For several weeks, Gmail has been rejecting mail from one of our domains and Postfix servers with a 550-5.7.1 error saying the sending domain has very low reputation. We discovered that an SPF include pointed to a domain that had expired, causing the entire SPF record to return a permerror. The invalid include was removed on August 9 after being broken for several days.
Before this happened, our spam rate was effectively zero, and SPF, DKIM, and DMARC were all configured correctly. Current testing and delivery statistics show those records passing, but Gmail still reports a reputation of zero and continues blocking messages. The Postmaster dashboard also displays an older SPF warning from before the fix, even though newer data shows SPF passing.
The rejection is happening during SMTP delivery, and Postfix has been retrying the queued messages. Should outgoing mail to Gmail be stopped temporarily so the domain can rebuild its reputation, or is it better to continue sending at a steady rate? Are there other technical checks or steps that can help restore Gmail delivery?
3 Answers
Check the SPF record independently from multiple resolvers and confirm it stays under the ten-DNS-lookup limit. A record can look syntactically fine while still returning a temporary or permanent error because of a nested include, an unavailable lookup domain, or a different MAIL FROM domain being used by the application. Also confirm that the sending IP, PTR record, forward DNS, HELO name, and DKIM selector all match the server actually delivering the messages.
I would not firewall Gmail or deliberately stop all delivery. Keep sending legitimate mail at a consistent, modest volume and avoid bursts caused by a large queue being released all at once. Remove or suppress invalid recipients, monitor complaints and bounces, and make sure automated retries are not creating an unusually high volume. Reputation recovery can take days or weeks after the underlying authentication issue is fixed.
Nine days can feel long, but that is still within the period where reputation systems may be recalculating. The fact that Yahoo and Microsoft accept the mail does not necessarily predict when Gmail will restore its reputation score.
Postmaster data is delayed and is better for long-term trends than for diagnosing an immediate rejection. The SMTP response and your mail logs are more useful here. Fixing the SPF permerror does not instantly erase the reputation damage, particularly if Gmail saw repeated failures or a backlog of retries. Keep checking the actual DNS response, DKIM signing and alignment, DMARC results, reverse DNS, and the HELO name. Also verify that there are no other expired includes on subdomains or alternate envelope-sender domains.
The visible SPF record now passes every checker, and SPF, DKIM, and DMARC all show successful results. The rejection specifically says the domain has low reputation, so the stale Postmaster warning seems separate from the SMTP problem.
The SPF record currently reports no issues and uses the expected sending IPs, MX mechanism, and a soft fail policy. I will audit the envelope sender and subdomains as well as the retry queue to make sure nothing else is still producing failures.