Email Warm-Up Playbook

Why warm-up matters

A new domain or mailbox has no reputation, and mailbox providers treat no reputation as risk. Gmail, Microsoft (Outlook/Office 365) and Yahoo score every sender on domain reputation, IP reputation, authentication and recipient behaviour. A domain that goes from zero to 500 emails a day on day one looks exactly like a spammer, and the filters act accordingly.

Warm-up is the process of building that reputation deliberately: sending a small, growing volume of authenticated emails that get opened, replied to and never marked as spam, so the providers learn that your domain is a legitimate, wanted sender before your real campaigns start.

What the filters actually weigh:

Two consequences shape everything that follows. First, reputation is per domain, so cold outreach must never run from your main company domain: a burned outreach domain can be retired, a burned primary domain takes your invoices, support and client emails down with it. Second, since February 2024 Google and Yahoo enforce authentication, one-click unsubscribe and complaint rates below 0.3% for bulk senders, and Microsoft followed in 2025 for senders above 5,000 emails a day, so the technical setup in Stage 1 is mandatory, not optional.

The full pipeline:

1. Buy secondary domains
2. DNS: SPF, DKIM, DMARC, MX, tracking
3. Create mailboxes 2 to 3 per domain
4. Warm-up ramp 3 to 6 weeks
5. Verified, segmented list
6. Campaign at capped daily volume
7. Monitor, rotate, keep warming

Each stage below covers one of these blocks.

Stage 1: Infrastructure

Get the DNS right before a single warm-up email goes out. Every day of warm-up on a misconfigured domain is wasted, and fixing SPF or DKIM mid-ramp resets part of the reputation you built.

1.1 Secondary domains

Never send cold outreach from the primary domain. Buy lookalike domains that redirect to the main site so a curious prospect lands somewhere real.

• Naming: getamazify.com, amazify.co, tryamazify.com, amazify-agency.com. Avoid hyphens where possible and avoid anything that looks like phishing (amazify-secure.net).

• TLD: .com first, then .co, .io, .net. Cheap TLDs (.xyz, .top, .club) start with a worse reputation.

• Age: a domain registered two weeks ago is weaker than one registered six months ago. Buy domains early and let them sit with DNS configured, or look at aged domains from a reputable broker if you need speed. Always check the history on a blacklist checker and the Wayback Machine before buying an aged one.

• Quantity: plan for 2 to 3 mailboxes per domain and a cap of 20 to 30 real emails per mailbox per day. For 300 outreach emails a day you need roughly 12 mailboxes across 4 to 6 domains.

• Redirect every secondary domain (root and www) to the primary site with a 301. A domain with no website behind it is a spam signal.

1.2 Mailbox provider

For cold lead generation, split infrastructure across both Google and Microsoft so a problem with one provider does not stop the whole operation.

1.3 DNS records

All four are required. Set them on every secondary domain before creating mailboxes.

SPF (Sender Policy Framework) lists which servers may send for the domain. One record per domain, maximum 10 DNS lookups.

Type: TXT Host: @
v=spf1 include:_spf.google.com ~all

For Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all. If a tool like Instantly or Smartlead sends through its own servers, add its include. Use ~all (softfail) during warm-up and -all (hardfail) once stable.

DKIM (DomainKeys Identified Mail) signs each email cryptographically so the receiver can verify it was not altered. Generate the key in the Workspace or M365 admin console, publish the TXT record they give you, then turn signing on. Use 2048-bit keys.

Type: TXT Host: google._domainkey
v=DKIM1; k=rsa; p=MIIBIjANBgkq...

DMARC (Domain-based Message Authentication) tells receivers what to do when SPF or DKIM fail and sends you reports. Start in monitoring mode, then tighten.

Type: TXT Host: _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

Move to p=quarantine after two clean weeks of reports and to p=reject once you are sure every legitimate sender is aligned. Gmail and Yahoo require at least p=none for bulk senders; a domain with no DMARC at all is penalised.

MX records must exist even on outreach domains: a domain that sends but cannot receive is a classic spam pattern. Workspace and M365 set these automatically.

Custom tracking domain: if your sending tool tracks opens and clicks, it rewrites links through its own domain, which is shared with every other customer, including spammers. Set a CNAME such as track.getamazify.com pointing to the tool's tracking host so links stay on your domain. Better still, disable open tracking entirely (see Stage 4).

BIMI (brand logo in the inbox) is optional and requires p=quarantine or p=reject plus a verified mark certificate. Not worth it for outreach domains.

Verify everything with MXToolbox, Google Admin Toolbox or a tool like Mail-Tester before moving on. All of SPF, DKIM and DMARC must show PASS on a test send to a Gmail and an Outlook address.

1.4 Mailboxes

• 2 to 3 mailboxes per domain, real first name and surname of a real team member, with a photo and a signature. laura@getamazify.com outperforms outreach@getamazify.com every time.

• Fill in the Google or Microsoft profile fully: name, photo, phone, address.

• Turn on 2FA and use app passwords or OAuth for the sending tool.

• Do not create 20 mailboxes in one hour on a fresh Workspace tenant; Google flags it. Spread creation over a few days.

• Send 5 to 10 manual emails from each new mailbox to colleagues and reply to them on day one. This is the seed of the warm-up.

Stage 2: The warm-up ramp

Warm-up takes a minimum of 3 weeks for Google Workspace and 4 to 6 weeks for Microsoft 365 or a dedicated IP. There is no shortcut: providers score consistency over time, not volume. The goal at the end of the ramp is a mailbox that sends 20 to 30 cold emails a day on top of a continuous background of warm-up traffic.

2.1 How warm-up traffic works

Warm-up emails are exchanged between your mailboxes and a network of other real mailboxes. The receiving side opens the email, marks it as important, moves it out of spam if it landed there, and replies. Those actions are the strongest positive signals a mailbox provider can see. The two ways to generate them:

Automated warm-up networks (built into Instantly, Smartlead, Lemlist, Woodpecker, or standalone like Warmup Inbox, Mailreach, Warmbox). Your mailbox joins a pool of thousands of others that send each other conversational emails and reply automatically. Set it up and leave it running for the life of the mailbox, not only during the ramp.

Manual warm-up. Real emails to colleagues, partners and existing clients who reply. Slower, but the engagement is genuine and it cannot be fingerprinted. Do both: automated for volume, manual for quality.

A note on risk: Google's terms prohibit the automated network approach and in 2025 Google started detecting and penalising some warm-up pools, especially those that reuse identical filler text. Use a tool with a large, varied pool, keep warm-up volume moderate (never above 40 a day), and make sure warm-up subjects and bodies do not contain a tag that identifies them (the tools use a hidden code; make sure it is not visible in the subject line).

2.2 Ramp schedule per mailbox (Google Workspace)

For Microsoft 365 halve the cold volume in weeks 3 and 4 and extend the ramp by two weeks. For a dedicated IP, start at 50 emails a day total to your most engaged contacts and double roughly every three days, watching bounce and deferral rates.

2.3 Rules that hold at every stage

• Warm-up never stops. Drop it to 15 to 20 a day once the mailbox is mature, but keep it on. A mailbox that only sends cold email drifts toward spam within weeks.

• Never exceed 30 cold emails per mailbox per day, whatever the provider's hard limit says. Scale by adding mailboxes and domains, not by pushing each one harder.

• Total sends per mailbox (cold plus warm-up plus replies) should stay below 50 a day.

• Randomise sending times within business hours of the recipient's time zone and space emails 5 to 15 minutes apart. A batch of 30 at 09:00 sharp is machine behaviour.

• Send on weekdays. Keep warm-up running at the weekend so the pattern looks human, but pause cold sends.

• A new domain and a new mailbox are warmed together. Adding a mailbox to an already warm domain still needs 2 weeks of warm-up for the mailbox itself.

• If placement in the warm-up dashboard drops below 80% or you see a deferral ("421" or "451" responses), stop cold sends on that mailbox for 5 to 7 days and let warm-up alone run. Do not push through it.

2.4 What good looks like at the end of the ramp

• Warm-up inbox placement above 95% on Gmail and above 90% on Outlook.

• Zero spam complaints in Google Postmaster.

• Domain reputation shown as High or Medium in Postmaster (Low or Bad means restart the ramp).

• Test sends to seed accounts across Gmail, Outlook, Yahoo and a corporate M365 tenant land in the primary inbox, not Promotions or Junk.

Stage 3: List quality

A perfectly warmed domain dies in a week on a bad list. Bounces and complaints are the two metrics providers punish hardest, and both come from who you email, not how.

3.1 Sourcing

• Build lists from a B2B database (Apollo, Clay, Lead Magic, ZoomInfo, LinkedIn Sales Navigator exports) with a tight ICP filter: role, company size, industry, geography. A 200-contact list that fits the ICP outperforms 5,000 generic ones on every metric that matters, including reputation.

• Never buy pre-made lists. They are full of dead addresses, spam traps (addresses that exist only to catch senders who did not opt in) and people who have complained before.

• Prefer work addresses on the company's own domain. Personal Gmail and Yahoo addresses complain more and, under GDPR and Spain's LOPDGDD, cold emailing them for B2B purposes is much harder to justify.

• Legal basis in the EU: B2B cold email to a work address is defensible under legitimate interest if the offer is relevant to the person's role, you identify yourself, you give an easy opt-out and you keep a suppression list. Keep a record of the interest assessment.

3.2 Verification

Run every list through an email verifier before the first send and again if it is older than 30 days. Tools: ZeroBounce, NeverBounce, MillionVerifier, Bouncer; Lead Magic and Clay have verification built in.

Target after cleaning: a hard bounce rate under 2% on the first send. Above 3% means the list or the verifier failed; stop and re-verify.

3.3 Segmentation and suppression

• Segment by ICP fit and send the strongest segment first while the domains are youngest. Early engagement compounds.

• Cap each contact at one active sequence at a time across all mailboxes and domains. The same person receiving two sequences from two lookalike domains is a complaint waiting to happen.

• Maintain one global suppression list: unsubscribes, replies asking to stop, bounces, complainers, existing clients, competitors. Sync it to every sending tool.

• Do not email the same company more than 3 to 5 people at once. Corporate spam filters (Mimecast, Proofpoint, Microsoft Defender) notice patterns across a domain.

• Re-verify and prune anyone who has not opened in 90 days before re-engaging them.

3.4 Thresholds to hold

Stage 4: Content and sending hygiene

The email itself is the last filter you pass and the first thing a human judges. Content filters look for the fingerprint of bulk mail; write like one person emailing another and most of the risk disappears.

4.1 Copy

• Plain text. No HTML templates, no header images, no buttons, no logo. A cold email should look like something typed in Gmail.

• Under 120 words for the first touch, under 80 for follow-ups. Short emails get read and replied to; long ones get archived, and archiving without reading is a negative signal.

• One link at most, and ideally none in the first email. Links to unknown domains are the single biggest content-based spam trigger. Ask a question and send the link once they reply.

• No attachments in cold sequences. Ever.

• Avoid spam-trigger vocabulary and formatting: FREE, guarantee, 100%, act now, limited time, exclamation marks, ALL CAPS subject lines, currency symbols in the subject, emoji.

• Subject lines: lowercase, 2 to 5 words, specific to them (your amazon ppc for q4, question about {{company}} listings). Subjects that read like a colleague's note outperform clever ones.

• Personalise the first line with something real: a product they sell, a recent launch, a review pattern on their ASINs. Generic I noticed you're the founder of personalisation is recognised as templated by both filters and humans.

• Real signature: name, role, company, one phone number. No image, no social icons, no legal disclaimer block.

• Include an opt-out. For B2B cold email a plain sentence works better than a formal unsubscribe link: If this isn't relevant, reply "no" and I won't follow up. For anything above bulk-sender thresholds (5,000 a day to Gmail) a one-click List-Unsubscribe header is mandatory; most tools add it.

4.2 Sequences

• 3 to 4 emails over 10 to 14 days. More touches raise complaints faster than they raise replies.

• Follow-ups thread under the original (same subject, Re:) so the recipient sees context, and stop the sequence automatically on any reply, bounce or out-of-office.

• Vary the copy across the sequence; do not resend the same email.

4.3 Spintax and variation

Sending 300 identical emails a day across 12 mailboxes is a pattern providers can match across recipients. Use spintax to vary greetings, openers and closers so no two emails are byte-identical:

{Hi|Hello|Hey} {{first_name}},
{I noticed|I saw|I came across} {{company}} {on Amazon|while looking at the {{category}} category}...

Keep the variations natural and equivalent in meaning. Over-spun text reads badly and personalisation errors (Hi {{first_name}}) are worse than no personalisation: always set a fallback value.

4.4 Tracking

• Turn open tracking off. It inserts a hidden image hosted on a tracking domain, which is both a spam signal and inaccurate since Apple Mail Privacy Protection. Judge sequences on reply rate instead.

• If you must track clicks, use the custom tracking domain from Stage 1, never the tool's shared one.

4.5 Throttling and rotation

• Cap 20 to 30 cold emails per mailbox per day, spaced 5 to 15 minutes apart, randomised, in the recipient's business hours.

• Rotate sends across all mailboxes and domains in the campaign so volume is spread evenly. Every serious tool (Instantly, Smartlead, Lemlist, Woodpecker) does this automatically once mailboxes are added to the campaign.

• Match provider to provider where possible: send to Outlook-hosted prospects from Microsoft mailboxes and to Gmail-hosted ones from Workspace. Same-provider delivery is measurably better.

• Retire a domain after 6 to 9 months of active outreach, or sooner if reputation drops, and rotate a fresh warmed one in. Keep 1 to 2 spare domains always warming so replacement is instant.

• Reply to every response, including negative ones, from the same mailbox. Two-way conversation is the strongest reputation signal there is.

Stage 5: Monitoring and maintenance

Deliverability decays silently. Open rates fall, replies stop, and by the time you notice the domain has been in the bulk folder for two weeks. A 15-minute weekly check catches it in days.

5.1 Weekly checks

Set Postmaster and blacklist alerts where the tools allow it so you do not depend on remembering.

5.2 Reading the signals

• Open rate drops on one mailbox only: that mailbox is being filtered. Pause cold sends on it, keep warm-up on, check it is not the one that hit a spam trap.

• Open rate drops across a whole domain: domain reputation issue. Pause the domain, check Postmaster, check blacklists, re-verify the list used.

• Bounces spike: list problem. Stop the campaign, re-verify, look for a catch-all segment that turned out invalid.

• Emails landing in Promotions on Gmail: content problem, usually a link, an image or template-like formatting. Strip the email back to plain text.

• Deferrals ("421 4.7.0 Try again later", "451 Temporarily rate limited"): the provider is throttling you. Cut volume by half for a week; do not retry aggressively.

5.3 Recovery when a domain is burned

1. Stop all cold sends from the affected domain immediately. Do not send through it while diagnosing.

2. Find the cause: check Postmaster for the day the spam rate rose, match it to the list and copy sent that day.

3. Check and request delisting from any blacklist that shows the domain or IP. Spamhaus and Barracuda have self-service forms; most delist within 24 to 48 hours once sending stops.

4. Run warm-up only for 2 to 3 weeks at 20 to 30 a day and watch placement recover.

5. If Postmaster reputation is Bad for more than 30 days, retire the domain. It is cheaper to warm a spare than to nurse a dead one. Keep the mailboxes alive for a few months so replies still arrive.

6. Update the suppression list with every address that complained or bounced before touching the list again.

5.4 Ongoing hygiene

• Keep warm-up on every mailbox permanently.

• Re-verify any list older than 30 days before use.

• Review copy quarterly; what worked in January reads as templated by June.

• Keep 1 to 2 spare domains warming at all times.

• Retire and replace outreach domains every 6 to 9 months.

• Never move a proven outreach domain onto the primary tenant or use it for anything transactional; keep the two worlds separate.

Reference

Capacity planning

Work backwards from the daily volume you need.

Add 20% spare capacity in domains already warming so a burned domain does not cut volume.

Tool stack

Pre-launch checklist

• Secondary domains bought, 301-redirected to the main site, at least 2 weeks old

• SPF, DKIM (2048-bit) and DMARC (p=none minimum) published and passing on a Gmail and an Outlook test

• MX records present; custom tracking domain set or tracking disabled

• 2 to 3 mailboxes per domain with real names, photos, signatures, 2FA

• Warm-up running on every mailbox for at least 3 weeks (Google) or 4 to 6 weeks (Microsoft)

• Warm-up placement above 90%, Postmaster reputation High or Medium, no blacklist hits

• List built to a tight ICP, verified within the last 30 days, catch-alls and role addresses removed

• Global suppression list synced to the sending tool

• Copy is plain text, under 120 words, no attachments, at most one link, opt-out sentence included, spintax applied, personalisation fallbacks set

• Sequence of 3 to 4 emails, threaded follow-ups, auto-stop on reply and bounce

• Sending capped at 20 to 30 cold emails per mailbox per day, randomised timing, business hours, weekdays only

• Seed test to Gmail, Outlook.com, Yahoo and M365 lands in the primary inbox

• Weekly monitoring routine scheduled with Postmaster, blacklist and DMARC checks

• 1 to 2 spare domains already warming

Key thresholds at a glance