Email warm-up for cybersecurity vendors: the hardest audience

Budget four to six weeks to warm a cybersecurity sending domain, and accept that the ramp is only part of the job. Two things make this vertical harder than most: the people you are mailing are trained to treat unexpected messages as hostile and report them, and their mail is filtered by a security gateway before it ever reaches a mailbox provider. The gateway, not Gmail, is often what decides your placement.

The gateway changes the problem

Enterprise security teams sit behind products like Proofpoint, Mimecast or Microsoft Defender for Office 365. Those systems apply controls a mailbox provider does not:

• URL rewriting and sandboxing. Links are rewritten and fetched for inspection, which produces clicks in your analytics that are machines, not people. Filter sub-second clicks from datacentre ranges or your engagement data is fiction.
• Attachment detonation. Anything executable, macro-enabled or archived is likely to be stripped or quarantined. Do not attach files to a first contact at all.
• Newly-observed-domain rules. Many gateways treat domains registered recently as suspicious outright, which is a hard reason not to start outreach from a week-old domain.
• Impersonation and lookalike detection. Display names resembling an internal executive, or domains resembling a known brand, are explicitly flagged.
• Quarantine rather than rejection. You get a 250 OK, the message is quarantined, and nobody tells you. Your ESP reports success.

That last point is why seed mailboxes behind a gateway are worth more to a security vendor than any provider-level dashboard.

Authentication: enforce it, and mean it

A security buyer may actually check your DMARC record, and an unenforced policy on a vendor selling email security is a credibility problem as well as a deliverability one.

example.com.           TXT  "v=spf1 include:_spf.google.com ~all"
sel._domainkey         TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.example.com.    TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Reach that record in stages. Start at p=none with a reporting address, read aggregate reports until every legitimate stream shows aligned DKIM, then move to quarantine and reject. Keep SPF to one record under ten DNS lookups, because exceeding the limit produces a permerror that silently disables SPF. Add MTA-STS and TLS-RPT; they are cheap and they are the kind of thing your buyers notice.

Avoid every phishing-adjacent pattern

A spam report from a security team is worse than an unsubscribe in two ways: it damages your domain, and it may end up in a threat-intel feed that other organisations consume.

A ramp that fits this audience

Weeks one and two: a handful of sends per mailbox per day to people who will actually answer — existing contacts, event follow-ups, inbound leads. Weeks three and four: increase roughly 30% every two or three days while hard bounces stay under 1% and placement holds. Weeks five and six: approach target volume and hold it flat. Add mailboxes for capacity rather than pushing one mailbox toward its provider quota, and stagger mailbox creation over several days so the fleet does not appear all at once.

Judge progress on what is measurable: Gmail spam rate under 0.3% and ideally under 0.1%, per-provider seed placement including at least one gateway-protected mailbox, hard bounce rate, and reply rate. Google Postmaster Tools retired its domain and IP reputation charts, so there is no reputation grade to sign the ramp off with.

What not to do

Do not warm your product or corporate domain for outreach; keep a separate sending domain so a bad campaign cannot delay security alerts or customer notifications. Do not buy an aged domain as a shortcut — you are buying an unknown history, and a domain that changed hands and immediately began outreach is a legible pattern. Do not send cold mail with attachments, ever. Do not use urgency or breach language as a hook. Do not mail a conference attendee list you did not collect consent for; in this audience it converts directly into reports.

And do not try to shortcut engagement. Volume ramping is mechanical and defensible, and genuine replies from real prospects are the signal worth having. Pools of controlled mailboxes manufacturing opens, clicks and replies are what Validity's Heatwave blocklist, launched 3 September 2026, was built to detect — it lists domains rather than IPs, launched with over a million listed, and feeds live filtering, with lookup at lookup.validity.tools. Its thresholds are unpublished, so no tool, ours included, can promise your domain exemption. For a vendor whose product is trust, the reputational exposure is larger than the deliverability one.

MailPilot handles the measurable parts: warm-up over OAuth for Gmail and Outlook or SMTP/IMAP for Amazon SES, SendGrid, Mailgun, Postmark and custom relays, SPF/DKIM/DMARC validation per domain, real per-provider inbox placement measurement, and per-mailbox reputation recorded daily.