For several weeks, Gmail has been rejecting mail from one of our domains and Postfix servers with a 550-5.7.1 message saying the sending domain has very low reputation. We discovered that an SPF include pointed to a domain that had expired on July 29, making the SPF record invalid. The bad include was removed on August 9.
Before this happened, our spam rate was effectively zero, and SPF, DKIM, and DMARC were configured correctly. Current testing and delivery statistics show the records passing, but Gmail still reports the domain reputation as zero. The Postmaster data also appears stale and continues to show an older SPF failure from before the fix.
Should we temporarily stop sending mail to Gmail to avoid making the reputation worse, or is it better to continue sending normally? We also noticed that Postfix appears to retry some of these rejections, and we want to understand whether that is contributing to the problem.
3 Answers
A 550 response is normally a permanent rejection, so Postfix should not keep retrying it indefinitely. Review the exact SMTP status classification and your Postfix transport, retry, and bounce logs. If Gmail is returning a clear 550-5.7.1 response, the message should generally be bounced or deferred only if your configuration is incorrectly treating that response as temporary. Fixing the retry behavior will prevent a backlog from repeatedly hammering Gmail, but it will not by itself repair the domain reputation.
I would not firewall Gmail or deliberately stop all delivery. Send at a steady, normal volume, avoid bursts, and make sure old queued messages are not suddenly released in large batches. Also verify the SPF record from several public resolvers and confirm that every include still resolves and that the record stays within SPF's ten-DNS-lookup limit. Recovery can take days or weeks even after the DNS problem is fixed.
Postmaster metrics can lag behind DNS changes and are mainly useful for trends, not real-time troubleshooting. Correcting SPF will not immediately restore a reputation damaged by repeated SPF permerrors. Keep the configuration stable and give Gmail time to observe successful mail again. Check the complete path as well: PTR, HELO name, DKIM signing and alignment, DMARC alignment, sending IP reputation, and any other subdomains or envelope-from domains that might still contain the expired include.
The record now passes the external checks, and other major providers accept the messages. The frustrating part is that Gmail's dashboard still shows the older failure, so it is difficult to tell whether the current rejection is based on stale data or a separate reputation issue.