Email Warmup After Heatwave: Build Sender Reputation Safely

For years, the standard advice for a new sending domain went something like this: connect your mailbox to a warmup network, let it trade emails with thousands of other mailboxes for a few weeks, and watch your inbox placement climb. The network did the opening, replying and rescuing from spam for you. It was cheap, automatic and, for a while, it seemed to work.

That advice has aged badly. In September 2026 a new blocklist arrived that is aimed squarely at reputation built this way, and it listed more than a million domains on day one. If you send sales or marketing email, the question is no longer whether to warm up a mailbox but how to do it without creating the very signal that gets a domain blocked. This guide explains what changed, what sender reputation is really built from, and how to run a safe email warmup in 2026 using nothing but real email to real people.

What changed: the Heatwave blocklist

On 3 September 2026, Validity launched the Heatwave blocklist. Its target is what Validity calls synthetic domain warming: sender reputation built from fake engagement exchanged between warmup networks. At launch, Heatwave had already listed more than 1 million domains, and Validity named Comcast, Proofpoint, Spamhaus and SURBL as organisations using or evaluating it.

Those names matter. A blocklist only has teeth if the people who filter mail consult it, and this one launched with a mailbox provider, an enterprise email security vendor and two of the best-known blocklist operators in the conversation. Spamhaus' CEO described synthetic engagement as "another iteration of the same problem", which is a useful way to think about it: manufactured engagement is being treated in the same family as the other ways senders have tried to look more trusted than they are.

What the Heatwave blocklist means for ordinary senders

Most businesses that joined a warmup network were not trying to deceive anyone. They had a new domain, a sales team that needed to send, and a tool that promised to protect them. The trouble is that a filter cannot see intent. It sees behaviour, and the behaviour of a mailbox in a warmup network is distinctive: it exchanges mail with a large pool of other warmup mailboxes, and those messages are opened, answered and pulled out of spam by software rather than people.

Once a list like Heatwave exists, that behaviour stops being neutral. A domain that was warmed synthetically can now carry a label that tells filters to be more suspicious of it, not less. In other words, the tactic that was meant to protect the domain has become a risk to it.

How email warmup networks worked, and why we retired ours

It is worth being plain about how an email warmup network operates, because many teams used one without looking closely at the mechanics.

1. You connect your sending mailbox to the warmup service.
2. The service sends generated messages from your mailbox to other mailboxes in its pool, and theirs to yours.
3. Software logged into each receiving mailbox opens the messages, writes replies, marks them as important or moves them out of the junk folder.
4. Mailbox providers see a sender whose mail is opened, answered and rescued from spam, and reputation rises accordingly.

The whole model depends on step three looking like human behaviour. Heatwave exists because, at scale, it does not. The recipients are other warmup mailboxes, the conversations have no business purpose, and the engagement disappears the moment the network is switched off.

A candid note: Vedain ran one too

Vedain CRM had its own peer-to-peer warmup network. Connected customer mailboxes emailed each other and automatically opened, replied to and moved mail out of junk. It was built with good intentions, to give new domains a gentle start, and it was the same basic design as most warmup tools on the market. After Heatwave launched, we decided the risk to our customers' domains was no longer acceptable, and we retired the network. Mailboxes that were in it moved to a warmup method based on real sending, described later in this article. We think every team that relies on a warmup network should make the same assessment for itself.

What sender reputation is really built from

Strip away the tooling and sender reputation comes down to a simple question mailbox providers ask about every message: do the people receiving mail from this sender want it? Everything else is a way of answering that question with evidence.

The requirements mailbox providers have published

The two largest consumer mailbox providers have been explicit about the baseline. Since February 2024, Gmail has required bulk senders to authenticate with SPF, DKIM and DMARC and to keep spam complaints below 0.3%. Since May 2025, Outlook's consumer mail service has required SPF, DKIM and DMARC for high-volume senders. These are not advanced tactics. They are the entry ticket.

Beyond authentication, providers' guidance keeps returning to the same few signals:

• •Real engagement. People open your mail, reply to it, and do not report it as spam.
• •Correct authentication. SPF, DKIM and DMARC are published and aligned for the domain you send from.
• •Low bounce rates. You mail addresses that exist, which shows you maintain your list.
• •Low complaint rates. Recipients rarely hit the spam button, and unsubscribing is easy.
• •Consistent behaviour. Volume grows gradually and predictably instead of jumping overnight.

Notice what is missing from that list: nothing says reputation must be built fast, or that engagement from strangers counts. A new domain that sends modest volumes of relevant mail to people who respond will build reputation. It just does it at the speed of real conversations.

Domain reputation and mailbox reputation

It helps to separate two things. Domain reputation belongs to the domain in the From address and the links in your email; it is shared by every mailbox that sends from that domain. Mailbox reputation reflects the history of a specific sending account. A blocklisting usually attaches to the domain, which is why one careless mailbox can hurt a whole team. Safe warmup protects both by keeping every mailbox on a domain within the same disciplined limits.

Synthetic warmup vs real-send warmup

The practical alternative to a warmup network is real-send warmup: you warm a mailbox by sending your actual campaigns, slowly, to the people most likely to engage. Here is how the two approaches compare.

Real-send warmup is slower in the first couple of weeks. That is the point. The speed limit comes from genuine behaviour, which is exactly what filters are looking for.

How to warm up a mailbox safely in 2026

Whether you are setting up a brand-new domain or moving a mailbox off a warmup network, the steps are the same. Treat them as a sequence: each one removes a reason for a filter to distrust you before you ask it to trust you with more volume.

Step 1: Authenticate the domain before the first email

Publish SPF, DKIM and DMARC records for your sending domain and confirm they pass. Check that MX records exist too, since a domain that cannot receive mail looks odd as a sender. If you use a mailbox provider such as Google Workspace or Microsoft 365, both publish step-by-step instructions for their DKIM keys. Do not start sending until all three authenticate.

Step 2: Clean the list before you touch it

Bounces are one of the fastest ways to damage a young domain. Verify addresses before the first send: remove invalid addresses, obvious typos and domains that cannot accept mail. Treat anything flagged as risky with caution until the mailbox has a track record. If you want a detailed walk-through, our email verification page explains the checks, and you can try a single address with the free email verifier.

Step 3: Ramp volume on real campaigns

Start small and grow in steady increments. A new mailbox might send ten emails on day one and add a modest percentage each day until it reaches its working volume. Keep the daily limit per mailbox, not just per campaign, so that three campaigns sharing one mailbox cannot triple its volume by accident. Avoid bursts: a hundred emails spread through the working day look more natural than a hundred sent in one minute.

Step 4: Send to engaged people first

The first emails a mailbox sends set the tone for how providers see it. Send those emails to the contacts most likely to respond: customers, recent conversations, people who opened or replied to you in the last few months. Their opens and replies are exactly the real engagement that synthetic warmup tried to fake. Save cold, never-contacted addresses for once the mailbox has a steady history.

Step 5: Write email that looks like a person wrote it

Content signals matter more on a new domain than an established one. Keep early messages mostly text, with one or two links at most. Avoid link shorteners, since they hide the destination and are widely abused. Skip all-caps subject lines, piles of exclamation marks and pressure phrases. Include a clear unsubscribe link; an easy way out reduces spam complaints.

Step 6: Watch the signals and stop early

Check bounce and unsubscribe rates after each batch, not at the end of the month. A sudden rise usually means a bad list segment, a broken link domain or content that is not landing. Pause, find the cause and fix it before sending more. Check whether your domain or link domains have appeared on any blocklist. A campaign that stops itself at the first sign of trouble costs you a day; one that keeps sending can cost you the domain.

Safe email warmup checklist

Run through this list before a new or recovering mailbox sends its first campaign:

• •SPF, DKIM and DMARC published and passing for the sending domain
• •MX records present for the sending domain
• •Sending domain and every link domain checked against domain blocklists
• •List verified; invalid and undeliverable addresses removed
• •Daily per-mailbox limit set, starting low and growing gradually
• •First sends going to engaged contacts, not cold lists
• •No link shorteners, and not an image-only email
• •Subject line in normal case, no spam-style wording
• •A working unsubscribe link in every marketing email
• •Bounce and unsubscribe thresholds agreed, with a plan to pause if they are crossed
• •Mailbox disconnected from any warmup network

If your domain was in a warmup network: what to do now

If you used a warmup network before September 2026, you do not need to panic, but you should act deliberately.

1. Switch the network off. Stop new synthetic activity first. Every day it continues adds to the pattern.
2. Clear out leftover warmup mail. Generated messages from other network members may still be sitting in your inbox or folders. They can be deleted.
3. Check your domain's standing. Look up the sending domain on the major domain blocklists and review any provider dashboards you have access to. If you find a listing, follow the list operator's published removal process rather than guessing.
4. Re-establish the basics. Confirm authentication still passes and nothing has drifted since setup.
5. Restart with a real-send ramp. Drop daily volume back to a conservative level and rebuild on genuine campaigns to engaged contacts, following the steps above.
6. Consider the domain's role. If your main company domain was in a network, keep a close eye on it and be cautious about high-volume outreach from it until its standing is clear.

Reputation built from real conversations is slower to earn but much harder to lose, because it does not depend on a network staying undetected.

How safe warmup works in Vedain CRM

When we retired our peer-to-peer network, we rebuilt email warmup in Vedain around the steps in this guide, so the discipline happens automatically inside the CRM where your campaigns already run.

A sending ramp on real campaign email

Each mailbox with the ramp switched on starts at 10 campaign emails a day and grows by about 30% a day up to a target you choose, 100 a day by default. It works with Microsoft 365 and Outlook, Google Workspace and Gmail, and SMTP mailboxes.

Engaged recipients first

While a mailbox ramps, contacts who opened, clicked or replied in the last 180 days are sent first, so early volume earns real engagement.

A mailbox health score with the exact fix

Every sending mailbox gets a score from 0 to 100 covering SPF, DKIM, DMARC, MX, domain age, the SURBL and URIBL domain blocklists and the mailbox's 30-day bounce rate. Each problem comes with the exact fix. The checks run daily, and the owner is alerted if the domain gets blocklisted or the score drops.

Pre-send checks and verification

Before a campaign starts, Vedain checks the sending mailbox's health, blocklisted or shortened link domains, image-heavy emails, shouting subject lines, spammy wording and a missing unsubscribe link, and tells you how many sending days the campaign will need at the current ramp. Email verification runs a free quick check on every contact, offers paid mailbox verification for the addresses that matter, and a campaign guard skips invalid addresses automatically.

Auto-pause

A campaign pauses itself if bounces reach 8% after 30 sends or unsubscribes reach 5% after 50 sends, and the owner is notified, so one bad segment cannot quietly damage a domain.