Domain vs IP vs Mailbox Reputation: Which One Cold Senders Actually Control

On Google Workspace or Microsoft 365, you do not control IP reputation. You control your domain's reputation and the standing of each sending account. Both providers send your mail from large shared IP pools that they manage. Your domain reputation, tied to the domain in your From address and DKIM signature, follows you wherever you send. Each sending account also has its own limits and can be restricted on its own. So when cold email results drop, the useful question is which of the two is hurt: one account, or the whole domain.

For the general picture, our guide to improving sender reputation compares domain and IP reputation for all senders. This post is for cold senders on shared provider IPs.

The three layers

Layer	Attached to	Who manages it on Workspace / M365	Where you see it
IP reputation	The server IP your mail leaves from	The provider	Indirectly; blocklist lookups of the sending IP in a message header
Domain reputation	The From domain and the DKIM signing domain	You	Google Postmaster Tools; placement across all inboxes on the domain
Account standing ("mailbox reputation")	One user account	You, within the provider's rules	Sending errors and limits on that account

IP reputation: the provider's job

Microsoft explains how it protects its own IPs. Mail from its datacenters "that are determined to be spam are sent through the high-risk delivery pool", a separate set of IPs, so that "the normal IP address pool for outbound email maintains the reputation sending 'high quality' messages" (Microsoft, outbound delivery pools, updated 25 June 2026). Microsoft adds that delivery from the high-risk pool "isn't guaranteed".

That has a practical meaning for cold senders: the IP your mail leaves from is partly a result of how Microsoft judged your mail, not a cause you can fix. If a recipient blocks one Microsoft or Google IP, there is nothing to delist on your side. Look at your domain and account instead.

If you run your own sending server or pay for a dedicated IP, IP reputation is yours again. See shared vs dedicated IP and Sender Score explained.

Domain reputation: yours, everywhere

Google Postmaster Tools shows reputation "for domains and IP addresses that send DKIM-authenticated messages to Gmail accounts", and its Domain Reputation dashboard "only displays messages sent from the exact domain used for DKIM and SPF authentication" (Postmaster Tools dashboards). Two consequences:

• It moves with you. Switch sequencer or inbox provider and the domain's history comes along.
• It is shared by every inbox on the domain. Ten inboxes on one domain build or damage one reputation together.

That is why cold email setups use separate sending domains: one damaged domain should not take the main company domain with it. Our Postmaster Tools guide covers what the dashboards show and their limits.

Account standing: the per-inbox layer

No provider publishes a per-mailbox reputation score. They do publish what happens to an account:

• Microsoft 365. A user who exceeds the service's sending limits or the outbound spam policy limits "is restricted from sending email, but they can still receive email", and further sends return "550 5.1.8 Access denied, bad outbound sender" (Microsoft, restricted entities, updated 30 October 2026). An admin can remove the restriction, and Microsoft says it is usually lifted within an hour. Our Microsoft 365 restricted sender post covers the fix.
• Google Workspace. A user who exceeds a sending limit can be blocked from sending for up to 24 hours (Gmail sending limits).

Account standing also shows up in less formal ways. A brand-new inbox with no history, or one that suddenly jumps from 10 to 80 sends a day, tends to see worse placement even when the domain is fine. That is why warmup and gradual ramps are done per inbox.

Which one is hurt? Read the pattern

What you see	Most likely layer	Why
One inbox gets 550 5.1.8 or a "limit exceeded" notice	Account	The error is about the sender account
One inbox's replies drop, other inboxes on the same domain are fine	Account	Domain reputation would hit all of them
Every inbox on one domain lands in spam; other domains are fine	Domain	Shared domain reputation
421 4.7.0 "very low reputation of the sending domain" at Gmail	Domain	Google names the domain; see Gmail low domain reputation
451 4.7.650 throttling from Outlook.com across domains	IP / provider-side	See Microsoft 451 4.7.650
Every domain and inbox drops at once	Content, list or infrastructure	Look at what they share: the lead source, the copy, the tracking domain
High hard bounce rate on one campaign	The list	Bounces damage the domain and accounts that sent them

The last row matters most. Bad lists are the most common way cold senders damage both layers at once. Every hard bounce counts against the account that sent it and the domain it was signed with. Our post on whether it is your list or your domain walks through that split.

What to do for each

Account problem

1. Stop sending from that inbox.
2. Read the exact error. For 550 5.1.8, secure the account (password, MFA) before asking an admin to unblock it.
3. Restart at a low daily volume and ramp again. Check what changed: a sudden volume jump, a new list, or a new sequence.

Domain problem

1. Pause or slow every inbox on the domain.
2. Check authentication with the cold email domain checker and blocklists with the blacklist check.
3. Send only to your most engaged and freshly verified recipients until placement recovers.
4. If it does not recover, retire it. See when to retire a cold email domain.

Provider-side IP problem

1. Confirm it is not you: check the error text and whether other senders on the same provider report it.
2. Slow down to the affected recipient provider. There is no delisting step on your side for a shared provider IP.

Habits that protect both layers

• Verify before every campaign, so hard bounces stay low on every account and domain.
• Ramp each new inbox, and do not add volume to a live domain all at once. See adding new inboxes to a live campaign.
• Spread risk across domains, so one domain's problem does not reach the rest.
• Watch per inbox and per domain, not only per campaign, so you can tell the layers apart when something moves.

Where SimpleVerifier fits

SimpleVerifier checks each address before you send and marks anything it could not confirm as risky, not valid, so bounces stay off your accounts and domains. Upload a list on the verify page; the first 100 checks are free with a Google sign-in. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.