What TLDs should be avoided for email domains due to spam or reputation issues?
Matthew Whittaker
Co-founder & CTO, Suped
Published 6 Aug 2025
Updated 21 Jun 2026
17 min read
Summarize with
Updated on 21 Jun 2026: We updated this guide with clearer guidance on cheap bulk-purchased TLDs, file-extension domains, temporary-address signals, and list checks.
The TLDs to avoid for serious email sending are .tk, .ml, .ga, .cf, .gq, plus cheap, bulk-purchased, high-abuse, or high-scrutiny extensions such as .xyz, .top, .club, .buzz, .cam, .shop, .site, .click, and .info. Treat file-extension TLDs such as .zip and .mov as avoid choices for account, security, and cold email unless the brand reason is overwhelming. Use caution with .io, .ly, .co, and .org depending on the use case. Newer technical TLDs such as .ai and .dev can work when the brand and audience expect them, but they still need testing before volume. Niche vertical TLDs such as .clinic and .vet need the same caution because recipient trust, domain age, and sending behavior carry more weight than a relevant-looking label. For most companies, .com, .net, a well-matched country-code TLD such as .co.uk or .ca, or an established public brand domain such as .me is still a lower-friction choice than a bargain or novelty extension.
In an email address, the TLD is the final label in the domain after the @ sign, such as .com in name@example.com. A TLD does not automatically decide SMTP acceptance or inbox placement. A message can be accepted by the mailbox provider and still land in spam, promotions, or another low-attention folder. Mailbox providers care about authentication, complaint rate, sending history, domain age, content, infrastructure, recipient behavior, and sender identity. The TLD is a risk signal on top of those factors. The same domain can also inherit risk from its linked URLs, redirect chain, sending IP, and shared infrastructure, so do not treat TLD choice as the only reputation input. If the extension has heavy abuse, cheap registration, weak trust, or a lot of lookalike use, the domain starts with less benefit of the doubt.
- Avoid high-risk or bargain TLDs for production email. Keep them for non-email experiments, parked domains, or throwaway testing.
- Use startup-friendly, technical, and niche TLDs cautiously. They can work, but they need stronger warmup, cleaner sending, and closer monitoring.
- Prefer a familiar brand domain when the email has commercial, support, account, or security value.
- Check suspicious-domain signals such as brand typos, parked redirects, shared MX or IP clusters, and weak ownership clues.
- Verify authentication, domain health, DNS history, blacklist and blocklist status for the sending domain, linked domains, and sending IP, plus real inbox placement before scaling.
The short answer
For customer email, lifecycle email, invoices, newsletters, sales outreach, or login messages, do not try to be clever with the TLD. The safest path is a .com domain that matches the brand, a .net domain when it fits a secondary sending identity, or a country-code TLD such as .co.uk or .ca when the company and audience match. If those are not available, choose a TLD with broad business usage and no obvious abuse pattern, and do not let the cheapest first-year price decide the sender identity.
A country-code TLD does not need a same-country sending IP. A local extension works when the company, audience, language, visible From name, and From domain make sense together. IP location is a separate infrastructure signal, and it does not rescue weak authentication or a poor sending reputation.
|
|
|
|
|---|---|---|---|
.tk .ml | Very high | Cheap abuse | Avoid |
.ga .cf .gq | Very high | Historic abuse | Avoid |
.xyz .top | High | Scrutiny | Avoid |
.club .buzz | High | Mixed abuse | Avoid |
.cam | High | Lookalike | Avoid |
.shop .site .click .info | High | Campaign abuse | Avoid for outbound |
.zip .mov | High | File confusion | Avoid |
.io .ly | Medium | Less familiar | Caution |
.co .org | Medium | Context | Caution |
.clinic .vet | Medium | Niche trust | Test first |
.ai .dev | Medium-low | Tech fit | Test first |
.co.uk .ca .me | Low to medium | Audience fit | Use when matched |
.com .net | Low | Familiar | Prefer |
Practical TLD risk guide for email sending domains.
The mistake to avoid
Do not choose a risky TLD and expect SPF, DKIM, and DMARC to erase the trust problem. Authentication proves authorized sending. It does not prove that recipients want the mail or that the domain has a clean history.
- A poor TLD can add filtering pressure before the first campaign leaves.
- Authentication fixes identity, not recipient trust or complaint behavior.
- Controlled test sends reveal failures before a broad launch.
Risky TLDs and the tradeoffs
The riskiest extensions usually share the same pattern: low-cost registration, low friction for abuse, limited legitimate business use, bulk-friendly first-year pricing, and a history of being overused by disposable senders or bulk-purchased campaign domains. That does not mean every domain under the TLD is bad. It means your good domain has to fight the assumptions created by bad neighboring behavior.
TLD reputation also changes. Cheap promotions, weak abuse handling, registry enforcement, registrar complaint handling, bulk-purchase patterns, and sudden phishing waves can move an extension into heavier scrutiny. Even familiar country-code TLDs can see short abuse waves, so do not turn one current incident into a permanent global ban. Treat any list of risky TLDs as a starting point, then check the exact domain, registrar, DNS history, and current blocklist or blacklist signals before sending.
The Freenom-era ccTLD group, .tk, .ml, .ga, .cf, and .gq, is the easiest group to reject for brand email. Those extensions lost much of the free-registration path after Freenom halted new registrations in 2023 and exited the domain business in 2024, but legacy reputation still matters. That change did not reset years of abuse data in security tools, mailbox filtering memory, or manual review habits. For most outbound programs, .xyz, .top, .club, .buzz, .cam, .shop, .site, .click, and .info also belong in the avoid or heavy-caution bucket. The issue is not only automated filtering. Recipients also judge a domain visually, and odd or lookalike TLDs can make normal messages feel suspicious. ICANN issued a public breach notice to the .top registry in July 2024 for DNS abuse report handling and unpaid fees, and marked it cured on June 2, 2025. That cure matters, but it does not erase why many senders still treat .top as a high-scrutiny choice for email.
File-extension TLDs need a separate caution. Domains ending in .zip or .mov can look like attachments or media files in plain text, chat, ticketing systems, and security reviews. The concern is visual and security-tool confusion, not a claim that every .zip or .mov domain is harmful. That makes them poor choices for account security, invoices, outreach, and password reset mail even when the domain itself is authenticated correctly.
Do not turn one provider's sample into a universal ban on legitimate country-code TLDs. Country-code TLDs such as .fr or .ph deserve testing when they match the sender's market. They should not be treated the same as bargain, novelty, or lookalike extensions chosen only because they were available.
Lower-friction choice
- Recipients recognize the company and the domain at a glance.
- The extension has broad personal and business usage.
- DNS, DMARC, SPF, and DKIM are easy to explain and audit.
Higher-friction choice
- The domain looks like a temporary sending identity.
- The extension has a poor or uneven abuse profile.
- The sender needs more testing before volume increases.
Infographic showing abuse history, domain age, user trust, and authentication as TLD risk factors.
How mailbox providers treat TLD reputation
Mailbox providers do not publish a simple list that says one TLD always goes to spam and another always reaches the inbox. The practical model is scoring. The domain, IP, message, sender identity, DNS setup, recipient behavior, and TLD all contribute to a decision. That is why two domains with the same TLD can perform differently.
Do not equate accepted delivery with inbox placement. A message that does not bounce can still land in spam, promotions, or another low-attention folder. That is why open rate, click rate, complaint rate, bounce rate, spam placement, and authentication results need to be reviewed together.
Domain reputation also rolls up above individual subdomains. If news.example.com sends poorly, a mailbox provider can connect that behavior to example.com and other subdomains. That is why buying an odd root domain or using a private suffix does not isolate risk as cleanly as senders expect.
For a broader explanation of the mechanics, this TLD deliverability discussion covers how an extension can change the starting point without being the only reason mail fails.
TLD risk bands
A practical scoring model for first-pass TLD selection.
Low risk
.com, .net, local ccTLD
Familiar business or matched country-code use.
Medium risk
.io, .ly, .co, .clinic, .vet
Legitimate use exists, but some filters apply more scrutiny.
High risk
.xyz, .top, .club, .buzz, .shop, .click, .info
Abuse patterns and recipient distrust create friction.
Avoid
.tk, .ml, .ga, .cf, .gq, .zip, .mov
Disposable, file-confusing, or low-trust history makes business email harder.
Blocklist and blacklist exposure is a separate issue. A domain can have a decent TLD and still get listed because of sending behavior, compromised infrastructure, mail sent through a bad shared IP, or a URL reputation hit. URI-based blocklists can score domains and hosts found inside message links, so the tracking domain and final redirect destination need review as well as the SMTP source. Suped's blocklist monitoring helps teams watch that risk across domains and IPs instead of guessing after deliverability drops.
A practical selection framework
When choosing an email domain, score the TLD before looking at DNS. If the extension creates a trust question, every later step gets harder. That matters more for cold email, high-volume newsletters, and account email because those streams have little room for avoidable suspicion.
Separate outbound domains can protect core business mail only when the separate domain still looks like a real brand asset. A cheap, odd, or lookalike TLD for cold outreach often creates the opposite effect: the recipient sees a disposable sender before reading the message.
Domain age matters too. A familiar TLD on a newly registered domain still starts with no sending history, and a risky TLD makes that lack of history more visible. Register domains before the launch window, publish SPF, DKIM, and DMARC early, send low-risk mail first, and treat 60 days as a practical minimum before meaningful marketing or cold outreach volume.
For country-code domains, check market fit before infrastructure geography. A local TLD is strongest when the business has a real local presence, audience, language, or product reason. A local sending IP is optional, and changing IP location will not fix poor list quality, authentication gaps, or reputation damage.
- Try the main brand .com before using a novelty or bargain TLD.
- Use a country-code TLD only when it fits the company, market, or audience.
- Do not let a cheap first-year price outweigh recipient trust or brand clarity.
- Use subdomains for mail streams before buying odd new root domains.
- If a separate outbound root domain is needed, keep it close to the brand and choose a familiar TLD.
- Check prior domain use, DNS history, registration age, current reputation, and blocklist or blacklist status before launch.
- Inspect the visible site and MX records for parked redirects, brand typos, shared MX or IP clusters, and unclear ownership.
- Create working postmaster@ and abuse@ addresses for the root domain and important sending subdomains.
- Build volume slowly and stop when complaint or failure patterns appear.
Cloudflare Registrar domain search for email domain TLD selection, comparing .com, .io, .co, and .xyz options.
Newer and niche extensions are not automatically bad, but production email should not use them unless there is a clear brand reason, existing public use, and a measured rollout. Healthcare-style and veterinary-style TLDs such as .clinic and .vet can make sense for a website or vanity redirect, but they are a poor first choice for patient reminders, appointment flows, invoices, account mail, or cold outreach. Use a subdomain under the established brand domain for those streams unless the niche TLD has already earned trust with the same audience.
Avoid private suffixes sold like TLDs
Some domains are sold beside normal TLDs even though they are private suffixes or resold subdomains. A uk.com-style registration is not the same as owning a domain under an official TLD in the DNS root zone. For email, the risk is shared parent-domain reputation: many unrelated senders can sit under the same parent, and mailbox providers can score behavior above the name you bought.
- Confirm the extension is an official root-zone TLD, not a resold subdomain presented like one.
- Avoid private suffixes for production mail, cold outreach, account mail, customer support, or password resets.
- Keep the root brand on a trusted TLD, then separate streams with authenticated subdomains.
- Verify the organizational domain before publishing DMARC policy or assuming subdomain reputation is isolated.
A safer default
If a registrar result looks like a TLD but the right side of the domain is really a shared parent domain, skip it for serious email. The short-term availability win is not worth inherited reputation risk.
Authentication cannot erase TLD risk
A clean TLD without authentication is still a bad setup. A risky TLD with perfect authentication is still a risky choice. The right model is cumulative: choose a sane domain, authenticate it correctly, monitor the results, then scale only when the data supports it.
Example DMARC record for monitoring firstdns
_dmarc.example.com TXT v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s
Example SPF record for one approved senderdns
example.com TXT v=spf1 include:spf.sender.example -all
Baseline before warmup
- SPF has one valid record, fewer than 10 DNS lookups, and only approved senders.
- DKIM signs every production sender with a selector you control.
- DMARC reporting is on, domain matching passes, and policy staging has a plan.
- DNS has MX, rDNS, HELO, and tracking domains that match the intended sender identity.
- Role addresses accept external mail at postmaster@ and abuse@ without auto-replies or closed-list bounces.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
Suped's product fits this workflow when the same team needs DMARC reporting, SPF and DKIM diagnostics, blocklist checks, hosted SPF, hosted DMARC, hosted MTA-STS, and real-time alerts in one place. The practical value is issue detection with clear steps to fix problems before a sending domain becomes a deliverability problem.
If you are moving a domain through policy stages, Suped's DMARC monitoring gives you source visibility, authentication results, and practical fixes without asking every marketer or operator to read raw aggregate reports.
How to test a domain before sending
Before sending anything meaningful from a new domain, check the domain itself and then send a real message through the mail stack. DNS checks catch broken records. A delivered test message catches authentication, header, routing, and content issues together.
Start with a domain health check to confirm DMARC, SPF, and DKIM basics. Then send a real message to the email tester so you can inspect the message as mailbox systems see it.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Also send external test mail to postmaster@ and abuse@ for the root domain and any major sending subdomain. Those addresses should accept mail, route to a searchable queue, and avoid autoresponders that create backscatter.
Inspect every visible link and tracking link in the test message. A risky TLD gets worse when it appears with shared shorteners, long redirect chains, HTTP landing pages, or a final domain that does not match the sender. Use a branded HTTPS tracking subdomain and keep the redirect path short.
If a blacklist or blocklist result appears, tie it to evidence before blaming the TLD. Group bounces by recipient domain, inspect spam-folder headers when possible, and test the sending IP, visible link domains, tracking host, and final redirect destinations separately.
Testing should happen before volume, not after the first complaint spike. Watch for blacklist and blocklist listings during warmup, especially when the sending domain is new or the TLD has a mixed reputation. A clean DNS score is helpful, but it is not a substitute for measured rollout.
For acquisition lists and signups, also review recipient-domain clusters. Gmail typos, parked redirects, disposable mailbox domains, shared MX or IP patterns, and domains tied to one weak source point to list-source risk that a new sending TLD will not fix. Do not treat the recipient's TLD as an automatic block rule. Temporary email domains and generated addresses should be tagged, confirmed, scored, and measured against bounce, complaint, confirmation, and engagement data before they become suppression logic.
Suggested warmup pace
An example daily volume increase for a new sending domain with clean results.
Daily send volume
If a domain is newly registered, slow down even more. New domains have no sending history, and a suspicious TLD makes that lack of history more visible. A 60 day waiting period is a useful rule of thumb, not a protocol rule. The real test is whether authentication is passing, recipients expect the mail, volume increases gradually, and early engagement stays clean. Compare the ramp with initial sending volumes before turning a new domain into a production sender.
When .io or .ly can still work
Do not put .io and .ly in the same bucket as the worst TLDs. They can work, especially when the brand is already known, the audience expects the domain, and the sender has clean authentication. The risk is that some filters and recipients give them less initial trust than .com. That matters for acquisition email and any mail sent to people who have no prior relationship with the brand.
Reasonable use
- Recipients already know the brand and expect the domain.
- Sending starts small and grows only after clean signals.
- The domain appears on the website, product, and login flows.
Bad fit
- Recipients have no relationship with the sender.
- The plan starts with large outbound campaigns.
- The TLD looks like a workaround for the main brand.
The same caveat applies to .co. It has real business usage, but it also looks like a missing letter away from .com. If the domain is for invoices, account security, or password resets, avoid any address that makes the recipient pause and wonder whether the sender is legitimate.
Newer technical TLDs such as .ai and .dev are not automatic avoid choices. They are strongest when the brand already uses them publicly, the audience recognizes them, and authentication results stay clean during a measured rollout.
The same practical rule applies to .app, .me, .ca, and other market-matched country-code TLDs. They are better fits when they are the public brand domain, not a backup option chosen because the preferred domain was unavailable.
Views from the trenches
Best practices
Choose a familiar TLD first, then prove authentication and reputation before scaling.
Treat mixed-reputation TLDs as higher risk and validate them with live sending data.
Keep core account mail on the main brand domain, not on novelty or cheap domains.
Common pitfalls
Using a cheap TLD for sales mail can make a normal campaign look disposable fast.
Assuming DMARC fixes recipient distrust hides the real problem of domain choice.
Launching a new root domain at full volume creates risk before reputation exists.
Expert tips
Separate mail streams by subdomain so the root brand stays easy to recognize clearly.
Watch both domain and IP blacklist status during every new-domain warmup period.
Check registrar and registry rules when using TLDs with stricter complaint handling.
Marketer from Email Geeks says .io mail can be legitimate, but some filters still give it a heavier score because a large share of observed mail is unwanted.
2022-07-13 - Email Geeks
Marketer from Email Geeks says startups using anything other than .com can face a harder reputation path, even when the domain is valid and the company is real.
2022-07-13 - Email Geeks
Practical recommendation
For real email, start with the plain answer. Use .com where available. Use .net when it fits a secondary identity. Use a relevant country-code TLD when it fits the brand and audience. Avoid the high-abuse and low-trust groups for production mail, especially for cold outreach, marketing, account messages, and customer support.
If the brand is already committed to .io or .ly, do not panic. Treat it as a domain that needs more discipline. Authenticate it well, keep sending clean, warm it slowly, and monitor failures closely. If the domain has not been bought yet, avoid giving the team that extra work.
A simple rule
If the TLD needs explanation to a security reviewer, mailbox provider, cautious customer, or sales prospect, do not use it for the main sending domain.
