is part of what is being sold.

Mailbox providers score the sender — the combination of the sending domain, the addresses it sends from and the stream it produces — and file mail accordingly. The signals are well documented by the providers themselves: how many recipients mark a message as spam, how many open or reply, how many addresses bounce because they do not exist, whether the traffic is steady or arrives in bursts, and whether the mail is authenticated.

Authentication is the part a sender fully controls. SPF lists the servers allowed to send for a domain; DKIM signs each message so its origin can be verified; DMARC tells receivers what to do when neither aligns with the visible From address, and asks them to report back. Since 2024 the largest providers require bulk senders to authenticate with all three and to keep complaint rates below a published threshold — the rules that the dmarc.org and provider announcements in the feed track.

What moves it: send only to people who asked, remove addresses that bounce, keep volume predictable, and read the feedback the providers offer (Google Postmaster Tools, Microsoft SNDS, the DMARC aggregate reports) before the spam folder tells you the same thing.

An IP address is scored by the traffic seen from it — mail, web requests, scans — and by who has held it. Shared addresses (a cloud provider's pool, a hosting company's range) carry the behaviour of every tenant; a dedicated address carries only yours, and starts cold: with no history, providers throttle it until a pattern emerges, which is what "warming up" an address means.

The public sources are the IP blocklists: Spamhaus (SBL, XBL, PBL), Spamcop, Barracuda and others, each with its own listing and removal policy, plus the reputation centres that vendors publish (Cisco Talos, for one). Being listed is visible to anyone who checks, and most mail servers check.

What moves it: keep the address from sending anything it should not — a compromised account, an open relay, a misconfigured application — because a listing follows the incident, not the intent; set reverse DNS that matches the sending name; and when choosing an address, look up its history before you inherit it.

Search engines keep a view of how trustworthy a site is, and Google now names one abuse of it explicitly: site reputation abuse, the practice of publishing third-party content on an established site mainly to ride on that site's standing in results. The policy, and its updates, are announced on the Search Central blog that this site follows.

For a domain that changes hands, this is the practical point: a name with a good history is valuable precisely because the history is real, and the fastest way to lose the value is to fill the name with content that has nothing to do with what earned it. The notes here exist for the opposite reason — to give the name a use that matches what it says.