Emails forwarded from my VPS to Gmail being rejected, "very low reputation"

[u/csdude5]

My main domain is 25+ years old and has a great reputation, never used for spam or anything like that. I've been having the emails forwarded through WHM / cPanel to my Gmail.

7 days ago I moved my main site to a new VPS, and copied over the forwarders. But today I discovered that I'm missing the wide majority of my emails! I found them in WHM > View Relayers, about 241 out of 250 were rejected by my Gmail with this error:

TLS_AES_256_GCM_SHA384:256 CV=yes : SMTP error from remote mail server after end of data: 550-5.7.1 [<new VPS IP> 19] Gmail has detected that this message is likely\n
550-5.7.1 suspicious due to the very low reputation of the sending domain. To\n
550-5.7.1 best protect our users from spam, the message has been blocked. For\n
550-5.7.1 more information, go to\n
550 5.7.1 https://support.google.com/mail/answer/188131 af79cd13be357-93917765ba8si962882385a.175 - gsmtp

I double checked in Postmaster Tools, and the domain's reputation is stellar. So when it says "low reputation of the sending domain", I have to assume it means the IP of the new VPS. MXToolbox confirms that the IP isn't on any blacklists, although the parent ASN is on the UCEPROTECT-Level3 list (which covers thousands of domains so it's not MY domain, but I can pay an extortion fee to get mine whitelisted).

Any suggestions?

[u/mooter23]

Have you got SPF, DKIM and DMARC setup on your sending domain?

https://www.freethought.uk/help/google-gmail-rejecting-emails-spf-dkim-dmarc-setup-guide/

Gmail (and others) will reject them if not. Thankfully it's an easy fix.

[u/InitialEffective8630 → u/mooter23]

if spf and dkim are missing gmail will slap that low rep label on it almost every time, even when the domain itself is clean. the ip shift just made it more visible since the old vps probably had some built up trust over time

I had similar issue in last year and setting strict dmarc policy helped a lot after few days

[u/csdude5 → u/mooter23]

I do, the SPF has the new VPS IP, the old VPS IP (which expires tomorrow), and Cloudflare since I use them for DMARC:

"v=spf1 ip4:<old IP> ip4:<new IP> a mx include:_spf.google.com include:_spf.mx.cloudflare.net -all"

The DMARC was set to p=reject but I changed it to p=none for now. And DKIM matches what cPanel shows under Email Deliverability.

I also have SRS enabled in WHM; it was enabled on the old VPS, too.

[u/mooter23 → u/csdude5]

What does mxtoolbox say about the domain, anything stand out?

[u/csdude5 → u/mooter23]

Everything looks right in MXToolbox, other than the UCEPROTECT-LEVEL3 param.

It shows both "DMARC Policy Not Enabled" and "DMARC Record Published", but I think that's just because I changed it to p=none?

I did a test with mail-tester.com, too, and it came back all positive.

I'm starting to think there's nothing I can do on my end but wait for the new VPS to build up a reputation score that Gmail likes.

[u/mooter23 → u/csdude5]

Yeah, in which case I suspect it's the new VPS IP that has a low reputation. Who knows who had that IP before you, and what it was used for.

[u/mooter23 → u/csdude5]

Maybe register the domain with

https://postmaster.google.com/

To get more insight?

But the 550 error message says "very low reputation" so I think that explains it.

If you have the SPF/DKIM/DMARC/PTR records in place I think you just have to wait it out for Google to reassess the reputation.

In the meantime, you could always create another email as the forward hop?

I dunno, WHM forward to something else (I have no idea what haha!) and then forward from there to Gmail?

[u/csdude5 → u/mooter23]

My temporary solution has been to set up a Worker in Cloudflare, then copied all of my redirects to it and port the email through that worker. It's not a great solution since it bypasses my custom SpamAssassin config and there's no log for emails in case something is lost, but I guess it'll do short term.

[u/Proud-Company-7771 → u/mooter23]

this is almost always the answer when emails suddenly start bouncing after a migration tbh

[u/PrimaryFamous6139]

Your new VPS IP has no sending history, which Gmail treats as suspicious regardless of blacklist status, but the real fix for forwarding specifically is SRS (Sender Rewriting Scheme), which you can enable in WHM under Exim Configuration. Without SRS, forwarded emails arrive appearing to come from your VPS IP while claiming to be from the original sender’s domain, which fails SPF checks and triggers exactly this rejection. Also make sure your PTR/reverse DNS matches your mail hostname and that SPF/DKIM/DMARC are properly configured on the new server. Enable SRS first though, that’s almost certainly the primary culprit.

[u/csdude5 → u/PrimaryFamous6139]

I do have SRS enabled, I did that awhile back on the old VPS and duplicated the params on the new one. Good thought, though!

[u/SinkCompetitive837]

Gmail blocks forwarded mail because SPF fails when the VPS IP is not listed in your domain SPF record. Add an SRS service or switch to a provider that rewrites the envelope sender for forwards to pass authentication checks.

[u/TCB13sQuotes → u/SinkCompetitive837]

Or whenever the email being forwarded is too spammy looking.

[u/matriisi]

Self hosting your own SMTP service isn't really worth it unless it's for some kind of internal use. Otherwise I'd just use an email sending service, SES / mailgun etc.

Of course you could try to ensure your SPF, DKIM, and DMARC records are working as they should to fix the problem, but unfortunately, the big ones really don't care about small servcises.

[u/martian_rover → u/matriisi]

Yes, agree with this, would suggest to look into using 3rd party smtp. using resend smtp myself and has worked well.

[u/Strong_Ant3431]

SRS will fix the SPF failure (SinkCompetitive and PrimaryFamous already covered that), but it won't touch your actual problem. That VPS IP has no sending history, and you're forwarding everything that lands on a 25 year old domain, which means all the spam it catches too. So Gmail sees a brand new IP that just started relaying it junk, and thats about the fastest way to bury a fresh IP's reputation no matter how clean the domain behind it is. It's why the SES/Mailgun answers are right, you inherit a warm IP pool instead of warming one from zero. If you're set on forwarding off the box, filter the stream before it goes out so you're not relaying the garbage, and give the IP a couple weeks to settle.

[u/Readypixels]

One option nobody has mentioned: skip forwarding and let Gmail pull the mail instead. In Gmail settings under Accounts and Import, "Check mail from other accounts" fetches from your cPanel mailbox over POP3 with SSL. Nothing gets relayed out of the new VPS IP, so the IP's reputation stops mattering for inbound mail. Your SpamAssassin config still runs on the box before Gmail fetches, and you keep the cPanel mail logs, which is the part the Cloudflare Worker route loses.

Two downsides. Gmail polls on its own schedule, somewhere between a few minutes and an hour depending on volume, so delivery is not instant. And you need a real mailbox on cPanel per address rather than a bare forwarder, though a catch-all mailbox covers most setups.

I moved a client off VPS forwarding to POP fetch after hitting the same 550 wall and the bounces stopped the same day. Worth running while the IP warms up, and you might find you never go back to forwarding.

[u/christpetron → u/Readypixels]

Google is deprecating the POP fetch feature. All users will lose access to it by end of 2026, and “Send as” is going away in Jan 2027. Instead you can use a third-party drop-in replacement that does this same exact fetch, something like mailbridge.app

[u/Readypixels → u/christpetron]

Good catch, thanks for the correction. I went and checked: Google announced in January the end of Gmailify and the POP "check mail from other accounts" fetch, rolling out through 2026. So my suggestion has a short shelf life at best and is already gone for some accounts. The Gmail mobile apps still read third-party mailboxes over IMAP, but only in the app, no web inbox, so it is not a real replacement.

For the OP, the honest revision to my comment: skip POP fetch. Either relay outbound through a warmed sender like SES or SMTP2GO as others said, or point the domain's MX at a mailbox provider and read it there instead of forwarding into Gmail at all.

[u/csdude5 → u/christpetron]

“Send as” is going away in Jan 2027

Well crap.

[u/rbobby]

Handling email sending yourself is probably an anti-pattern. There's a reason for companies like sendgrid.

[u/discosoc]

have to assume it means the IP of the new VPS.

Correct. IP reputation matters; domain “reputation” isn’t really tracked beyond spf/dkim/dmarc setting.

Instead of forwarding, use a service like smtp2go. It also doesn’t matter if you have neutral reputation or not on any blacklists. What matters is you’re sending mail through a new IP (for your domain) and that is always inherently suspicious. And since it looks automated, doubly so.

[u/MadSpaz3]

I just did the same move, to a VPS, if the cluster you’re in has a bad reputation your email delivery takes a dive. I ended up setting up an SMTP relay, as all my DNS records relating to my email were good, but larger email threads were still getting bounced back.

[u/Ni_Peng_NeeeWom]

yeah, forwarding is going to become less and less reliable as efforts to combat spam desperately try to catch up with the cat and mouse game. the long term solution for a production environment is always going to end up being to use an actual mailbox at a dedicated email service.

[u/Grouchy_Brain_1641]

fix everything then put the ip on the allow list.

[u/testingaurora]

Just adding that I was learned years ago that being on a server with other domains that are spammy/bad reputation can negatively affect your email sending reputation and blacklist your domain even if you’ve never sent spam.

Disclaimer that this is second hand and I would defer to the people on this thread with more knowledge than I of email servers

[u/Shiv-ss]

Hii

[u/flexcoding]

The "low reputation" wording is misleading here — this is almost certainly SPF

failing, not your domain.

When your VPS forwards someone else's mail to Gmail, Gmail checks SPF against

the original sender's domain, and your VPS IP isn't in their SPF record. So it

fails. DKIM usually survives forwarding unless Exim touches the body, but with

SPF broken there's no alignment left for DMARC either — and a brand-new IP with

no sending history gets zero benefit of the doubt.

Two ways out.

If you want to keep forwarding, turn on SRS in Exim — WHM has it under Exim

Configuration Manager. It rewrites the envelope sender to your domain, so SPF is

checked against you and passes instead of failing on the original sender.

Honestly though, the more reliable fix is to stop forwarding and let Gmail pull

instead: Gmail → Settings → Accounts and Import → "Check mail from other

accounts", over POP3. Gmail fetching from your server isn't inbound relay, so

none of the reputation logic applies.

Also worth checking the PTR record on the new VPS IP. A lot of providers leave

it unset after a migration and Gmail weighs it heavily.

And don't pay UCEPROTECT. Level 3 lists entire ASNs by design — that's the whole

business model — and Gmail doesn't use it. The whitelisting fee buys you nothing.

[u/corobo → u/flexcoding]

Do you not see that your comments are getting blended when you copy paste the answer from GPT lol

[u/flexcoding → u/corobo]

fair, you got me on the phrasing. english isn't my first language so i write

these with help. i do check the substance before posting but yeah, i'll dial the
polish down.

[u/corobo → u/flexcoding]

I mean the line breaks

in the middle of

sentences

lol

[u/loafthebrain]

the phrase "sending domain" is throwing you off. forwarded mail gets judged on the identity that authenticated at the last hop, which is now your fresh vps ip, not your 25 year old domain. forwarding also breaks the original spf and usually the dkim once cpanel or spamassassin touch the body, so gmail sees unauthenticated mail from a new ip and calls it "low reputation." cleanest fix is to stop forwarding and let gmail pull instead: settings > accounts > check mail from other accounts (pop3). no smtp hop, no ip reputation, problem gone.