My main domain is more than 25 years old and has never been used for spam. Until recently, email forwarding through WHM/cPanel to Gmail worked normally. Seven days ago I moved the website and mail forwarding to a new VPS and copied the existing forwarders. I've now discovered that roughly 241 of 250 forwarded messages were rejected by Gmail with a 550 5.7.1 error saying the sending domain has a very low reputation. The domain's reputation looks excellent in Postmaster Tools, and the VPS IP does not appear on common blacklists, although its parent ASN is listed by one blacklist service. Could the new IP's lack of history be responsible, or is this more likely an SPF, DKIM, DMARC, or forwarding configuration problem? What should I check or change?
3 Answers
Check SPF, DKIM, and DMARC on the domain first. Gmail may apply a low-reputation-style rejection when authentication is missing or failing, even if the domain itself has a good history. The move to a new VPS may simply have exposed a configuration problem that wasn’t visible before. Verify the records and inspect the authentication results on a test message.
Also verify the new VPS has valid reverse DNS, with the PTR record matching the mail hostname, and that the hostname resolves back to the same IP. Confirm SPF, DKIM signing, and DMARC alignment from the new server. If you don’t want to maintain all of this yourself, forwarding through a mail provider or using a transactional service may be more reliable than sending directly from a new VPS.
Forwarding has a specific SPF problem: the original sender’s domain authorizes the original mail server, not your VPS. When your server forwards the message, Gmail sees the VPS delivering mail while the envelope sender still belongs to someone else, so SPF can fail. Sender Rewriting Scheme (SRS) rewrites the envelope sender during forwarding and is usually the proper fix. Enable and test SRS in the Exim configuration, then confirm that DKIM survives forwarding and that DMARC alignment is handled correctly.
The content and reputation of the original message can still matter, but SRS is the important thing to address for normal forwarding. Simply adding every possible sender to your own SPF record generally won’t solve this situation.
A new IP can make the issue more noticeable because it has no established sending history. In my case, tightening the DMARC setup and correcting authentication improved delivery after a few days.