My primary domain is more than 25 years old and has never been used for spam. Until recently, email was forwarded through WHM/cPanel to my Gmail account without any major problems.
About a week ago, I moved my website to a new VPS and recreated the forwarding rules. I've now discovered that roughly 241 of 250 forwarded messages were rejected by Gmail. The mail log shows Gmail returning a 550 5.7.1 error saying the message was suspicious because of the "very low reputation of the sending domain."
The domain's reputation looks excellent in Google Postmaster Tools, and the new VPS IP does not appear on normal blacklist checks. However, the VPS provider's parent ASN is listed by a broad blacklist service.
Could the problem be the new VPS IP, or is forwarding failing SPF/DKIM authentication? What should I configure in Exim/cPanel to get these messages delivered reliably?
4 Answers
Check that SPF, DKIM, and DMARC are correctly configured for the domain on the new server. Gmail may describe authentication failures as a reputation problem, even when the domain itself has a good history. A stricter DMARC policy can also help once SPF and DKIM are passing.
The main forwarding issue is usually SPF. The forwarded message still claims to be from the original sender, but it arrives from your VPS, so the original sender’s SPF record does not authorize your server. Enable Sender Rewriting Scheme (SRS) in Exim/cPanel or use a forwarding service that supports SRS. This rewrites the envelope sender so SPF can pass through the forwarding step.
Also remember that messages with spam-like content can still be rejected even after SRS is enabled. SRS fixes the authentication problem, not every reputation or content signal.
A new VPS IP has no established Gmail sending history, so it may receive extra scrutiny even if it is not listed on a blacklist. Verify that the IP has correct reverse DNS/PTR matching the mail hostname, and confirm that SPF, DKIM, and DMARC all pass from the new server. SRS is still the most important setting for forwarded mail.
For a small personal setup, operating SMTP delivery from a VPS can be more trouble than it is worth. An outbound mail provider such as Amazon SES or Mailgun can give you an established delivery infrastructure, but you should still configure SPF, DKIM, and DMARC correctly. A blacklist entry covering an entire ASN is not necessarily the direct cause, though it may be a sign that the hosting network has a poor overall reputation.
Forwarding can make this especially confusing. I had a similar issue where adding proper authentication and tightening DMARC improved delivery after Gmail had some time to update its signals.