Fix: Gmail Email Rejections Due to Poor Domain Reputation in Microsoft 365
🔍 Symptoms
⚠️ What You May Experience
- Emails rejected by Gmail SMTP servers
- Messages marked as spam despite valid SPF, DKIM, and DMARC
- Domain flagged by external email reputation / blocklist providers
- Successful delivery to other providers, but Gmail still rejecting
🧠 Root Cause
💡 Two-Stage Failure
- Initial rejection was due to missing or misconfigured email authentication records (SPF, DKIM, DMARC)
- After fixing DNS records, most providers accepted emails — but Gmail continued blocking because the domain had a poor sending reputation and the domain or IP was listed by email reputation / blocklist systems
- Root issue traced to: a compromised account sending bulk phishing emails
⚠️ Key Point
Fixing DNS records alone is not sufficient once Gmail has flagged a domain for poor reputation. Active remediation and a controlled warm-up period are required.
🛠️ Step-by-Step Resolution
Validate Email Authentication
Ensure all required DNS records are correctly configured — SPF, DKIM, and DMARC must all be in place with proper alignment.
Connect-ExchangeOnline # Check DKIM configuration Get-DkimSigningConfig # Verify accepted domains Get-AcceptedDomain # Review outbound spam policy Get-HostedOutboundSpamFilterPolicy
Stop Unauthorised Email Activity
Identify and disable all compromised accounts — all outbound phishing activity must be fully stopped before requesting blocklist removal.
Connect-MgGraph -Scopes "User.ReadWrite.All" # Disable compromised account Update-MgUser -UserId "user@yourdomain.com" -AccountEnabled $false # Revoke all active sessions Revoke-MgUserSignInSession -UserId "user@yourdomain.com"
Request Removal from Reputation / Blocklist Systems
Check your domain and IP reputation, then submit delisting requests once the abuse is fully stopped and security controls are in place.
✅ Key Delisting Resources
- Google Postmaster Tools — monitor Gmail delivery and domain reputation
- Microsoft Junk Mail Reporting — delist from Microsoft’s blocklist
- MXToolbox Blacklist Check — check third-party blocklist status
Gmail Deliverability Recovery
Gradually rebuild domain reputation — Gmail recovery is not instant and requires a controlled warm-up period of clean sending behaviour.
✅ Recovery Approach
- Request recipients using Gmail to whitelist your domain as a short-term measure
- Start with low-volume emails to engaged recipients only
- Avoid bulk or marketing emails temporarily
- Monitor bounce rates and spam complaint rates via Google Postmaster Tools
⚠️ Recovery Timeline
Gmail reputation recovery may take several weeks of clean sending behaviour before full deliverability is restored.
💡 Best Practices / Recommendations
- Enable outbound spam protection policies in Exchange Online to detect and restrict compromised accounts automatically
- Monitor domain reputation regularly using Google Postmaster Tools and MXToolbox
- Implement DMARC policy = quarantine or reject after stabilisation to prevent future domain spoofing
- Use Microsoft Defender for Office 365 to detect outbound phishing attempts in real time
- Enforce MFA and Conditional Access to prevent account compromise from recurring
📚 References & Further Reading
- 🔗 Use DKIM to validate outbound email — Microsoft Learn
- 🔗 Use DMARC to validate email — Microsoft Learn
- 🔗 Outbound spam controls in Microsoft 365 — Microsoft Learn
✅ Key Takeaway
Fixing SPF, DKIM, and DMARC is necessary but not sufficient — if a compromised account sent phishing emails, Gmail’s domain reputation scoring will continue to block messages until the root cause is addressed and reputation is rebuilt through a controlled low-volume warm-up period.