Your SaaS sends thousands of transactional and marketing emails every week—password resets, onboarding sequences, billing notifications, and drip campaigns. If mailbox providers like Gmail, Outlook, and Yahoo perceive your sending behavior as risky, your messages land in the spam folder, effectively breaking your product’s user experience. Email reputation is the invisible, dynamic score determining your deliverability. It is not a static number but a layered system of authentication, engagement signals, complaint thresholds, and infrastructure health. This guide breaks down how providers evaluate your sending identity and the concrete steps to protect your domain’s ability to reach the inbox.
How Mailbox Providers Score Your Sending Identity
Every major mailbox provider maintains its own internal reputation model. There is no universal "email score" that transfers across all providers; your deliverability might be perfect at Gmail while Outlook throttles your traffic. Providers build reputation around two primary identifiers: your sending IP address and your domain. Since the rise of shared infrastructure—where thousands of SaaS companies send from the same IP pools via platforms like SendGrid or Amazon SES—the domain has become the dominant factor in reputation scoring.
Google evaluates domain reputation through "domain signals," which weigh complaint rates, authentication pass rates, user engagement (opens, replies, stars), and spam trap hits over a rolling 30-to-60-day window. Microsoft uses a similar, more opaque model tied heavily to their Junk Mail Reporting Program. A critical, often misunderstood reality is that switching email service providers does not reset your reputation. Your domain carries its history with it. A SaaS that burns through a provider with a 0.8% complaint rate will face the same filtering issues after migrating unless the underlying sending behavior changes first.
Decision rule: Before changing ESPs, audit your domain-level reputation using Google Postmaster Tools and Microsoft SNDS. If your domain reputation is poor, fix your list hygiene and engagement practices before migrating; otherwise, the new provider will simply inherit your existing filtering problems.
The Authentication Triad: SPF, DKIM, and DMARC
Authentication is the foundation mailbox providers use to verify your identity. Three protocols work in tandem: SPF (Sender Policy Framework) lists the IPs authorized to send for your domain; DKIM (DomainKeys Identified Mail) attaches a cryptographic signature proving the message was not altered in transit; and DMARC (Domain-based Message Authentication, Reporting, and Conformance) instructs providers on how to handle failures—quarantine, reject, or do nothing. Most SaaS teams fail because they ignore alignment. DMARC checks if the domain in the "From" header matches the domain validated by SPF or DKIM. If your marketing emails show "From: hello@yourapp.com" but DKIM signs with "d=emailprovider.com," DMARC alignment fails, and your policy is effectively ignored.
Micro-example: A B2B SaaS sending billing notifications through a third-party tool noticed Outlook users reporting password resets as spam. The root cause was a misaligned DKIM signature—the envelope sender was authenticated, but the visible "From" address lacked a matching DKIM record. Once they configured custom DKIM signing for their domain, the "via" or "on behalf of" tags disappeared from the UI, and deliverability stabilized.
Decision rule: Aim for a DMARC policy of `p=reject` with full alignment. Once achieved, spoofing attempts against your domain drop by over 95%, and your authenticated delivery rate climbs, directly improving your reputation score.
Managing Engagement and Complaint Thresholds
Mailbox providers treat user engagement as a proxy for content quality. High open rates and replies signal that your emails are expected and relevant, while high complaint rates—users clicking "Report Spam"—are the fastest way to destroy your reputation. Providers monitor the ratio of "spam complaints" to "total sent" with extreme sensitivity. A complaint rate exceeding 0.1% (one complaint per 1,000 emails) is often the threshold where automated filtering kicks in, leading to throttling or outright blocking.
SaaS companies often inadvertently trigger these thresholds through "graymail"—emails that aren't strictly spam but aren't wanted, such as excessive marketing blasts to inactive users. If your onboarding sequence sends five emails in two days to a user who has already churned, they are likely to report the message rather than hunt for an unsubscribe link. This behavior signals to Gmail that your domain is a source of nuisance, not value.
Micro-example: A SaaS platform noticed their transactional emails were hitting spam after a major product update. They realized their "What's New" newsletter was being sent to every user in their database, including those who hadn't logged in for six months. By segmenting their list to only include active users, they reduced their complaint rate by 60% and restored their primary inbox placement.
Decision rule: Implement a "sunset policy." Automatically suppress users who have not opened or clicked an email in the last 90 days. This protects your reputation by preventing you from sending to addresses that are likely to bounce or report you.
Infrastructure Health and IP Warm-up
While domain reputation is king, IP reputation still matters, especially when using dedicated IP addresses. When you start sending from a new IP, mailbox providers have no history of your behavior. If you suddenly send 50,000 emails from a "cold" IP, providers will flag this as a potential botnet or spam campaign. This is why "IP warm-up" is a mandatory process for any SaaS scaling its volume. You must gradually increase your daily volume over several weeks, allowing providers to observe your sending patterns and build trust in your infrastructure.
Infrastructure health also involves maintaining clean DNS records. Beyond SPF, DKIM, and DMARC, ensure your PTR records (reverse DNS) are correctly configured to point back to your domain. If your IP address resolves to a generic cloud provider hostname instead of your own domain, it creates a "mismatch" that triggers spam filters. This is particularly common in self-hosted or poorly configured cloud environments.
Micro-example: A startup moved to a dedicated IP to improve deliverability but saw their open rates plummet overnight. They had skipped the warm-up, sending their entire list of 100,000 users on day one. They had to pause all non-critical emails for two weeks and restart the warm-up process at 5,000 emails per day to regain the trust of the major providers.
Decision rule: If you must use a dedicated IP, never exceed your previous day's volume by more than 20-25% during the warm-up phase. If you are a low-volume sender, stick to shared IP pools managed by reputable ESPs.
Conclusion
Maintaining a high email reputation is an ongoing operational requirement, not a one-time configuration task. It requires a disciplined approach to authentication, a strict adherence to user engagement metrics, and a cautious strategy for infrastructure scaling. By ensuring your DMARC alignment is perfect, suppressing inactive users, and respecting the warm-up process for new IPs, you build a resilient identity that mailbox providers learn to trust. The goal is to make your domain synonymous with legitimate, expected communication. When your technical foundation is solid and your engagement data is clean, your transactional emails will reliably land in the inbox, ensuring your users receive the critical notifications they need to stay engaged with your SaaS. Monitor your feedback loops, audit your authentication regularly, and treat your sender reputation as a core asset of your product’s growth.