Reef

The Wisconsin sender ran a small agricultural supply company. Twelve thousand subscribers, mostly farmers and farm-supply distributors. Their open rates were healthy, their list was clean, their authentication was set up. They had hired Reef to do a quarterly audit and watch for trouble.

He told them: check your blocklist status daily. They said they'd check weekly. He said: at minimum twice a week. They said: we have other priorities.

Eight months in, he got a notification on a Tuesday afternoon. Their primary sending IP had been added to a Spamhaus listing. He emailed the sender within ten minutes.

The sender didn't read the email until Thursday morning. By then they'd sent two campaigns from the listed IP. Their delivery rate had cratered. Customers were calling support saying they hadn't received expected order confirmations. The reputation damage had compounded for forty-eight hours.

The delisting itself was straightforward, Spamhaus removed them within a day of the request. But the IP reputation didn't fully recover for six months. Their engagement metrics took a year to climb back to where they'd been. They lost two big customer contracts in the meantime.

Reef stayed on as their advisor. He also got daily access to their Postmaster Tools after that. The lesson he teaches now is the same one his uncle taught him, just dressed in different clothes: the warning signal arrives long before the disaster does, but only if you're looking.

---

Reef carries a small leather book. He's had it since he was eighteen. It has the names of every sender he's watched go down without saving.

Three of them he remembers most often.

The first was a B2B SaaS company that ignored his warnings about a reputation slide caused by a new sales-team email tool. They lost their domain reputation entirely. Migrated to a new domain, never recovered the customer-trust signal. Folded eighteen months later.

The second was a charity that spent four years building a clean newsletter list, then sent one campaign to a purchased list because a board member insisted. Hit a pristine spamtrap. The sending domain landed on three major blocklists in a single week. They couldn't reach their donors during their year-end appeal. Lost a third of their donations that quarter. Reorganized under a new name.

The third was a friend. Someone Reef knew personally, who ran a small ecommerce shop. They were proud of their reputation and treated it casually, the way people treat things they think they own. They sent through a compromised ESP partner and the spillover damage hit before anyone could intervene.

Reef doesn't read from the book in front of others. He reads it on the anniversary of each one, alone in the crow's nest. He says: we lose more from inattention than from malice. The book is to remind him that watching is a duty owed not just to the senders he works with, but to the ones he didn't get to.

Reef's intro:

There was a sender out of Manchester I worked with for two years. Clean list, careful campaigns, healthy team. They thought their inbox-placement was a permanent thing. It wasn't. It was a current they hadn't been watching, and the current shifted. By the time anyone noticed, the inbox-placement was gone, and getting it back was a six-month job. Reputation is the name of that current.

---

When you send an email, the receiving mailbox provider has to make a fast decision. Inbox? Spam folder? Reject entirely? They make this decision in milliseconds, and they make it based on a single thing: how much they trust you.

Sender reputation is the score that trust gets reduced to.

It's not one number. It's not visible in any single place. It's a composite signal that mailbox providers calculate continuously, behind closed doors, based on dozens of inputs. Some of those inputs you can see (Google Postmaster Tools shows you a small piece). Most you can't.

Reputation has two main layers. They behave differently. Senders who don't know the difference get blindsided.

Domain reputation. This is the trust score attached to your sending domain (or subdomain). It follows the domain forever. If you migrate to a new IP but keep the same domain, you carry your reputation with you. Domain reputation is built and lost slowly. It takes weeks of consistent good behavior to build it up. It takes a single bad campaign to drag it down. It takes months to rebuild after damage.

IP reputation. This is the trust score attached to your sending IP address. If you're on a shared IP pool with your ESP, you share the reputation of everyone else on that pool. If you have a dedicated IP, the reputation is yours alone. IP reputation is more volatile than domain reputation, but it can also be reset by switching IPs. Domain reputation is the one you actually own.

Most senders only think about reputation when something breaks. By that point, it's already late.

---

What goes into reputation? Mailbox providers don't publish the full formula, but the inputs are consistent across the industry.

Engagement signals. Opens, clicks, replies. The more your subscribers interact positively with your mail, the higher your reputation. Reply rates are the strongest single signal because they're the hardest to fake. A reply means a real person did something deliberate.

Complaint rates. Every time a subscriber clicks "this is spam" in their inbox, your reputation takes a hit. Mailbox providers want this rate below 0.3%. Above 0.5% and you're in trouble. Above 1% and you're nearly dead.

Bounce rates. Hard bounces (addresses that don't exist) are direct evidence of poor list hygiene. Bounces above 2% are a warning. Above 5% is a crisis.

Authentication results. SPF passing. DKIM passing. DMARC alignment. The Signaler's domain. Mail that fails authentication has worse reputation than mail that passes.

Spamtrap hits. Sending to addresses that have been turned into traps by ISPs or anti-spam services is the single fastest way to destroy reputation. One pristine spamtrap hit can put you on a major blocklist within a week.

Volume consistency. Mailbox providers expect predictable sending. A sudden spike in volume looks like a compromised account or a list-buy. Steady cadence builds trust. Volatility erodes it.

List quality signals. Engagement decay across the list, the percentage of inactive subscribers, the age of the list, the source of the addresses. Mailbox providers can't see your list directly, but they can infer health from how the list responds to your mail over time.

---

How do you actually see your reputation?

You can't see the full picture. Nobody outside the mailbox providers can. But you can see partial views.

Google Postmaster Tools shows you, for any domain you authenticate, a daily report card. Domain reputation rated as Bad / Low / Medium / High. IP reputation. Authentication pass rates. Spam rate. Delivery errors. It's free. It's the closest thing to seeing inside the inbox decision. Most senders never sign up.

Microsoft SNDS does similar work for the Microsoft mailbox network (Outlook, Hotmail, Live). It shows complaint rates per IP per day. It's also free. Even fewer senders sign up.

Yahoo and Apple don't publish this kind of data publicly. You infer their judgment indirectly through your engagement metrics with subscribers on those services.

Blocklist databases show you whether you've been listed by Spamhaus, SpamCop, Barracuda, SORBS, and others. Listings are the visible end of reputation damage. By the time you're listed, the damage was already happening for days or weeks.

You watch all of these. You watch them daily, or close to it. You catch the small drifts before they become large drops. That's the work.

---

Why does this matter so much? Because the mailbox decision happens in milliseconds, and it happens for every email you send, every time. A reputation drop doesn't just hurt one campaign. It hurts every campaign for as long as it takes to rebuild. Senders with healthy reputations see 95%+ inbox placement. Senders with damaged reputations see 60%, 40%, 20%. The math is brutal. A 40% inbox-placement rate means almost half the emails you spent money on never get seen.

The senders I respect most are the ones who treat reputation as a daily watch, not a quarterly review. Reputation is built and lost in small increments. You can't see what you don't watch. The watch is the work.

You're already on the right ship for reading this. Now go set up Postmaster Tools.

- Reef

Reef's intro:

I noticed the pattern in my second year of watching. Listings cluster around the middle of the week. Tuesday and Wednesday afternoons specifically. Not always, but often enough to be a pattern, not noise. I've checked it against my notes from a decade of watches. The pattern is real. Here's what it means and how to use it.

---

If you watch enough blocklist activity over time, you start to notice a rhythm.

Listings don't happen evenly across the week. They cluster. The cluster is heaviest on Tuesday afternoon and Wednesday morning. The cluster is lightest on weekends. There are real reasons for this, and knowing them changes how you watch.

The first reason is when senders send.

Most marketing email volume happens Tuesday through Thursday. Tuesday morning and mid-morning are the most popular send slots in the entire industry. ESPs see massive volume spikes during those windows. The bigger the volume spike, the more signal mailbox providers and blocklist operators have to work with. If your sending behavior is going to trigger a flag, it's most likely to trigger during the high-volume window. Because that's when the signal gets noticed.

Send a campaign with a 4% bounce rate on a Sunday at 2 PM and the listing might come a few days later. Send the same campaign on a Tuesday at 10 AM and the listing might come within hours. The difference is partly real-time monitoring, partly review queues, partly the math of a 4% bounce rate looking different against a low-volume background versus a high-volume one.

The second reason is when blocklist operators work.

Spamhaus, SpamCop, and the other major operators have humans in the loop. They run automated systems that flag suspicious sending patterns, but they also have analysts who review and confirm before adding to public lists. Those analysts work normal weekday hours. A pattern flagged on a Sunday night might not get reviewed until Monday afternoon, and the resulting listing might not propagate until Tuesday.

The third reason is when senders are watching, or not.

This is the part that makes the Tuesday Listing especially dangerous. Senders have weekly cadences. Marketing teams are heads-down on campaign launches Monday and Tuesday. Customer support is in firefighting mode through Wednesday. Nobody has time to check Postmaster Tools or run a blocklist scan during the busiest part of the week.

So the listing happens at peak volume, on the day senders have the least attention, with the longest window before anyone notices.

That's the Tuesday Listing.

---

Here's what it means in practice.

I've worked with senders whose monitoring schedule looks like this: blocklist check on Monday morning to start the week, Postmaster Tools check on Friday afternoon to wrap up. Two checkpoints, both off-cycle from when listings actually happen.

That schedule means a Tuesday listing has up to three full days to compound damage before anyone notices. Three days of campaigns sent through a listed IP. Three days of bounces piling up. Three days of delivery rates dropping while the marketing team thinks the campaign is working.

By Friday, when somebody finally checks, they're not looking at a listing. They're looking at a crater.

The fix is mid-week vigilance. Specifically, twice on Tuesday and twice on Wednesday. Morning check, afternoon check. It takes five minutes if you have automated monitoring, ten minutes if you're checking manually. The window of detection drops from three days to a few hours.

---

Some patterns I've seen that confirm the Tuesday Listing is real, not paranoia.

A sender I worked with for three years had clean weekly metrics for 94 of 156 weeks. Of the 62 weeks they had blocklist trouble, 41 of the listings were detected on Tuesday or Wednesday. That's 66%. Random chance would predict closer to 28%.

Another sender, an ecommerce shop with predictable Monday-morning campaign sends, never had a blocklist issue detected on a Saturday or Sunday in five years of watching. They had three Tuesdays and one Friday. The bias toward mid-week is consistent.

Anti-spam vendors have published their own data on this and the trend is the same. Mid-week is when the alarms ring.

---

What this means for the watch.

If you're checking blocklist status once a week, do it Tuesday afternoon. If you're checking twice a week, do it Tuesday and Thursday. If you're checking daily (which I recommend for any sender above 100K subscribers), make sure your daily check happens before noon Tuesday and before noon Wednesday.

Set up automated monitoring. There are free options (MXToolbox has a basic monitor, some are bundled with email-deliverability tools you might already pay for). Paid options are better for senders at scale (HetrixTools, Sender Score, dmarcian's blocklist add-on). Paid monitoring will alert you within minutes of a listing. Free monitoring may take hours. The difference matters most on Tuesday.

If your team's calendar has a "weekly metrics review" that happens on Friday, move part of it to Tuesday. Check the things that move fast on the day they're most likely to move. Check the things that move slowly later in the week.

---

The Tuesday Listing isn't a curse. It's a pattern. Patterns are what the Lookout works with. The senders who lose the most to mid-week listings are the ones whose attention is somewhere else mid-week. The senders who win against them are the ones who line up their watching with the rhythm of when listings actually happen.

The horizon doesn't move. The schedule of who's watching it does. Move yours to where the action is.

- Reef

Reef's intro:

There was a sender out of Dublin who got listed by Spamhaus on a Wednesday morning. They emailed me Wednesday afternoon in panic. We had a clean delisting and a recovered domain by Friday. The reason it went well wasn't luck, it was that they didn't try to fix it before they understood it. Most senders try to fix it first. Here's the order it actually has to go in.

---

You opened your blocklist monitor and your domain or IP is listed. Or your delivery rates have collapsed and someone finally checked, and the answer is on a public blocklist. The instinct is to do something immediately. The first thing to do is to not.

Listings are not random emergencies. They are receipts for something that already happened. The receipt is the easy part. Understanding what produced the receipt is the hard part. If you fix the receipt without understanding the underlying issue, the listing will come back, often within days, sometimes worse than the first time.

Here's the order. First hour, first day, first week.

First hour: confirm and contain

Before anything else, confirm the listing is real and current. Some monitoring tools have stale caches. Check the listing directly at the source. If Spamhaus has flagged you, go to spamhaus.org's blocklist removal center and look up the IP or domain yourself. If it's a smaller blocklist, check the operator's site directly. About one in ten "listings" turn out to be cached data from a listing that already cleared.

If it's real, stop sending. Pause every campaign queued to go out from the listed IP or domain. This is hard to do mid-week when there are scheduled drops, but every email sent from a listed IP makes the situation worse. Bounces compound. Complaint rates spike. The recovery window stretches.

If you have multiple sending IPs and only one is listed, route all traffic to the unlisted ones. If your domain is listed, you may need to pause sending entirely until you understand the cause.

First day: investigate, don't request

Don't submit a delisting request yet. I'll say that twice. Don't submit a delisting request yet. Generic "please remove me" requests get ignored. Specific "we identified the cause and fixed it" requests get approved. You can't write the second kind until you know what happened.

Investigation has to find the cause. Common causes:

Bought or scraped list. Did anyone on your team add purchased contacts to a sending list recently? Even a small batch can hit pristine spamtraps. Check signup sources for the past 30-60 days.

Old re-engagement attempt on inactive segment. Did someone try to "re-warm" a long-inactive list segment? Inactive subscribers from years ago are a high-probability spamtrap source.

Compromised account. Did anyone send mail through a compromised user account or stolen API key? Check your ESP's audit logs for unusual sending patterns.

Authentication failure. Did your DKIM key rotate without the public key being updated in DNS? Did your SPF lookup count creep over 10? Run an authentication check on your sending domain.

Volume spike. Did you send a campaign at 5x your normal volume? Mailbox providers and blocklist operators flag spikes as compromise indicators.

Subdomain or third-party sender. Did a vendor that sends on your behalf (transactional ESP, CRM, marketing tool) start sending from a misconfigured subdomain? Check DMARC reports for unrecognized sources.

The investigation is the most important step. Skip it and you'll be back on the list within a month.

First day continued: fix the cause

Once you know what caused it, fix it before submitting the delisting request. Fix means addressed and verified, not "we'll get to it."

If a purchased list was added, suppress every contact from that source. Document the suppression in writing.

If old inactive contacts were emailed, build a sunset policy and apply it to anyone past 12-24 months of inactivity.

If a compromised account or stolen key, rotate credentials, audit access, and document the rotation.

If authentication failed, fix the records and verify with an authentication-check tool. Don't just trust that the change went through.

If volume spike, document why it happened and implement a volume cap on future campaigns.

If a vendor was misconfigured, work with them to fix it and verify the fix.

By the end of day one, you should have a one-paragraph summary of what happened and what's been fixed.

First week: submit the delisting request

Now you write the delisting request. The format that works:

"Domain [or IP] [name] was listed by [blocklist] on [date]. After investigation we identified the cause as [specific cause]. We have taken the following steps to remediate: [list of specific actions]. We have verified [specific verification steps]. We respectfully request removal."

This format gets approved because it shows the operator three things: you understand what happened, you fixed it, and you've verified the fix. Generic "please remove me" requests show none of those things and get ignored or queued behind serious requests.

Most major blocklists process delisting requests within 24-48 hours of submission. Spamhaus is usually faster (often same-day for clear cases). SpamCop tends to auto-delist if the cause is genuinely fixed. Smaller blocklists are sometimes slow, sometimes never (some essentially abandoned databases still cause filtering on some receivers).

After delisting, do not resume normal sending immediately. Resume gradually. Volume goes back to maybe 30% of normal for a few days, then 60%, then 100%. Mailbox providers will be watching you closely after a listing event, and a return to full volume too quickly looks like the original problem reasserting itself.

After: the long recovery

Delisting is the start of recovery, not the end. Domain reputation, even after delisting, can take 30-90 days to fully recover. IP reputation is similar. During recovery, your inbox-placement rate will be lower than it was before the incident. Mailbox providers remember.

Watch your Postmaster Tools metrics daily during recovery. If domain reputation hasn't recovered to pre-incident levels within 90 days, there's likely a residual issue you haven't found.

Senders who handle a listing well often come out of it with better practices than they had going in. Senders who handle it badly end up listed again, often within months, often more severely.

The Tuesday Listing teaches you to watch. The first listing teaches you to investigate. The second listing teaches you that you didn't fix it the first time. Try not to need the third.

- Reef