Burned Domain vs Burned Inbox: How to Tell the Difference
Domain-level damage and inbox-level damage require completely different responses. Here's how to diagnose which one you're dealing with.
When deliverability collapses, operators often say "my inboxes are burned." But sometimes the problem is the domain, not the individual inboxes. And sometimes it's both. Distinguishing between these matters because the fix is different — and replacing the wrong thing wastes time and money.
Domain-level reputation damage
Domain reputation is associated with your full domain (e.g., yourcompany.com). Every inbox on a domain shares that domain's reputation. If the domain itself has a reputation problem, all inboxes on it are affected — regardless of which specific inbox sent what.
Signs of domain-level damage:
- All inboxes on the domain are in spam simultaneously
- Even new inboxes added to the domain immediately have placement problems
- Domain is blacklisted on major RBLs (Spamhaus, Barracuda)
- The problem started around the same time for all inboxes on the domain
Inbox-level reputation damage
Individual inbox (account) reputation is specific to the email address — e.g., john@yourcompany.com. An inbox can develop bad reputation while the domain remains relatively clean, particularly if one inbox was sending more aggressively or to lower-quality lists than others.
Signs of inbox-level damage:
- One or two specific inboxes are failing while others on the same domain are fine
- The affected inboxes were sending at higher volumes or to riskier lists
- Placement test fails for specific inboxes but passes for others on the same domain
How to diagnose
Step 1: Test each inbox separately
Run a placement test for each inbox on each domain. Send the test from each specific inbox account, not just from the domain in general. Compare results.
Step 2: Check blacklists
Run the blacklist checker on the domain itself and on the sending IP. Domain blacklisting = domain problem. IP blacklisting = may affect all inboxes using that IP.
Step 3: Check auth at domain level
Authentication (SPF, DKIM, DMARC) is domain-level. If auth is broken, every inbox on that domain is affected equally.
The three scenarios and responses
Domain damaged, inbox OK
If domain reputation is the issue (blacklisted, auth failed), you have domain-level work to do. Fix auth, request delisting. All inboxes on this domain are affected. During recovery, migrate campaigns to different domains if continuity is needed.
Inbox damaged, domain OK
If specific inboxes are the problem but the domain is clean, you may be able to retire only the affected inboxes and add fresh ones on the same domain. This is the more favorable scenario — the domain reputation survives and recovery is faster.
Both damaged
The most common crisis scenario — aggressive sending has damaged both the domain and individual inboxes. In this case, the domain needs full recovery or replacement, and individual inbox history doesn't matter because the domain itself is the primary problem.
The decision tree
- Are all inboxes on one domain failing? → Domain problem → check domain blacklists and auth
- Are specific inboxes failing but others on the same domain are fine? → Inbox problem → consider retiring specific inboxes
- Is a whole domain pool failing across multiple domains? → Check if IPs are shared, check if there's a common ESP issue
Use the burn score calculator for each domain and inbox combination to get a structured assessment.
Run the checks first
Before replacing anything, run a free inbox placement test. You might find the issue is DNS, not the domain — and save yourself a week of unnecessary work.