The complete prevention guide for startup founders and small business owners. Twelve causes, twelve fixes — read this before you send a single email from your new domain.
You launched your business. You registered a domain. You set up an email account and started reaching out to customers, partners, and leads. Then one day — silence. Your emails stop arriving. No error. No bounce. They just vanish. You've been blacklisted, and you didn't even know it was possible.
This happens to thousands of new businesses every year. The founders who avoid it are not luckier — they simply knew what to set up and what to avoid before going live. This guide covers everything they know.
"A blacklisting doesn't mean you're a spammer. It usually means you skipped a step that every legitimate sender needs."
This is the number one mistake made by founders who just registered a domain. You write 200 outreach emails on day one and send them all at once. To the blacklist systems watching global email traffic patterns, a brand-new domain that suddenly fires hundreds of emails looks identical to a spam operation.
Email reputation is earned, not granted. Your domain starts with zero trust. Major providers like Google and Microsoft watch your sending volume closely in the first 30–90 days. Any sudden spike gets flagged, and automated blacklist systems pick it up within hours.
SPF — Sender Policy Framework — is a DNS record that tells the world which mail servers are authorised to send email on behalf of your domain. Without it, anyone can send email pretending to be you, and every receiving mail server knows you haven't taken the basic step of proving who you are.
Many blacklists will flag or pre-emptively list domains with no SPF record. It takes five minutes to add one and it protects both you and your recipients.
Type: TXT
Host: @ (or your domain: yourdomain.com)
Value: v=spf1 include:_spf.google.com ~all
# If you use Mailgun:
Value: v=spf1 include:mailgun.org ~all
# If you use multiple sending services:
Value: v=spf1 include:_spf.google.com include:mailgun.org ~allLog into your domain registrar (GoDaddy, Cloudflare, Namecheap, etc.), go to DNS settings, and add a TXT record at your root domain (@). Your email provider will give you the exact value to paste. Only create one SPF record — multiple SPF records cancel each other out.
DKIM — DomainKeys Identified Mail — adds a cryptographic signature to every email you send. When a receiving server gets your email, it checks this signature against a public key stored in your DNS to confirm the message was genuinely sent by you and hasn't been tampered with in transit.
Without DKIM, your emails are easily forged and more likely to be treated as suspicious. Many blacklists now consider a missing DKIM record a sign that a domain is being used for spam, because legitimate senders always authenticate.
Type: TXT
Host: mailo._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUA...
(your provider generates this key for you)Your email provider (Google Workspace, Mailgun, SendGrid, Mailchimp, etc.) will generate a DKIM key pair for you. They give you a TXT record to copy into your DNS. Do this in your provider's settings under "Domain authentication" or "Email authentication." It activates within 24–48 hours of adding the record.
DMARC — Domain-based Message Authentication, Reporting & Conformance — is the policy layer that sits on top of SPF and DKIM. It tells receiving servers what to do when an email fails those checks: ignore the failure (p=none), send it to spam (p=quarantine), or reject it outright (p=reject).
In 2024, Google and Yahoo made DMARC mandatory for anyone sending more than 5,000 emails per day. Many blacklists now flag domains that have no DMARC record at all. A p=none policy is better than nothing but offers no real protection.
Type: TXT
Host: _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
# Once SPF and DKIM are confirmed working, move to:
Value: v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com
# Full enforcement (ideal):
Value: v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@yourdomain.comp=none so you can receive reports without affecting email flow.rua email address for two weeks to understand your sending landscape.p=quarantine.p=reject.A PTR record is the reverse of an A record. When someone does a standard DNS lookup for your domain, they get your IP address. A reverse lookup (PTR) goes the other direction — it starts with an IP and returns a hostname. Many enterprise mail servers refuse to accept email from IPs with no PTR record, treating the absence as a sign of a fly-by-night spam operation.
This is especially important if you send email from your own server or VPS. Shared hosting and managed email services (Google Workspace, Microsoft 365, Mailgun) handle this automatically on their IPs — but if you control your own sending IP, you must set it up yourself.
Contact your hosting provider or VPS provider and request a PTR record be set for your sending IP. The value should resolve back to a hostname that forward-resolves to the same IP. Example: 217.154.41.178 → mail.yourdomain.com → 217.154.41.178. Most hosts allow this through a support ticket or control panel.
This one catches people completely off guard. You're on shared hosting. You've done everything right. And then one day your domain is blacklisted — because another website on the same shared IP address was sending spam. You are guilty by association.
UCEPROTECT Level 3 (L3), the listing affecting baloservices.co.uk in our test, is a perfect example: it blacklists entire IP ranges and Autonomous System Numbers (ASNs), meaning all domains sharing that hosting provider's IP block get listed together, regardless of individual behaviour.
Real example: baloservices.co.uk resolved to IP 217.154.41.178 (Webfusion shared hosting). The entire /24 subnet was listed on UCEPROTECT L3 due to another tenant. This is not rare — it's a standard risk of shared hosting for any business relying on email.
uceprotect.net with an explanation of the shared hosting situation.Purchased email lists are one of the fastest routes to a blacklisting. These lists are full of old addresses, invalid accounts, and deliberate spam traps — email addresses created by blacklist organisations specifically to catch senders who use dirty lists. The moment you email a spam trap, the sending IP and domain are flagged immediately.
The same risk applies to contacts you scraped from the web years ago, or lists you pulled from an old database. People change email providers, accounts expire, and what was a valid address in 2022 may be a spam trap or bounce by 2026.
When someone presses "Mark as spam" in Gmail, Outlook, or Apple Mail, that action is reported back to the sending domain's reputation profile. Google considers anything above a 0.10% complaint rate a serious problem. Above 0.30% and your emails will be blocked outright at Gmail. Other providers have similar thresholds.
For a startup sending 500 emails, that means just one or two spam clicks can start damaging your reputation. New senders have no trust buffer — every complaint hits harder.
Since February 2024, Google requires that bulk senders include a one-click unsubscribe link in all marketing and promotional email. This is not just a best practice — it is now a technical requirement enforced through Gmail's List-Unsubscribe header. Senders who don't comply see emails routed to spam or blocked entirely.
UK and EU businesses also have legal obligations under PECR and GDPR to honour unsubscribe requests promptly. In the US, the CAN-SPAM Act requires an unsubscribe mechanism and mandates you action it within 10 business days.
List-Unsubscribe and List-Unsubscribe-Post headers to your sending configuration (most ESPs like Mailchimp, Mailgun, and SendGrid do this automatically).Even if your list is clean and your authentication is perfect, a sudden massive volume increase will trigger spam filters. Blacklist systems look for anomalous behaviour — a domain that sent 12 emails last week and 4,000 this week looks like an account that was either taken over or is being used to run a campaign with no legitimate history.
This is particularly dangerous for seasonal businesses, product launches, and anyone who built up a subscriber list before launching their email infrastructure.
Your domain gets blacklisted and you genuinely did nothing wrong — because someone else took control of your account or server and used it to send spam. This is more common than most founders expect. Weak passwords, reused credentials, phishing, or an outdated WordPress plugin can all lead to your server being used as a spam relay while you're asleep.
The first sign is often a sudden blacklist appearance on multiple registries simultaneously, or receiving bounce messages for emails you never sent.
Content filters score every email before it reaches an inbox. Certain patterns — excessive use of capital letters, words like FREE, GUARANTEED, WINNER, or too many exclamation marks — push your spam score up. Emails with no plain-text version, image-heavy layouts with little text, or a suspicious ratio of images to copy all score poorly.
Copy-pasted templates used by thousands of other senders are also flagged because spam filters see the same structure arriving from multiple different senders.
Run a free scan across 68 blacklist registries, DNS authentication checks, IP reputation, and breach detection — in under 30 seconds.
Scan my domain free →Before you send your first email from a new domain, work through this list. Tick every box and you'll start with a clean reputation, proper authentication, and none of the traps that catch most founders off guard.
_dmarc.yourdomain.com (start with p=none)If you're reading this after a blacklisting has already happened — don't panic. Nearly every listing is reversible. The key is working through it methodically rather than just repeatedly submitting removal requests (which can work against you on some registries).
Step one: Find the listing. Run a full scan across all major blacklists. Not all registries are equal — a Spamhaus listing is far more serious than a SORBS listing, and the removal process is different for each.
Step two: Fix the root cause first. Most registries will not remove you if the underlying problem still exists. If you were listed for sending spam, fix your authentication and list hygiene before requesting removal. If it's a shared hosting issue, document that clearly.
Step three: Submit a formal removal request. Each registry has its own process. Write professionally, explain what caused the listing and what you've done to resolve it. Aggressive or repeated requests can delay removal on some systems.
Step four: Monitor until clear. Removal is not always instant. Some registries take 24 hours. Others take up to 14 days. Set up monitoring so you know the exact moment you're removed.
ClearPath checks 68 blacklists, scores your DNS health, audits your IP reputation, and alerts you the moment anything changes. Most founders set it up in under 5 minutes.
Start monitoring free →