Validity’s Heatwave Blocklist: What It Lists and What Senders Should Do

On 3 September 2026, Validity launched Heatwave, a public blocklist built for one purpose: identifying sending domains it associates with synthetic reputation warming. It launched with over a million domains already listed, that number has kept climbing, and because the list feeds real filtering infrastructure, a listing has consequences at the receiver.

If you run cold outreach, this is the most consequential blocklist launch in years, and most senders still do not know whether they are on it.

What Heatwave lists

Heatwave lists domains, not IPs. It is published at lookup.validity.tools, drawn from Validity's own intelligence network and spam-trap data, and the published lookup refreshes every few minutes.

Validity's stated target is manufactured engagement: pools of mailboxes that exchange mail with each other to produce opens, clicks and replies that no human ever performed, in order to make a cold domain look established. Their listing policy also references domains whose mail reached Validity's spam traps and scored as cold-email infrastructure.

Two things follow from that, and they matter:

• A listing is about patterns, not intent. Validity is inferring from traffic shape, trap hits and engagement signatures, not reading your tooling contract.
• Being listed is not the same as being proven abusive. At the scale of a million-plus domains at launch, false positives are a mathematical certainty, and nobody outside Validity has independently audited the accuracy rate.

What is verified and what is not

Verified: the launch date, the lookup endpoint, the fact that it lists domains, the published review process, and that it is fed into filtering rather than being a reference list only.

Not verified: the precise signals that trigger a listing, the weighting between trap hits and engagement patterns, how long a listing persists without action, and whether delisting sticks when sending behaviour has not changed. Treat anyone stating these confidently — vendors included — as speculating.

How to check your domain

Go to lookup.validity.tools and enter the domain, not the IP. Check every domain you actually send from, which for most outreach setups is more than one:

• your primary brand domain
• any lookalike or secondary outreach domains
• subdomains used for sending, if they send independently
• the domains your sequencer sends from on your behalf

There is no public DNS zone or API, so this is a manual check. Put it on a recurring calendar reminder — a listing that appears quietly between campaigns is the expensive kind.

Requesting a review

Validity publishes a review request form at the /delist path of the lookup site, alongside its listing policy. Before you submit:

1. Fix the pattern first. A review that finds the same traffic shape ends where it started.
2. Suppress and purge. Remove every address you have not verified, every hard bounce, and every contact with no engagement in 90 days. Trap hits are the part of this you can act on directly.
3. Document the change. What you stopped doing, what you changed it to, and when. Reviews go better with a dated account than with an assertion of innocence.
4. Submit once and wait. Repeat submissions do not accelerate anything.

What senders should actually do

The durable answer is not a trick, it is making your sending resemble what it claims to be:

• Earn engagement from real recipients. Smaller, better-targeted sends to people with an actual reason to reply beat large volumes of manufactured interaction, and they are the only engagement that survives scrutiny.
• Isolate your sending streams. Transactional, marketing and cold outreach on separate domains, so one classification cannot take down your invoices and password resets.
• Keep the list clean. Trap hits are the one input in this system you control absolutely. Verification before sending, aggressive suppression after.
• Authenticate properly. SPF, DKIM and DMARC aligned, with DMARC at enforcement. It does not exempt you from anything, but its absence makes every other signal read worse.
• Measure placement, not delivery. "Accepted" tells you nothing. Seed-inbox testing across Gmail, Outlook, Microsoft 365 and Yahoo tells you where mail actually lands, which is how you detect a filtering change in days rather than quarters.
• Ramp honestly. A new domain still needs volume history before it can send at scale. The ramp is legitimate; the fabricated interaction layered on top of it is what is under scrutiny.

Where this leaves warm-up

It would be convenient to claim that one category of warm-up is safe and another is not. The honest position is narrower: Heatwave targets manufactured engagement signals, nobody outside Validity knows the exact thresholds, and any sender whose reputation rests on interaction that no human performed is exposed. Warm-up that ramps volume gradually, sends content a human would plausibly send, and is measured against real inbox placement is a different risk profile from a closed loop of bots inflating open rates — but "different" is not "exempt", and treating it as exempt is how senders get surprised.

MailPilot's position is to tell you what is measurable: your per-provider placement, your authentication state, your reputation trend, and your blocklist status. We will publish what we learn about Heatwave's behaviour as it becomes verifiable rather than ahead of it.