Warm-up is the most misunderstood part of cold email infrastructure. Most outreach teams treat it as a setup task — turn on the warm-up tool, wait two weeks, start sending. In 2026, that approach produces inboxes that look warmed but still land in spam, because the warm-up never actually engineered the sender reputation it was supposed to build.

The mechanics changed in late 2025. Microsoft updated its anti-spam systems to specifically flag volume increases greater than 3x within a 48-hour window, sending patterns that match known warm-up tool signatures, and engagement patterns where opens and replies occur within seconds of delivery. Gmail moved to SMTP-level rejection of unauthenticated bulk mail. The threshold for what counts as a “warmed” domain is materially higher than it was 18 months ago.

This guide is the engineering protocol your team should run for every new sending domain. It covers what warm-up actually does at the mechanical level, how SPF, DKIM, and DMARC interact with reputation building, the 42-day day-by-day ramp schedule, and the operational checkpoints that determine whether you proceed, pause, or pull a domain. The deliverable in section 1 is the protocol itself — print it, follow it, do not skip days.

1. The 42-Day Warm-Up Engineering Protocol

Below is the day-by-day protocol for warming a new sending domain from registration to full cold-outreach capacity. It runs over six weeks because faster ramps are penalised by Microsoft and Google’s 2026 detection systems. The protocol assumes one sending inbox per domain; for multi-inbox setups, treat each inbox as an independent track but stagger their start dates by 7 days so reputation builds sequentially rather than as a synchronised spike.

Phase 1: Foundation (Days -7 to 0)

This is the pre-warm-up phase. Authentication must be live before a single warm-up email sends. Sending from a domain with missing or broken authentication during warm-up actively damages reputation rather than building it — the warm-up traffic itself triggers spam classification.

Day	Action	Pass criteria
−7	Register domain. Set up MX records pointing to Google Workspace or Microsoft 365.	Domain resolves; MX records propagated.
−6	Configure SPF record. Single TXT record at root, includes all sending sources, ends with -all or ~all.	MXToolbox SPF check returns no errors; under 10 DNS lookups.
−5	Enable DKIM signing. Generate 2048-bit key in Google Workspace / Microsoft 365 admin console. Publish TXT record at selector._domainkey.yourdomain.com.	Test send to a Gmail address: DKIM PASS in ‘Show original’.
−4	Publish DMARC record. Start with p=none, rua= aggregate report address, pct=100.	MXToolbox DMARC check returns valid policy.
−3	Set up basic landing page at the domain. Three to five paragraphs of legitimate-looking content, contact info, privacy policy link.	Site loads; passes a manual sanity check.
−2	Create the sending inbox. Real name, professional signature, profile photo, recovery options configured.	Inbox can send and receive; profile complete.
−1	Connect inbox to warm-up tool (Mailreach, Warmup Inbox, Lemwarm, or platform-built-in). Verify authentication PASS inside the tool’s diagnostic.	Tool reports all green: SPF, DKIM, DMARC verified.
0	Send three test emails to addresses you control (Gmail, Outlook, Yahoo) from the new inbox. Open them, reply, mark as important.	All three land in primary inbox. mail-tester.com score ≥ 8/10.

Phase 2: Initial Warm-Up (Days 1–14)

Warm-up traffic only. No cold outreach. The goal is to establish a baseline of positive engagement signals (opens, replies, conversations) from a network of trusted inboxes before the domain ever touches a real prospect.

Day	Warm-up volume	Cold volume	Engagement actions
1–3	5/day	0	Manually send 1 personal email per day to a friend/colleague; reply within 2 hours when they reply.
4–7	7–9/day	0	Continue manual engagement. Monitor Postmaster Tools daily.
8–10	10–12/day	0	Add 1 manual reply per day to a previously-received warm-up email (move from spam if needed).
11–14	13–15/day	0	Check spam folder daily; mark any warm-up emails as “Not spam.” This is the highest-value rehabilitation signal.
Why the +2/day cap matters The +2 emails per day increment is not arbitrary. Per industry analysis from MailDeck’s data on 1M+ inboxes, aggressive ramp-up causes 23% more spam folder placements in the first month compared to the standard incremental protocol. Microsoft specifically monitors for volume increases greater than 3x within a 48-hour window. Going from 5 to 15 emails on day 3 trips this filter even if every email is legitimate warm-up traffic. The +2/day pattern stays well below the 3x threshold.

Phase 3: Mixed Sending (Days 15–28)

Begin cold sending at half your warm-up volume, only after confirming Postmaster Tools shows your domain reputation moving from “None” toward “Low” or “Medium.” Continue warm-up traffic in parallel — never replace warm-up with cold sending, layer cold sending on top.

Day	Warm-up volume	Cold outreach volume	Total daily volume	Checkpoint
15–17	15/day	5/day	20	Postmaster: domain reputation ≥ Low. mail-tester ≥ 9/10.
18–21	15/day	8/day	23	Reply rate on cold sends ≥ 2%. Bounce rate ≤ 2%.
22–24	15/day	12/day	27	Spam complaint rate < 0.1% (Postmaster).
25–28	15/day	18/day	33	Postmaster: domain reputation = Medium or High. Cleared to scale.

Critical rule for this phase: if any checkpoint fails, do not advance. Hold at the current volume for another 3–5 days, diagnose the failure (almost always list quality, authentication drift, or content patterns), and only resume the ramp once the failed metric recovers. Pushing through a failed checkpoint is the single most common way teams burn domains that would otherwise have warmed successfully.

Phase 4: Volume Scaling (Days 29–42)

By day 29, the domain has 4 weeks of progressive engagement history. It is now credible to inbox providers as an established sender. The remaining two weeks ramp cold volume toward target operational capacity, with warm-up shifting to a maintenance role.

Day	Warm-up volume	Cold outreach volume	Total	Cumulative status
29–31	12/day	28/day	40	Domain established. Engagement signals positive.
32–35	10/day	40/day	50	Approaching benchmark cold volume for an aged warmed domain.
36–39	10/day	55/day	65	Full operational capacity for single-inbox cold outreach.
40–42	10/day (maintenance)	70–80/day	80–90	Domain warmed. Continue maintenance warm-up indefinitely.
After day 42: the maintenance protocol Warm-up never ends. Once you reach operational sending volume, keep automated warm-up running at roughly 15% of your daily volume — for an inbox sending 80 cold emails per day, run 12 warm-up emails per day in parallel.   Run a Domain Deliverability Readiness Score (DDRS) audit monthly. Monitor Postmaster Tools weekly. If domain reputation drops from High to Medium or Medium to Low, immediately reduce cold sending volume by 50% and increase warm-up to 25% of total, then diagnose the root cause.

2. What Warm-Up Actually Does (And Doesn’t Do)

Most teams use warm-up tools without a precise understanding of what is happening mechanically. This is the cause of most failed warm-ups: the team did the ramp correctly but missed the underlying signals warm-up is supposed to produce.

2.1 The Three Trust Signals Warm-Up Builds

Per Bitscale’s 2026 deliverability research, inbox providers evaluate sender trust along three independent axes:

• Identity (authentication): SPF, DKIM, and DMARC confirm you are who you claim to be. Warm-up does not improve this — it is binary, configured once, and either passes or fails. If authentication is broken, no amount of warm-up rehabilitates the domain.
• Reputation (history): Bounce history, complaint rate, sending pattern consistency, and engagement metrics build over time. This is what warm-up actually improves — by generating a track record of positive engagement signals before any real outreach begins.
• Engagement (current behaviour): Opens, replies, and “mark as important” actions on every message you send. Warm-up traffic produces synthetic engagement signals that count toward this score — but only if the engagement looks human (varied timing, varied content, multi-step conversations).

2.2 The Specific Signals Modern Warm-Up Tools Generate

A reputable warm-up tool produces five distinct signal types. If your warm-up tool is not generating all five, it is not delivering the protection you are paying for:

Signal	What it looks like to the inbox provider	Why it matters
Open events	Message opened within 2–48 hours of delivery	Establishes that the recipient is a real human who engages with the sender.
Reply events	Recipient replies with relevant-looking text	Strongest positive engagement signal. Conversation history is heavily weighted by Gmail.
“Not spam” actions	Tool moves warm-up emails from spam to inbox	Rehabilitates domain reputation after any negative event. Highest-value single action.
“Mark as important” / star	Recipient flags the message as important	Indicates priority sender status to Gmail’s filter.
Conversation threads	Multi-reply back-and-forth conversations	Mirrors organic business communication patterns. Pattern-matches what providers see as legitimate.

2.3 What Warm-Up Cannot Fix

Warm-up is not a universal repair tool. Specific situations where warm-up will not solve the underlying problem:

• Broken authentication. If SPF is misconfigured or DKIM is signing with the wrong domain, warm-up makes things worse, not better. Fix authentication first.
• Bad lists already sent. If you have already sent 5,000 emails to a scraped list with 8% bounces and 0.5% complaints, your domain reputation has already been damaged. Warm-up cannot fully rehabilitate within 30 days; sometimes the better choice is to switch domains.
• Blacklist listings. Once a domain or IP appears on Spamhaus, Barracuda, or SURBL, warm-up does not remove it. You must petition for removal directly from the listing service, then rebuild reputation.
• Domain age. A 7-day-old domain cannot be “warmed” to behave like a 6-month-old domain. Inbox providers track domain age independently. Warm-up shortens the time to full operational status, but it does not eliminate the new-domain penalty entirely.

3. Authentication: The Pre-Warm-Up Foundation

Authentication must be configured before day 1 of warm-up. Section 1 of this protocol schedules it across days -7 to -1 precisely because errors discovered during warm-up are vastly more expensive than errors discovered before warm-up starts. This section covers the specific configurations that matter for outreach in 2026.

3.1 SPF: The Authorisation Layer

SPF tells receiving servers which IP addresses are permitted to send mail from your domain. The 2026 best-practice configuration for outreach:

SPF record template (replace bracketed values) v=spf1 include:_spf.google.com include:[outreach-tool-spf] ~all   Notes: • Single SPF record per domain. Two records = total failure. • Maximum 10 DNS lookups across all ‘include’ statements. • Use ~all (soft fail) during warm-up; switch to -all (hard fail) after day 42 once you are confident every sender is listed. • If you use Google Workspace, Smartlead, Instantly, and a transactional service (e.g. SendGrid), that is already 4 includes. Audit lookup count via dmarcian.com or kitterman.com.

3.2 DKIM: The Integrity Layer

DKIM adds a cryptographic signature to each outgoing message, proving the email was not modified in transit and confirming sender authorisation. Configuration specifics for 2026:

• Key length: 2048-bit minimum. Google now flags 1024-bit keys as weak in Postmaster Tools. The configuration takes 60 seconds in the admin console; there is no reason to run 1024-bit in 2026.
• Selector naming: Use a descriptive selector (e.g. google2026, smartlead1) rather than a generic ‘default’. This makes DNS troubleshooting easier when multiple sending services co-exist.
• Alignment with From: domain: The d= value in the DKIM signature must match the domain in the From: header. Sending tools that use shared infrastructure may sign with d=toolvendor.com — this passes DKIM but fails DMARC alignment.

3.3 DMARC: The Policy Layer

DMARC ties SPF and DKIM together and tells receivers what to do when messages fail. Per Mimecast’s 2026 enforcement summary, Gmail moved to SMTP-level rejection of non-compliant bulk mail in late 2025. Microsoft followed in early 2026. DMARC is no longer optional for any volume of cold sending.

The progressive DMARC policy aligned with the warm-up timeline:

Phase	DMARC policy	Rationale
Days -7 to 14 (foundation + warm-up)	p=none, pct=100	Collect aggregate reports. Identify any legitimate sending sources not yet authorised. Do not quarantine.
Days 15–28 (mixed sending)	p=quarantine, pct=25	Begin enforcement on 25% of failing mail. Verify aggregate reports show no legitimate failures.
Days 29–42 (volume scaling)	p=quarantine, pct=100	Full quarantine enforcement on all failing mail. Standard baseline for mature outreach domains.
Day 60+	p=reject, pct=100	Maximum protection. Recommended only after 60 days of clean reports and no legitimate-mail issues.
Read your DMARC reports DMARC aggregate reports are XML files emailed daily to the rua= address. Reading them by hand is impractical. Use a DMARC analytics service (Dmarcian, EasyDMARC, Postmark’s free tool, or Mailtrap’s DMARC dashboard) to visualise: • Pass rate by source IP • Volume of authenticated vs unauthenticated mail • Spoofing attempts and unknown senders   If you see legitimate sending sources failing DMARC, fix them before tightening your policy. Move from p=none to p=quarantine only when the report shows 100% pass rate from known sources.

4. Provider-Specific Warm-Up Behaviour

Different inbox providers evaluate warm-up differently. The protocol in section 1 produces good outcomes across all major providers, but understanding provider-specific signals helps you diagnose problems faster when they occur.

4.1 Google Workspace / Gmail

Gmail is the strictest mainstream provider for 2026 cold outreach. Google Postmaster Tools surfaces four signals you should monitor daily during warm-up:

• Domain Reputation: Trends from “None” → “Low” → “Medium” → “High” over a properly warmed 42 days. If reputation drops from Medium back to Low during warm-up, halt the ramp and diagnose.
• IP Reputation: Less critical on shared infrastructure (Google Workspace). Pay close attention if you are using dedicated SMTP.
• Spam Rate: Must stay below 0.1% during warm-up, below 0.3% during ongoing operations. Spikes above 0.3% trigger mitigation withholding.
• Authentication: Should show 100% SPF/DKIM/DMARC pass rate by day 7. Any failures indicate a configuration drift that must be fixed immediately.

Google Workspace warm-up safe volume during ramp: start at 5/day, increment by 2, target 25/day by week 4 and 50–80/day by week 6. Gmail’s technical limit is 2,000/day but cold sending above 100/day from a single inbox is high-risk regardless of warm-up status.

4.2 Microsoft 365 / Outlook

Microsoft’s anti-spam systems updated in late 2025 specifically to detect warm-up tool patterns. Three behaviours now flag inboxes for additional scrutiny:

• Volume increases greater than 3x within a 48-hour window.
• Sending patterns that match known warm-up tool fingerprints (e.g. emails sent at exactly the same minute every day, or always to the same warm-up network).
• Engagement patterns where opens and replies occur within seconds of delivery — humanly implausible, classic warm-up tool tell.

Practical adjustments for Microsoft 365 warm-up: use a warm-up tool that randomises send times across an 8–12 hour window per day, varies content (not templated subject lines), and delays simulated engagement by 30 minutes to 6 hours after delivery. Tools that send and reply within seconds are now actively harmful.

Microsoft 365 normal inboxes handle 3–5 cold sends per day in the first warm-up week and reach safe volumes of 30–60/day after 4 weeks. Outlook treats Microsoft 365 inboxes more favourably than third-party SMTP, so prefer M365 for inboxes that will pitch Microsoft-heavy recipient bases.

4.3 Custom SMTP and Dedicated IPs

If you send from custom SMTP infrastructure (rare for link building outreach, more common for high-volume sales teams), warm-up extends to 6–10 weeks because you are building IP reputation from scratch alongside domain reputation. Shared SMTP pools are higher-risk: one bad actor on the pool can damage your reputation despite clean sending behaviour. For link building operations, Google Workspace or Microsoft 365 with shared infrastructure is almost always the right choice over custom SMTP.

5. Warm-Up Tool Selection: What Matters in 2026

The warm-up tool ecosystem has consolidated around five reputable options in 2026, plus the built-in warm-up features inside major outreach platforms. The link building tools landscape covers selection criteria across categories; this section focuses on warm-up-specific evaluation.

Tool	Network size	Approx. monthly cost (per inbox)	Strengths	Limitations
Mailreach	Large; verified inbox pool	£20–£25	Strong reporting, blacklist alerts, GWS + M365	No outreach platform — standalone only
Instantly (built-in)	Large; platform network	Included with Instantly subscription	Native integration, no extra cost	Tied to Instantly platform
Smartlead (built-in)	Large; Premium pool recommended	Included with Smartlead	Premium pool only — standard pool is lower quality	Standard pool reportedly over-sends
Lemwarm (Lemlist)	Medium	£25–£40	Granular controls, customisable	Higher price; some templates increase spam risk
Warmup Inbox	Medium	£12–£20	Budget option; multi-provider	Smaller network — risk of repetitive patterns

Tool evaluation criteria

Beyond brand recognition, evaluate any warm-up tool against the following five criteria. Tools that fail more than one should be replaced:

• Network size and diversity: At least 5,000 participating mailboxes across Gmail, Outlook, Yahoo, and corporate domains. Smaller networks produce repetitive engagement patterns that providers can fingerprint over time.
• Engagement realism: Reply timing varies (not all within 30 seconds), reply content varies (not templated), and multi-step conversations occur. Test by reviewing 10 warm-up emails manually for plausibility.
• Spam recovery automation: When warm-up emails land in spam, the tool moves them to inbox and marks them as “Not spam.” This is the highest-value single action a warm-up tool performs.
• Authentication monitoring: Reports any authentication drift (DKIM signature failures, DMARC alignment issues) before they damage reputation.
• Dashboard transparency: Visible per-day volume, placement rate by provider, engagement metrics. Tools that show only a green/red light without underlying data are not adequate for serious operations.

6. Failure Modes During Warm-Up

Despite the protocol, warm-ups fail. Per published industry analysis, roughly 12–35% of inboxes do not reach “Good” domain reputation on their first warm-up attempt and require additional time or replacement. The common failure modes and their fixes:

Failure 1: Postmaster reputation stuck at “Low” after 4 weeks

Cause: warm-up traffic is being filtered to spam too often, or the warm-up tool’s engagement signals are not registering. Diagnose by checking the warm-up tool dashboard for placement rates — if more than 25% of warm-up traffic is hitting spam, the warm-up network quality is the problem.

Fix: extend warm-up by 14 days at current volume. Verify the warm-up tool is performing spam-recovery moves. If not, switch warm-up tools and add 14 days.

Failure 2: Authentication drift mid-warm-up

Cause: DNS changes (often unrelated, e.g. someone added a new tool’s TXT record and broke the existing SPF record), or DKIM key rotation. Diagnose via mail-tester or Postmaster Tools — both will surface authentication failures within 24 hours.

Fix: restore authentication immediately. If the failure persisted for more than 48 hours, restart the warm-up phase from day 8 (do not start over from day 1 — the established engagement history still has value).

Failure 3: Bounce rate spike on first cold send (day 15+)

Cause: list quality. The warm-up itself was successful, but the cold list is full of invalid or stale addresses. Bounces above 5% during the first week of cold sending will undo 4 weeks of warm-up reputation building.

Fix: pause cold sending immediately. Re-verify the list with NeverBounce or ZeroBounce. Resume cold sending at half the planned volume only after verification completes.

Failure 4: Spam complaint spike on first cold send

Cause: targeting mismatch — the recipients you are pitching are receiving emails irrelevant to their work, or your value proposition does not match what they would expect from your domain. Often a content/copy issue rather than a deliverability issue, but it damages reputation just the same.

Fix: pause sending. Audit the list segmentation, the pitch copy, and the first 50 recipients manually. Resume with tighter targeting and a more relevant pitch. Run additional 7 days of warm-up at higher ratio to rebuild engagement signals before resuming cold sends.

Failure 5: Inbox placement collapses after 6 weeks

Cause: sometimes structural — your domain is on the same root domain as a money site that has unrelated reputation issues, or your IP pool has been damaged by another tenant. Diagnose via Postmaster IP Reputation and a fresh mail-tester score.

Fix: if domain reputation is good but IP reputation is bad, escalate to your outreach platform’s support. If both are bad and the cause is unclear, switch to a backup domain and pause this one for 30 days before attempting rehabilitation.

7. How Warm-Up Fits the Broader Outreach Operation

Warm-up is the second technical layer in the cold outreach stack, sitting on top of authentication and underneath sending hygiene. It directly determines whether your pitches reach the editors you target. For practitioners using outreach as part of a broader link strategy, the protocol in this guide should be run for every new sending domain before any campaign — including campaigns supporting guest posting outreach, digital PR, or resource-page link building from the wider link building strategies playbook.

Reply-rate and placement benchmarks for warmed vs un-warmed domains are tracked in our broader link building statistics for 2026 dataset. The headline number worth knowing: properly warmed domains achieve inbox placement above 90% in the first month of cold sending, compared to 40–60% for skipped or rushed warm-ups — and that placement gap roughly maps to the reply-rate gap between top-performing and average teams.

8. Frequently Asked Questions

Can I skip warm-up if I buy a pre-warmed inbox?

Pre-warmed inboxes (sold for £4–£15 each on services like Litemail) ship with 4–12 weeks of simulated warm-up history. They are legitimate for fast-launch use cases but require verification — check the Postmaster Tools score on day 1, run mail-tester, and ramp gradually from 5–10 cold emails on day 1, never blast 100. Buying pre-warmed is not a licence to skip the ramp; it shortens it to roughly 7–10 days.

How long should warm-up run after the initial 42 days?

Indefinitely, at roughly 15% of daily volume. For an inbox sending 80 cold emails per day in operation, maintain 12 warm-up emails per day in parallel. Stopping warm-up entirely after the initial ramp causes a slow reputation decay over 4–6 weeks.

Can I warm up multiple inboxes on the same domain simultaneously?

Yes, but stagger their start dates by at least 7 days each. Synchronised ramps across multiple inboxes on one domain look like coordinated bulk sending to inbox providers and can trip volume-spike filters even when each individual inbox is within safe limits.

What if Postmaster Tools doesn’t show data for my domain?

Postmaster Tools requires roughly 100 emails to a single recipient domain (e.g. Gmail) before it surfaces meaningful data. For small-volume outreach teams, this can take 2–4 weeks. Until Postmaster data appears, use mail-tester scores and inbox placement tests (Mailreach, Glock Apps) as your primary monitoring signals.

Is warm-up illegal or against ESP terms of service?

Warm-up is not illegal. Some ESPs have specific terms restricting automated engagement that could be construed as inauthentic — Google Workspace’s terms restrict bulk automated activity broadly, but enforcement against legitimate warm-up tools is rare. The bigger operational risk is detection by inbox provider algorithms (Microsoft 2025 update), not ESP policy enforcement. Use reputable warm-up tools that randomise patterns to mitigate this.

Should I warm up on weekends?

Yes. Real business communication does occur on weekends (especially with international recipients), and gaps in your sending pattern can themselves be a signal. Most warm-up tools send 7 days per week by default — leave that setting alone. Reduce weekend volume by roughly 30% to mirror normal business patterns, but do not eliminate weekend sends entirely.

Can I run warm-up on my main business inbox (sarah@yourcompany.com)?

Not recommended. Your main business inbox already has organic engagement signals that warm-up tools cannot match in realism, and the warm-up traffic is more likely to interfere with legitimate business mail than help it. Use dedicated outreach inboxes (sarah.outreach@…, or sarah@variantdomain.com) for cold sending and warm-up. Keep main business inboxes for warm replies and ongoing client communication only.

How do I know if my warm-up is actually working?

Three signals, checked at day 14 and again at day 28:

• Postmaster Tools shows domain reputation moving from None toward Low or Medium.
• mail-tester.com score is 9/10 or higher on every test send.
• Inbox placement rate (Mailreach or Glock Apps test) is above 85%.

If all three signals are positive at day 28, the warm-up is on track. If any one is negative, extend the ramp by 14 days and diagnose the specific failing signal.

9. Putting the Protocol Into Practice

Warm-up is engineering work, not magic. The 42-day protocol in section 1 is not the only path that works, but it is the protocol most likely to produce a domain that scales to operational cold-sending capacity without burning out. The teams that consistently achieve 90%+ inbox placement run it for every new domain, monitor checkpoints daily during the ramp, and treat any failed checkpoint as a hard stop on advancement.

Two operational habits separate teams that warm up successfully from those that do not. First, they register and warm domains months before they are needed, so they always have aged backups ready and never warm under deadline pressure. Second, they treat the warm-up schedule as inviolable — no skipping ahead, no rushing the ramp, no “this domain seems fine, let’s go faster.” The +2 emails per day rule exists because the cost of being wrong is 4 weeks of lost sending capacity. The cost of being right and going slowly is 6 weeks instead of 4.

Print the 42-day protocol. Run it for your next sending domain. Diagnose every checkpoint. The deliverability your team achieves over the next 12 months is decided in these six weeks.