Email Warmup: The Complete Guide to Sender Reputation and Deliverability

RingLeadAI Team·June 5, 2026·13 min read

Email warmup is the practice of sending a small, gradually increasing volume of mail from a new inbox or domain, with real engagement on that mail, so mailbox providers build a positive reputation record for the sender before it starts cold outreach. It exists because Gmail, Outlook and every other major provider filter primarily on sender history, and a brand-new address has none. Unknown senders that suddenly push volume look exactly like the pattern spam filters were built to catch.

Warmup on its own is not deliverability. It is one part of a system with four moving pieces: authentication, sending reputation, list hygiene, and message quality. Get authentication wrong and no amount of warmup helps. Get list hygiene wrong and warmup only delays the damage. This guide covers all four, plus the ramp schedules, domain and inbox architecture, monitoring instruments, and recovery steps that go with them.

It is the most technical article on this site by design. If you run cold email at any real volume, this is the reference to come back to.

What is email warmup?

Email warmup is the process of gradually building a new inbox or domain's sending reputation so mailbox providers trust it. Instead of sending hundreds of cold emails from a brand-new address on day one, warmup starts at a low daily volume and increases over weeks, while generating positive signals such as opens, replies, and messages being moved out of spam into the inbox.

The useful mental model is credit history rather than a credential. A provider does not check whether you are allowed to send. It predicts whether its users will want what you send, based on what happened the last time you sent. A new sender has no history, so the prediction defaults to caution. Warmup is how you supply the history.

It is worth being honest about the limits. Warmup networks, where a pool of mailboxes exchange and engage with each other's mail, manufacture engagement that no provider has ever endorsed. Providers have gotten better at recognising reciprocal, low-value traffic. Warmup still works because the underlying signals it produces are the ones filters weigh, but it is a way to bootstrap a reputation, not a way to fake one indefinitely. What sustains reputation past the first month is real recipients replying to real mail.

Why deliverability makes or breaks cold email

Every other improvement is downstream of placement. Better copy, tighter targeting, smarter timing, and multichannel follow-up all assume the message arrived somewhere a human will look. Deliverability is the gate they pass through, and it is the only campaign metric that can silently go to zero without any error being raised. Nothing bounces. Nothing fails. Open rates just drift down and stay there.

This is also why deliverability problems get misdiagnosed for months. A team sees replies fall, rewrites the subject lines, changes the offer, swaps the list, and never checks placement. The most common reason a cold email campaign underperforms is not the campaign. It is the sender.

Reputation damage is not contained to one campaign either. Reputation attaches to the domain and to the sending IP, so a burned domain drags down transactional mail, sales follow-up, and one-to-one email from real people at your company. That is the asymmetry that makes this worth engineering properly: the upside of a good sender reputation is steady, and the downside of a bad one is company-wide.

What mailbox providers actually measure

Filtering models are proprietary and change constantly, but the inputs providers publicly tell senders to care about are consistent across Google, Yahoo, and Microsoft. You can treat this list as the scoreboard.

Google's published sender guidelines are explicit about the complaint threshold: keep spam complaint rates below 0.3% as reported in Google Postmaster Tools, and ideally below 0.1%. That is one complaint per thousand messages as the target. Bulk senders to Gmail must also authenticate with SPF, DKIM and DMARC, publish valid forward and reverse DNS for their sending IP, transmit over TLS, and support one-click unsubscribe per RFC 8058 with unsubscribe requests honoured within two days. Yahoo announced matching requirements at the same time, and Microsoft published comparable requirements for high-volume senders to its consumer domains in 2025.

Complaint rate: recipients marking mail as spam. The single most destructive signal.
Bounce rate: invalid recipients. High hard-bounce rates read as a purchased or stale list.
Positive engagement: opens, replies, and messages rescued from the spam folder.
Negative engagement: deletes without reading, and mail that sits unopened.
Sending pattern: volume consistency, ramp shape, and whether sends look automated or human.
Authentication and alignment: SPF, DKIM, and a DMARC record that ties them to your visible From domain.
Spam-trap hits: addresses that exist only to catch senders who never clean their lists.
Content and infrastructure signals: link domains, tracking domains, attachments, and the reputation of the IP you share.

Authentication: SPF, DKIM, and DMARC

Authentication is the prerequisite, not the optimisation. It proves that mail claiming to come from your domain was actually authorised by whoever controls that domain. Since 2024 it is no longer optional for anyone sending at volume to the major consumer providers.

Set all three up before the first warmup email leaves the mailbox. Retrofitting authentication onto a domain that already has a filtering history is far harder than starting clean.

SPF: who is allowed to send

SPF is a DNS TXT record listing the servers permitted to send mail for your domain. The receiving server compares the connecting IP against that list. The practical failure mode is the lookup limit: RFC 7208 caps SPF evaluation at ten DNS lookups, and every include: mechanism for a third-party sender consumes at least one. Teams that stack a mail host, a marketing tool, a helpdesk, and an outbound platform into one record blow the limit, SPF returns permerror, and authentication silently stops passing. Audit the record with a validator rather than assuming it resolves.

Use one SPF record per domain. Two SPF records is a hard failure, not a merge.

DKIM: cryptographic proof the message is yours

DKIM signs outgoing mail with a private key and publishes the matching public key in DNS under a selector. The receiver verifies the signature and knows the message body and signed headers were not altered in transit and that the signer held your key. Use 2048-bit keys where your provider supports them, give each sending system its own selector so you can rotate or revoke one without touching the others, and verify that signing is actually enabled rather than merely configured. A published key with signing switched off is a common and invisible failure.

DMARC: alignment and what to do on failure

DMARC ties SPF and DKIM to the domain the recipient can see in the From header, which is the part neither SPF nor DKIM checks on its own. That link is called alignment, and it is the reason DMARC exists. The record also tells receivers what to do when a message fails: p=none monitors only, p=quarantine sends failures to spam, p=reject blocks them outright.

Start at p=none with a reporting address so you can read the aggregate reports and confirm every legitimate sending source passes and aligns. Once the reports are clean, move to quarantine, then to reject. Publishing p=reject before you have inventoried your senders is how companies accidentally block their own invoices and support mail. Enforcement is also a prerequisite for BIMI, if displaying a verified logo in supporting clients is on your roadmap.

Beyond the big three

Reverse DNS (PTR) on the sending IP matching its forward record. Required by Google for bulk senders.
MTA-STS and TLS-RPT to enforce and monitor encrypted transport between mail servers.
A List-Unsubscribe header with RFC 8058 one-click support, honoured within two days.
A custom tracking domain, so open and click links carry your domain's reputation rather than a shared one used by every other customer of your tool.
A dedicated, properly delegated subdomain for any third-party sending, kept separate from your corporate mail flow.

How warmup works, step by step

With authentication in place, the mechanics of warmup are straightforward. The discipline is in not rushing.

Start low: send a small number of emails per day from a new inbox, in a human-looking pattern rather than an even burst.
Generate engagement: warmup mail gets opened, replied to, and pulled out of spam, which are the signals filters weigh.
Ramp gradually: increase daily volume over several weeks, not several days.
Blend in real mail: begin adding genuine cold sends alongside warmup rather than flipping from one to the other.
Rotate inboxes: spread cold volume across multiple warmed inboxes so none carries an unnatural load.
Monitor: track placement, complaints, and bounces, and back off the moment signals dip.
Keep warmup running: continue background warmup traffic permanently, at reduced volume, once cold sending starts.

A realistic ramp schedule

There is no schedule that is officially blessed, because providers publish direction rather than numbers. Google's guidance to new senders is simply to increase volume slowly and keep it consistent. The shape below is a conservative pattern that respects that guidance and leaves room to react.

Two rules matter more than the exact figures. First, never increase volume in a week where complaints, bounces, or placement moved the wrong way. Hold, diagnose, then resume. Second, consistency beats total volume. A mailbox sending forty messages every weekday looks far healthier than one sending two hundred on Monday and nothing until Thursday.

Week 1: warmup traffic only, roughly 5 to 10 messages per day per inbox.
Week 2: 10 to 20 per day, still warmup only, watching for anything landing in spam.
Week 3: 20 to 30 per day, introducing a small share of real cold sends to your most engaged segment.
Week 4: 30 to 40 per day, with cold volume now the majority and warmup continuing underneath.
Weeks 5 to 8: climb toward a steady-state ceiling, typically 40 to 50 cold sends per mailbox per day.
Ongoing: hold the ceiling. Scale by adding warmed mailboxes, never by raising the per-mailbox number.

Domain strategy: protect the domain you actually need

Never run cold outreach from your primary corporate domain. If reputation degrades, it takes your invoices, your support replies, and your executives' one-to-one mail with it. The standard architecture is to register separate sending domains, typically close variants of your brand, and use those for outbound only.

Each sending domain gets its own authentication records, its own mailboxes, and its own reputation. If one gets damaged you retire it and the rest of the business is unaffected. Buy them well in advance, since domain age is itself a weak trust signal and a domain registered this morning has none of it. Point each one at a simple redirect or a real landing page rather than leaving it parked, because a domain with no web presence looks disposable.

One caveat on subdomains: a subdomain of your primary domain inherits some of the parent's reputation in both directions. That is helpful when the parent is established and clean, and it is a liability if outbound goes badly, since the association runs back up. Separate registrable domains give you cleaner isolation, which is usually what you want for cold outreach.

Inbox rotation and the volume math

Once you accept a per-mailbox ceiling, planning becomes arithmetic. If a warmed mailbox safely sends around 40 messages a day and you want 1,000 cold sends a day, you need roughly 25 warmed mailboxes, spread across several sending domains so no single domain carries the whole load. Rotation software then distributes each campaign across that pool, staggers send times, and keeps each mailbox inside its own limit.

Good rotation does more than divide by N. It respects per-mailbox daily and hourly caps, randomises intervals so sends do not fire on a metronome, keeps each thread's follow-ups on the mailbox that started the conversation, pauses any mailbox whose signals deteriorate, and holds a warmed reserve so pausing one does not stall the campaign.

This is the part of AI email outreach that is genuinely infrastructure rather than intelligence. The copy can be excellent and the targeting precise, but if 1,000 sends a day leave from three mailboxes, those three mailboxes will burn.

Warmup is ongoing, not one-time

A common mistake is treating warmup as a setup step you complete and switch off. Reputation is a rolling assessment of recent behaviour, not a permanent score. A mailbox that sat idle for six weeks and then resumes at full volume is treated much like a new one, and a mailbox whose only remaining traffic is unanswered cold email accumulates negative engagement with nothing to offset it.

Continuous background warmup keeps positive signals flowing underneath the cold volume, and it gives you a live canary. If warmup mail from a given mailbox starts landing in spam within the warmup network, you have an early warning days before your cold campaign's reply rate would have shown it.

What wrecks a domain

Nearly all serious reputation damage comes from a short list of avoidable actions. Most of them happen in the first month, when a team is impatient, and the consequences arrive weeks later.

The pattern worth internalising is that filters penalise inconsistency and indifference. A sender who ramps steadily, cleans their list, and stops mailing people who never respond looks like a business. A sender who buys a list, blasts it, and ignores the bounces looks like the thing filters were built to stop.

Skipping warmup entirely and sending at target volume from day one.
Purchased or scraped lists with no verification, producing hard bounces and spam-trap hits.
Ignoring complaints, or making unsubscribing difficult enough that recipients use the spam button instead.
Broken or missing authentication, especially an SPF record over the ten-lookup limit.
Volume spikes: tripling daily sends because a quarter is ending.
Identical templated blasts with no variation, which are trivially clustered and fingerprinted.
Spam-trigger patterns: link shorteners, attachments in cold mail, heavy image-only messages, and shared tracking domains with poor reputation.
Continuing to mail non-openers for months, which steadily accumulates negative engagement.
Sending to a segment that never asked for anything and has no plausible relevance, which is both a deliverability problem and a compliance one.

How to recover a burned domain

Recovery is possible but slow, and it starts by accepting that you cannot send your way out. Every additional message on a damaged reputation reinforces the classification. The first action is always to stop.

Realistically, expect four to eight weeks of disciplined behaviour before placement improves, and understand that some domains do not recover to their previous level. If the domain is a dedicated sending domain rather than your primary, retiring it and starting clean on a fresh, properly warmed domain is often faster and cheaper than rehabilitation. That is precisely why the separate-domain architecture is worth setting up before you need it.

Pause all cold sending from the affected domain immediately.
Diagnose with data: check Google Postmaster Tools for domain and IP reputation, complaint rate, and authentication pass rates, and read your DMARC aggregate reports.
Fix authentication first, since a broken SPF or unaligned DKIM makes everything else moot.
Purge the list: remove hard bounces, role addresses, unverified contacts, and anyone who has not engaged in months.
Resume warmup at the lowest tier, as if the mailbox were brand new, for at least two weeks.
Restart cold sending only to your most engaged, highest-confidence segment, at a fraction of previous volume.
Ramp again on the slow schedule, and hold at any week where signals do not improve.
If reputation is still poor after several weeks, retire the domain and rebuild on a fresh one rather than continuing to spend time on it.

The instruments you need

You cannot manage what you cannot see, and reply rate is a lagging indicator with too much noise in it to diagnose anything. Instrument the sending layer directly.

Google Postmaster Tools is free, requires only a DNS verification, and is the closest thing to a direct readout of how one major provider sees your domain. Set it up before you need it, because it only reports on data collected after verification.

Google Postmaster Tools: domain reputation, IP reputation, spam rate, and authentication success, straight from the provider.
DMARC aggregate reports: which sources send as your domain, and whether they pass and align.
Seed or placement testing: whether mail lands in the inbox, promotions, or spam across providers.
Per-mailbox bounce and complaint rates, so a single bad mailbox is visible before it contaminates the pool.
Engagement by segment, so you can stop mailing the segments that never respond.
Blocklist monitoring on your sending domains and IPs.

Where AI improves warmup

AI does not change the physics of reputation. What it changes is the amount of manual attention the system needs. Ramp curves get managed automatically instead of by spreadsheet. Warmup conversations read like real threads rather than repeated filler, which matters as providers get better at spotting reciprocal traffic. Volume gets distributed across the mailbox pool with per-mailbox caps enforced, and a mailbox whose signals deteriorate gets paused without waiting for a human to notice.

The other contribution is upstream. Genuinely personalised copy earns real replies, and real replies are the strongest positive signal a sender can produce. That is the connection between message quality and infrastructure that most teams miss: good writing is a deliverability tactic. The same logic runs through the rest of B2B sales automation, where the constraint is almost never how much you can send.

Warmup in RingLeadAI

RingLeadAI runs warmup in-house rather than reselling a third-party network. Every connected inbox is warmed automatically: volume ramps on a managed curve, engagement is generated and tracked, sends are rotated across your mailbox pool with per-mailbox caps, and deliverability signals are scored continuously so a struggling mailbox can be pulled before it damages the domain. The full feature set is on the features page.

If you are evaluating this against a dedicated cold email tool, the honest comparison is worth reading. Purpose-built email platforms are mature and good at what they do, and our comparison with Instantly concedes where they lead. The difference is scope: RingLeadAI treats email as one channel alongside AI voice calling and social, so non-responders are still reachable without a second contract and a second tool.

Email plans start at $39 per month, and every plan includes a 7-day trial with no card required. Full pricing is on the pricing page. If you want the wider playbook that this infrastructure supports, our guide to booking 50 meetings a month covers the campaign layer that sits on top of a healthy sender.

Keep reading