The last two posts were about dragging a self-hosted sending domain to the inbox. Auth first, then the slow warm-up. Mine got there, and it stayed there for a good while. Postmaster Tools said High, campaigns landed, I stopped thinking about it.
Then months later placement started slipping on a list I had barely touched. Same auth records, same IP, same warm domain that had been fine all spring. Nothing in my setup had changed. The thing rotting underneath was the list itself, and it had been rotting quietly the whole time.
It took me too long to accept this. A list is not a static asset you clean once. It decays on its own whether you send to it or not, because the people on it change jobs, abandon inboxes, and mistype their address the day they signed up. Leave it alone for six months and a chunk of it is already dead. You just can't see which chunk until it starts costing you.
Not every bounce means the same thing
A bounce isn't one thing. It's a category, and the categories don't all behave the same.
A hard bounce is permanent. The mailbox does not exist, you get a 550 5.1.1 user unknown back, and that address should come off the list the moment it happens. Keep mailing it and you are telling Gmail you send to addresses you never verified, which is exactly what a spammer working off a scraped file does.
A soft bounce is temporary. Mailbox full, a 451 because the receiving server is greylisting you, a transient DNS hiccup. Those are fine once. The mistake is treating "soft" as "ignore." If an address softs on every send for two weeks, that is not temporary at all. The mailbox is full and nobody is ever coming back to empty it. Set a threshold, something like three or four consecutive softs, and retire it like a hard bounce after that.
The number the providers actually watch is the rate. Push past roughly two percent bounces on a send and you look like someone mailing dead data, and they start scoring the whole domain down for it, not just dropping the bad addresses.
The addresses that don't bounce are the ones that hurt you
Bounces are the easy problem because they announce themselves. The dangerous addresses are the ones that accept your mail and say nothing.
Spam traps are the clearest example. There are two kinds and neither one bounces. A recycled trap is an address that belonged to a real person once, went dead, and got repurposed by the mailbox provider specifically to catch anyone still mailing stale data. A pristine trap never belonged to anyone at all, it was seeded on a web page to catch scrapers. Both accept the message, return a clean 250, and file you as a sender who does not know their own list. You will not find them by looking. That is the point of them.
Then there are the merely dead. Not traps, just inboxes nobody opens anymore. They don't hurt you as loudly, but they drag down the one signal reputation is actually built on. That signal is whether people open and click. And given enough time abandoned inboxes are exactly what get recycled into traps, so today's dead weight is next year's landmine.
What verification can't do
List verification is the usual first move, and it is a good one. Mechanically it does an MX lookup on the domain, opens an SMTP conversation with the receiving server, and walks up to RCPT TO without ever sending a message. The server answers 250 if the mailbox is real or 550 if it isn't, and you drop the 550s. That genuinely clears out the obviously dead addresses before they cost you a bounce.
What it cannot do is the part people assume it does.
- A catch-all domain accepts every address at that domain, real or not, so verification gets a 250 for total garbage and marks it valid.
- Traps return 250 as well, by design, so no verifier can flag them.
- Greylisting and rate limits hand back ambiguous answers that get scored as unknown, not clean.
- Probe a large list hard from a single IP and the pattern itself looks like a directory-harvest attack, and you can get that IP blocked for running the check.
So verified is not the same as safe. It means you removed the addresses that admit they are dead. The toxic ones sail straight through. Treat verification as a floor to stand on and nothing more.
The real fix is the same lever as the warm-up
If reputation is built on engagement, then the thing that keeps a list healthy is the same thing that warmed the domain up in the first place. You stop mailing people who stopped caring.
A sunset rule does the work. Pick a window that fits your cadence, four months of no opens or clicks is a reasonable start, and anyone past it goes into a re-engagement send. One honest "still want these" email. The ones who open come back onto the active list, and the silence gets suppressed, not deleted, just stopped. It feels wasteful the first time you cut a few thousand people who might theoretically return. They won't, and while you wait for them to they are teaching every mailbox provider that your average recipient ignores you.
That is the trap in the slow version of this. A dirty list never fails on a single send. It degrades your domain reputation a little at a time, so by the time placement is visibly bad you have already spent weeks training Gmail to distrust you. Recovery is slow work after that.
Three legs, and the third one is the one you forget
Auth proves the mail is really from you. The warm-up earns you enough trust to land. Hygiene is what keeps that trust from leaking away while you are busy not thinking about it. Skip the third leg and the first two stop mattering, which is the whole story of the domain I thought was finished last spring.
I found it the boring way, by finally exporting the list and sorting by last-open date after ignoring it for months. Roughly a third of it had not opened anything in over half a year, sitting there deliverable and useless, dragging the average down for everyone who did still read the mail. Cutting them felt like deleting money. Placement recovered within a couple of weeks. Do the boring version on a schedule and you never have to have that particular afternoon.
Top comments (0)