What are domain reputation feeds?

Domain reputation feeds are continuously updated data streams that rate domains by their trustworthiness. Security systems use them to make real-time decisions about whether to allow connections, deliver email, or block content from particular domains.

The data in a domain reputation feed typically includes a reputation score or category, when the domain was first registered (newly registered domains are inherently less trusted), which threat categories have been associated with it (spam, phishing, malware distribution, botnet command-and-control), historical flags or incidents, and sometimes WHOIS data. The most sophisticated feeds also track reputation changes over time: a domain that was clean six months ago but has started appearing in phishing campaigns is a different risk than one that's always been clean.

For email specifically, domain reputation feeds affect a few things: whether your sending domain gets flagged as associated with abuse (which affects your deliverability even if you haven't done anything wrong, if your domain has been spoofed or compromised), whether links in your emails lead to domains that security gateways block, and whether newly registered domains in your organization trigger alerts.

Providers of domain reputation data include Spamhaus (particularly their Domain Block List), Cisco Talos, and various commercial threat intelligence platforms. Mailbox providers like Gmail maintain their own proprietary reputation data that isn't available externally but significantly influences filtering decisions.

For senders concerned about their own domain reputation, our free Review My Emails blocklist checker can tell you whether your domain is flagged on major public blocklists. For the internal reputation mailbox providers hold, sender reputation covers what signals affect your standing and how to improve it.