Inbox Watch
Menu
All guides

When to rest or replace a sending domain

Sun Oct 18 2026 00:00:00 GMT+0000 (Coordinated Universal Time)

Not every bad week means the domain is dead. Not every green dashboard means you should keep sending. The Monday report uses three words, and each one has a reason under it.

Replace

Replace means stop. Move live campaigns off the domain.

  • A major list hits. NordSpam lists the domain or a published mail IP, PSBL lists that IP, or Mailspike returns a block code (127.0.0.2, or reputation L3–L5).
  • SPF is missing, duplicated, invalid, or +all.
  • No DKIM key was found.
  • The last 7 days bounced 8% or more, with at least 30 emails sent.
  • The 7-day reply rate is under 30% of this domain's own baseline, again with at least 30 emails sent, and the baseline itself was not zero.

A replacement domain still needs SPF, DKIM, and DMARC before it takes volume. Pointing the same burned sending pattern at a fresh domain just burns the next one.

Rest

Rest means pause or cut volume, then look. The domain might come back.

  • A minor list hits: LashBack UBL, s5h, or Mailspike L2 (127.0.0.13). Confirm on that operator's own lookup. A refusal or an unrecognized return code is "unavailable", which is not a listing.
  • UCEPROTECT Level 1 is not in this list. It is recorded, and SendGrid treats it as low impact. It does not, by itself, rest or replace the domain. Spamhaus, SURBL, SpamCop, and Barracuda are not queried.
  • SPF does not end in ~all or -all.
  • DMARC is missing, invalid, or p=none.
  • Bounce rate is at least 4% and under 8%.
  • Reply rate is under half of baseline but not yet under 30% of it.
  • The domain is under 14 days old.

Keep

Keep means authentication is in place and the last 7 days are inside the baseline. If there is not enough history yet, the report says so instead of inventing a baseline. The first baseline locks once an earlier window, excluding the latest 7 days, has at least 80 sent emails. It stays put. A falling domain should not drag its own baseline down with it.

Alerts use the same measurements and fire earlier than Monday: a new blacklist hit, authentication that used to pass and now does not, a bounce spike, or a 7-day reply rate under half of baseline. The Monday note is the rollup. The alert is the interruption.