Email warmup, explained without the magic
What sender reputation actually is, why a new mailbox lands in spam, how a warmup engine builds deliverability, and what warmup can never fix. Plain engineering, no growth-hacker folklore.
Warmup is sold with a lot of mysticism. Underneath the vocabulary is a boring, knowable system: mailbox providers score senders on observable behavior, and a new sender with no history starts at a score nobody has verified. Warmup is the disciplined process of building that history before it matters. Here is what is actually happening.
What reputation is made of
Providers evaluate a sending identity across a handful of signals: domain authentication passing, engagement on sent mail, complaint rates, list quality, sending pattern consistency, and infrastructure hygiene. None of these are secret. The complication is that they compound: good engagement earns better inbox placement, which earns more engagement. The same loop runs in reverse, which is why a burned domain rarely recovers by itself.
Why new senders fail
A fresh mailbox on a fresh subdomain has sent nothing to anyone. When it suddenly emits fifty cold emails on a Tuesday, every signal is either absent or bad: no history, no engagement, volume spike, recipients who mostly do not reply. Filters do not hate you; they have simply computed that unknown senders who behave like this are usually spam. Volume before reputation is the classic self-inflicted failure.
What a warmup engine actually does
- Starts at a low daily volume, typically a handful of messages, and increases on a gradual schedule rather than a step function.
- Sends to a network of real mailboxes that engage deliberately: opens, replies, moves out of spam, which are the exact positive signals filters measure.
- Keeps the sending rhythm human: varied volumes, natural gaps, no 9:00:00 precision bursts.
- Monitors health continuously and pauses the schedule the moment placement degrades, because sending through a bad signal deepens the hole.
- Runs for two to four weeks before the first campaign, so the first real prospect email arrives on an identity with a track record.
Authentication: the non-negotiable part
Before any warmup matters, the domain has to authenticate. SPF authorizes the sending servers, DKIM signs the messages so tampering is detectable, and DMARC tells receivers what to do when either check fails, and reports back to you. Misconfigured authentication is the one deliverability failure that no amount of warmup offsets, and it is also the cheapest to fix: it is DNS records, checked and verified per domain before a single message goes out.
What warmup cannot fix
Honesty section. Warmup builds sender reputation; it does not build a good offer, a clean list, or readable copy. Bought lists destroy reputations faster than warmup builds them, because complaints and spam-folder placements are the strongest negative signals there are. If the targeting is wrong, warmup just delivers your bad email to the inbox, where it gets marked as spam by humans, which is worse.
| Problem | Does warmup help? | What does |
|---|---|---|
| New domain, no history | Yes | Warmup builds the record |
| SPF or DKIM failing | No | Fix DNS records first |
| Bought or scraped list | No, accelerates damage | Rebuild the list from real sources |
| Volume spike mid-campaign | Partially | Throttle schedules, per-mailbox caps |
| High complaint rate | No | Stop sending, fix targeting and copy |
How MailFlow operationalizes it
MailFlow treats warmup as infrastructure rather than a checkbox: per-mailbox warmup schedules with automatic pause on signal drop, authentication verification per domain before campaigns can send, reply detection that stops sequences when a human answers, and health analytics beside campaign metrics. The REST API exposes the same controls, because teams that send like a product want their deliverability observable in their own stack.
Common questions
How long should email warmup take before sending campaigns?
Two to four weeks for a new domain, with the schedule adapting to placement health rather than the calendar. Established domains moving to new sending patterns can shorten it, but the safe rule is: warmup ends when the health metrics say so, not when the launch date does.
Do SPF, DKIM, and DMARC all need to be set up?
Yes. SPF and DKIM are the baseline that DMARC evaluates. Without all three resolving correctly, authentication fails and receivers have every reason to distrust the mail. Verification belongs in the sending platform so a misconfigured domain physically cannot ship a campaign.