New domain warm-up checklist: what to do before the first send

Everything that determines whether a new domain warms cleanly happens before you send anything: whether the domain has a history, whether DNS is correct and aligned, whether the mailboxes look like people, and whether you can measure placement. Get those right and the ramp itself is four weeks of patience. Get them wrong and you spend the same four weeks generating data you cannot interpret.

Before you buy the domain

• Check the registration history and whether the name was previously used for mail. A dropped domain can arrive with blocklist entries and a reputation you did not earn.
• Look it up on Spamhaus DBL and SURBL, and — since 3 September 2026 — on Validity's Heatwave list at lookup.validity.tools, which lists domains rather than IPs. Ignore any tool reporting SORBS; SORBS shut down in June 2024.
• Avoid lookalikes of established brands, including your own: example-mail.com and exampleapp-team.com are the pattern phishers use, and filters score it accordingly.
• Prefer a short, pronounceable name on a common TLD. Novelty TLDs are not disqualifying but they start with less benefit of the doubt.

DNS, before the first message

example.com.            TXT   "v=spf1 include:_spf.google.com ~all"
sel1._domainkey         TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.example.com.     TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
example.com.            MX    1 smtp.google.com.

Checks that catch real problems:

1. One SPF record only. Two v=spf1 records is a permanent failure, not a merge.
2. Under ten DNS lookups. Exceeding it gives a permerror and SPF silently stops protecting you. Count your include: chains.
3. DKIM actually signing. Publishing the key is not the same as the provider signing with it. Send a message to a mailbox you control and read Authentication-Results to confirm dkim=pass with d= matching your From: domain.
4. DMARC with a `rua=` address someone reads. Start at p=none, read reports for a week or two, then move to quarantine and reject. Alignment is the thing you are checking for, not pass/fail.
5. Reverse DNS, if you control the sending IP, matching your sending hostname.

Mailboxes that look like mailboxes

Create them over a few days rather than in one batch, give each a real first-and-last-name address rather than info@ or sales@, set a display name and a signature, and let a human actually read the replies. Add a plausible profile photo where the provider supports it. None of this is a trick — it is that an outreach mailbox nobody reads produces no replies, and replies are the strongest positive engagement signal available to you.

Connect each mailbox over OAuth where the provider supports it. App passwords and basic authentication are being progressively shut off across providers, and a tool wired up with one stops working on a schedule you do not control.

The ramp

Add mailboxes to get capacity, not volume per mailbox. Hold flat on any day a provider's placement drops; do not drop to zero, because gaps reset the pattern you are building.

Measure placement, not delivery

Your ESP's delivery rate counts 250 OK responses, and a message filed in Junk is a successful delivery by that definition. What you need is per-provider folder placement from seed mailboxes you control, read weekly, split by provider. Two caveats to keep you honest: at Gmail the Promotions tab carries the INBOX label, so label-derived numbers are an optimistic ceiling; and Google Postmaster Tools retired its domain and IP reputation charts, so there is no reputation grade to sign off the warm-up with. Gmail spam rate under 0.3% — ideally under 0.1% — plus seed placement is the substitute.

What not to do

Do not send a real campaign in week one, however small the list. Do not warm up against a purchased or scraped list; pristine spam traps live there and one hit undoes a month. Do not skip one-click unsubscribe headers on anything bulk — Gmail requires them of bulk senders and their absence reliably converts unsubscribes into complaints. Do not put tracking links on a tracking domain you have not warmed; link domains carry their own reputation. Do not create twenty mailboxes and start them all on the same morning. And do not pause for a week because of a holiday and then resume at your previous volume.

One more, honestly. Warm-up works through a believable volume curve and genuine engagement. The second half is where the risk now sits: Validity's Heatwave blocklist, launched 3 September 2026 with over a million domains listed, targets synthetic reputation warming — pools of controlled mailboxes manufacturing opens, clicks and replies. It lists domains rather than IPs and feeds live filtering, with review requests on its /delist path. Nobody outside Validity knows the thresholds, so no tool, ours included, can promise a new domain exemption from it. Ramp on real mail.

MailPilot covers the mechanical parts of this list: it warms mailboxes over OAuth for Gmail and Outlook or over SMTP/IMAP for Amazon SES, SendGrid, Mailgun, Postmark and custom relays, validates SPF, DKIM and DMARC on the domain, measures real per-provider inbox placement through a seed network, and records per-mailbox reputation daily so the ramp is something you can see rather than assume.