How to Warm Up an Email Domain (Step by Step)

You bought a domain, connected a mailbox, imported 500 prospects and hit send. Two days later your open rate is 4%, replies are zero, and a test message you sent to your own Gmail landed in Spam with a scary red banner. Nothing is broken. You simply skipped the part where a brand-new domain has to earn the right to send email.

Domain warm-up is that earning process. It is boring, it takes four to eight weeks, and it is the single highest-return thing you can do before any cold outreach campaign. This guide walks through the whole thing: the DNS setup, a realistic volume ramp, the tools that help, the numbers that must not slip, and how to tell whether it is actually working.

What warm-up actually is

Mailbox providers — Gmail, Outlook, Yahoo, and the corporate filters in between — do not trust senders, they score them. That score is attached to your domain, your sending IP, and increasingly to the specific combination of the two. A domain registered last week has no history at all, which is not neutral: in spam filtering, unknown is closer to suspicious than to safe.

Warm-up is the deliberate creation of a positive history. You send small volumes to addresses that will open and reply, you keep bounces and complaints near zero, and you grow volume slowly enough that no filter sees a step change. After a few weeks, the domain has a track record and can absorb real campaign volume without triggering anything.

Three things build reputation, in rough order of weight: engagement (opens, replies, "not spam" clicks, moves out of Promotions), authentication (SPF, DKIM, DMARC — the proof you are who you claim), and consistency (steady volume, no spikes, no long silences).

Rule zero: do not send cold email from your primary domain

This is the mistake that costs the most and gets noticed the least. If your company runs on yourcompany.com — invoices, password resets, customer support, the sales team's replies — do not run cold outreach from it. One campaign that gets flagged can drag the reputation of everything that domain sends. You do not find out from a warning; you find out when a customer says they never got your invoice.

Buy a separate sending domain. The usual pattern is a close variant: getyourcompany.com, yourcompany.io, tryyourcompany.com. It should look legitimate and point somewhere real — set up a one-page site or a redirect to your main domain, because filters and humans both check whether the domain resolves to anything.

Three practical notes: age it before you use it — register, redirect, configure DNS, then leave it alone for two to four weeks, because domains that start blasting on day one look exactly like throwaway spam domains. Avoid burned domains — check for prior abuse history before buying, especially with expired registrations. And keep it to two or three mailboxes per domain; stacking ten mailboxes on one young domain concentrates all your risk in one place.

The three DNS records, in plain words

You need all three. Google and Microsoft have both tightened requirements for bulk senders, and in practice missing authentication is now a fast route to the spam folder regardless of your content. None of this requires a sysadmin — it is three entries in your DNS panel.

SPF — who is allowed to send as you

SPF is a public list of the servers permitted to send mail using your domain. The receiving server looks up your record and checks whether the message came from one of them.

It is a TXT record on the root of your domain, and it looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Two rules people break constantly:

• One SPF record per domain. Not two, not three. If you add a second TXT record starting with v=spf1, SPF evaluation fails outright. Merge everything into a single record by adding more include: entries.
• Stay under the 10 DNS lookup limit. Each include:, a, mx, and redirect mechanism costs at least one lookup, and includes can nest and cost several. Exceed ten and the check returns a permanent error — which most receivers treat as a failure. If you use a CRM, a transactional provider, a newsletter tool and a helpdesk all on one domain, you can hit this without realising. SPF flattening services exist, but the cleaner fix is fewer senders per domain.

End the record with ~all (softfail) or -all (hardfail). Start with ~all while you confirm nothing legitimate is being missed, then tighten to -all once you are sure the list is complete.

DKIM — a signature that proves nothing was altered

DKIM attaches a cryptographic signature to every outgoing message. Your provider holds a private key; you publish the matching public key in DNS. The receiver verifies the signature and knows the message genuinely came from your domain and was not modified in transit.

The public key lives at a subdomain that includes a selector — an arbitrary label that lets you have several keys at once:

selector1._domainkey.yourdomain.com

Your email provider generates the key and gives you the exact record to paste. Use a 2048-bit key if offered; 1024-bit still validates but is the weaker option. The selector matters for one practical reason: rotation. To change keys without an outage, you publish a new key under a new selector, switch your provider to sign with it, wait until nothing is signing with the old selector, then remove the old record. Rotating once or twice a year is good hygiene; rotating on day one of a campaign is not.

Also check that your provider signs with your domain and not its own. Some cheap setups sign as the platform's domain, which technically passes DKIM but gives you no alignment — and no reputation of your own.

DMARC — what receivers should do when checks fail

DMARC ties SPF and DKIM together and tells receivers your policy. It is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

The key concept is alignment. It is not enough for SPF or DKIM to pass — the domain they pass for must match the domain in the From: header the recipient sees. A message can pass SPF for your email provider's domain and still fail DMARC, because that is not the domain in the From: line. Relaxed alignment (r) accepts subdomains; strict (s) requires an exact match. Relaxed is the sane default. DMARC passes if either SPF or DKIM passes and is aligned.

The policy value moves through three stages, and you should walk them in order:

1. p=none — monitor only. Nothing changes for recipients, but you start receiving aggregate reports. Stay here two to four weeks and read the reports.
2. p=quarantine — failing mail goes to spam. Move here once the reports show your legitimate sending sources all pass and align. Consider pct=25 to phase it in.
3. p=reject — failing mail is refused outright. This is the end state, and it is also what protects your brand from being spoofed by someone else.

Do not jump straight to p=reject on a domain that sends anything besides your cold campaigns. You will silently kill your own invoices, your CRM notifications, or that one form on your website nobody remembers configuring.

A volume ramp that actually works

Here is the part people get wrong. The instinct is to start at 50 a day and "see how it goes." The correct instinct is to start embarrassingly small and let the curve do the work. Figures below are per mailbox, not per domain, and they assume a normal business mailbox rather than a bulk platform.

1. Week 1: 5–10 emails per day. Mostly warm-up traffic — real people who will open and reply. No campaign sending yet.
2. Week 2: 15–20 per day. Introduce a small slice of real prospects, maybe 20% of volume, chosen to be your most likely repliers.
3. Week 3: 25–30 per day. Roughly half warm-up, half real outreach.
4. Week 4: 35–40 per day. Real campaigns now dominate; keep some warm-up traffic running underneath.
5. Weeks 5–6: 40–50 per day. This is a healthy steady state for a cold outreach mailbox. Push higher only if your metrics are clean and you have a reason.

Three principles matter more than the exact numbers:

• Increase gradually, never step. Going from 20 to 100 overnight is the signal filters are built to catch. A rise of roughly 30–50% per week is safe.
• Send on a human schedule. Business hours in the recipient's timezone, weekdays, with random gaps between messages. Fifty emails fired in ninety seconds at 3am is not what a person does.
• Do not stop and restart. A mailbox that goes silent for three weeks loses much of its warm-up. Keep a baseline trickle running between campaigns.

If you need 500 emails a day, the answer is not one heroic mailbox — it is ten mailboxes at 50, ideally spread over two or three sending domains. That is also why list quality decides everything: at these volumes you cannot afford to burn sends on dead addresses. Building a tight, verified, well-targeted list — whether you research it manually or pull it together with JustLeadIt — does more for deliverability than any tool, because the strongest reputation signal is people actually wanting your email.

Warm-up tools: what they do and where they mislead

Warm-up services connect your mailbox to a network of other mailboxes. They send messages between them on your behalf, open them, mark them as important, drag them out of spam, and reply. It simulates the engagement pattern of a healthy, human mailbox and it genuinely accelerates the process.

They are worth using for three things: generating opens and replies at the start when you have no real traffic, automatically rescuing messages from the spam folder (a strong positive signal), and maintaining a baseline between campaigns so the mailbox never goes cold.

Where they mislead:

• Warm-up engagement is not real engagement. A dashboard showing 98% inbox placement inside the warm-up network tells you little about how Gmail treats your actual prospects. Test with your own real accounts at several providers.
• They do not fix a bad list or a bad message. If your campaign generates complaints and bounces, no amount of warm-up traffic outruns it.
• Filters are getting better at spotting the pattern. Treat warm-up as a jump start, then let genuine replies carry the reputation. Do not run artificial warm-up at high volume forever.

Manual warm-up works too, and costs nothing: for the first two weeks, email colleagues, friends, past clients and your own accounts at different providers, and ask them to reply, mark as not spam, and move you to Primary. It is tedious but the signal quality is real.

The numbers that must not slip

Warm-up buys you a good starting reputation. These metrics decide whether you keep it. Check them weekly.

• Hard bounce rate: under 2%. Above roughly 3% you are in dangerous territory; above 5% providers start treating you as someone who does not clean their lists. Verify every address before sending — this alone prevents most warm-up failures.
• Spam complaint rate: under 0.1%. Google's published threshold for bulk senders is 0.3%, and it explicitly says to stay under 0.1%. That is one complaint per thousand emails. Complaints are the fastest way to destroy a domain.
• Reply rate: above 3–5%. Not just a sales metric — replies are the strongest positive engagement signal there is. A campaign nobody answers is a campaign that slowly poisons the mailbox.
• Unsubscribe handling. Bulk senders are expected to support one-click unsubscribe and process opt-outs within a couple of days. Include a clear, working unsubscribe line; people who cannot opt out click "spam" instead, which is far more expensive for you.
• Authentication pass rate: effectively 100%. Any regular SPF or DKIM failure in your DMARC reports is a live problem, not a rounding error.

How to monitor it without guessing

Three free sources tell you almost everything.

DMARC aggregate reports. The rua= address in your DMARC record receives daily XML summaries from every major receiver: how many messages they saw from your domain, from which IPs, and whether SPF and DKIM passed and aligned. Raw XML is unreadable, so route it into any DMARC reporting tool — several have free tiers. This is how you discover a forgotten service sending as your domain, or a DKIM key that quietly stopped signing.

Google Postmaster Tools. Free, and the only direct window into how Gmail sees you: domain reputation, spam complaint rate, authentication rates, delivery errors. Verify your sending domain there before you start warming up, so you have data from day one. Microsoft offers an equivalent programme for senders reaching Outlook and Hotmail addresses.

Seed testing. Keep real mailboxes at Gmail, Outlook, Yahoo and, if your prospects are corporate, a couple of business domains. Every week, send a genuine campaign email to them and record where it lands — Primary, Promotions, or Spam. Placement testing services automate this, but half a dozen personal accounts catch most problems for free.

What breaks a warm-up

• Buying a list. Purchased lists are full of dead addresses and spam traps. One spam trap hit can undo six weeks of careful work.
• Spammy content. Excessive links, attachments, image-heavy HTML, ALL CAPS subjects, the vocabulary of a discount flyer. Plain text with a single link performs better anyway.
• Changing everything at once. New domain, new provider, new template and triple volume in one week means you cannot tell what caused the drop. Change one variable at a time.
• Ignoring the first bad week. Reputation damage compounds. If placement slips, halve volume immediately, fix the cause, and ramp again — do not push through it.

The whole thing, in order

1. Weeks 0–2: Buy a separate sending domain, point it at a real page, configure SPF, DKIM and DMARC at p=none, verify in Google Postmaster Tools, and let it sit.
2. Week 1 of sending: Create two mailboxes with real names, photos and signatures. Start warm-up at 5–10 messages a day each.
3. Weeks 2–3: Ramp to 25–30 a day. Introduce verified real prospects. Read your first DMARC reports and fix any source that fails alignment.
4. Week 4: Ramp to 35–40. Move DMARC to p=quarantine. Run seed tests across providers.
5. Weeks 5–6: Settle at 40–50 per mailbox per day. Move DMARC to p=reject. Keep warm-up traffic running underneath.
6. Ongoing: Weekly check of bounce rate, complaint rate, reply rate and Postmaster reputation. Rotate DKIM keys once or twice a year. Never let a mailbox go fully silent.

Six weeks feels slow when you have a list ready and a quarter to hit. But the alternative is not "six weeks faster" — it is a burned domain, a rebuild from scratch, and the discovery that the reputation problem followed you to the new one. Set up the DNS properly, ramp patiently, watch the four numbers, and the infrastructure stops being something you think about.