What are the first steps after detecting a reputation crisis?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Your open rates just fell off a cliff. Bounces are climbing. Someone forwarded you a screenshot of your email sitting in spam. Whatever triggered the alarm, the next 48 hours matter more than anything you'll do in the following weeks. Here's how to move.
First: figure out how bad it actually is. Before you touch anything, check your postmaster tools. Gmail Postmaster Tools will show your domain reputation and spam rate trend. Check whether the problem is one mailbox provider or several, one segment or your whole list, and whether things are still getting worse. A dip at one provider is a headache. A dip everywhere is a fire.
Second: stop the bleeding. Pause any non-critical marketing sends. This isn't forever, just long enough to stop digging the hole deeper. If you're sending transactional emails on a separate stream (password resets, order confirmations), those can usually stay on. If you're on a shared setup with no separation, the decision gets harder (and question 018.003.003 covers exactly that).
Third: preserve everything before it disappears. Pull your bounce logs, delivery reports, and complaint data. Screenshot your postmaster dashboards. Note the exact time you first saw symptoms and what had gone out just before. Log files rotate. Postmaster graphs don't keep forever. You want this evidence for diagnosis, and sometimes for appeals.
Fourth: loop in your team. Someone needs to know this is happening, even if it's just a Slack message saying "we have a deliverability issue, investigating now." Set a realistic expectation: reputation recovery typically takes days to weeks, not hours. Promising a quick fix before you know the cause is how stakeholder trust erodes.
Fifth: start the actual diagnosis. Only now, with the sending paused and the evidence saved, do you start looking for the root cause. Common culprits include a spike in spam complaints, a batch of bad addresses hitting spam traps, a sudden volume increase that looked suspicious, or an authentication failure that let something spoofed get through. Don't implement fixes until you know which one you're dealing with.
If you're not sure where to start with the diagnosis, our SOS hotline is free. No pitch, just help from someone who's seen this before.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
