How to Warm Up a New Email Sending Domain

Start with authentication before volume

Domain warmup is not just sending more email every day. Gmail, Outlook, and other mailbox providers first check whether the mail is authenticated, then they watch how recipients and their own abuse systems react.

Before you send campaign traffic, run a live check of the exact domain you will use in the visible From address. InboxRadar can grade it free at the domain scorecard, and you should rerun the check after every DNS or email service change.

• Use a dedicated sending subdomain, such as mail.example.com or updates.example.com, when marketing, product, or sales mail should have its own reputation.
• Publish one SPF TXT record for the envelope sender domain that authorizes every service that sends mail for that stream.
• Turn on DKIM signing in the sending platform and publish the selector records it gives you.
• Publish DMARC for the From domain, or at the organizational domain when subdomains should inherit the policy, starting with monitoring before enforcement.
• Confirm MX and reply handling exist for every address that needs to receive replies, bounces, abuse mail, unsubscribe requests, or DMARC aggregate reports.
• Check major IP and domain blocklists before ramping. A newly bought domain or recycled sending setup can have reputation history you did not create.

Set SPF, DKIM, and DMARC correctly

A warmup plan fails fast when authentication is technically present but not aligned. DMARC passes when SPF or DKIM passes and the authenticated domain aligns with the visible From domain.

SPF lists the hosts allowed to send for the envelope sender domain, also called RFC5321.MailFrom or Return-Path. Publish a single TXT record that starts with v=spf1 and includes only the services you actually use. A softfail ending such as ~all is useful while you are still discovering legitimate senders. A hardfail ending such as -all is stricter and should wait until the sender list is complete and stable. Do not publish multiple SPF records for the same domain. RFC 7208 sets a DNS lookup limit of 10 for mechanisms and modifiers such as include, a, mx, ptr, exists, and redirect. If you hit that limit, remove unused senders or split mail streams by subdomain instead of flattening records you will forget to maintain.

DKIM signs each message with a private key held by your provider and a public key in DNS. Each DKIM record has a selector, so a platform may ask you to create records like selector1._domainkey.example.com and selector2._domainkey.example.com. Turn signing on, send a test message, and verify that the DKIM-Signature header has a passing result and a d= domain that aligns with your From address. RFC 6376 defines DKIM, and Google Workspace guidance recommends 2048-bit DKIM keys when your DNS provider supports them, with 1024-bit keys only when 2048-bit keys are not supported.

DMARC ties SPF and DKIM to the visible From address. Start with a monitoring record such as v=DMARC1; p=none; rua=mailto:dmarc@example.com. Review aggregate reports until your legitimate sources pass and align. Then move to p=quarantine and p=reject only after you are confident. RFC 7489 defines p=none, p=quarantine, p=reject, alignment, and aggregate reporting through rua. Receivers still apply their own anti-abuse systems, so passing DMARC is required for modern trust but is not a promise of inbox placement.

Ramp by provider signals, not a fixed calendar

There is no universal safe daily number for a new sending domain. Reputation is built by provider, domain, IP, audience, and message stream, so the right ramp is the one your live signals can support.

• Start with people who expect your mail. Use recent opt-ins, customers, employees, or engaged subscribers before older or colder segments.
• Send low initial volume and verify SPF, DKIM, and DMARC results in Gmail, Outlook, and any provider that matters to your list.
• Increase in small steps only when bounces stay low, spam complaints stay low, authentication passes, and inbox placement looks stable.
• Watch each destination separately. If Gmail is healthy and Outlook is junking the stream, slow the Outlook-bound mail instead of averaging the results.
• Treat opens as a weak signal because image caching and privacy features can distort them. Put more weight on bounces, complaints, replies, clicks, unsubscribes, spam placement tests, and provider dashboards where available.
• Introduce colder or less engaged segments only after warm segments are stable. Keep the From name, From domain, reply handling, unsubscribe path, and template steady while you test.

Google sender guidelines tell senders to authenticate with SPF or DKIM, publish DMARC, keep spam rates low, use TLS, support one-click unsubscribe for marketing mail, and avoid impersonation. Microsoft guidance also focuses on SPF, DKIM, DMARC alignment, valid sending infrastructure, and sender reputation. Use those official guidelines as the source of truth when a platform checklist conflicts with them.

What mailbox providers are judging

Mailbox providers route mail to inbox, spam, quarantine, or rejection based on risk. Authentication tells them whether the domain is allowed to send. Reputation tells them whether recipients appear to want the mail.

• Keep bounce rates low by removing invalid addresses before the first send.
• Use permission-based lists. Bought lists and scraped addresses create complaints, spam-trap risk, and weak engagement.
• Avoid sudden changes to provider, domain, IP, template, link patterns, and audience source at the same time. You need clean signals.
• Use your own domain for links where possible and avoid link shorteners that hide the destination.
• Monitor blocklists, but do not make them your only dashboard. Many filtering decisions happen inside provider systems you cannot query.

When to pause the warmup

Warmup is working only if the domain earns trust as volume rises. Pause when the next batch is likely to make reputation worse.

• Pause if SPF returns permerror, often caused by duplicate SPF records or too many DNS lookups.
• Pause if DKIM is missing, failing, or signing with a domain that does not align with the From address.
• Pause if DMARC aggregate reports show legitimate mail failing both SPF alignment and DKIM alignment.
• Pause if replies, bounces, unsubscribe requests, abuse reports, or DMARC report mailboxes cannot be received and handled.
• Pause if a major provider starts junking or rejecting the stream, then resume with the most engaged segment after fixes propagate.

The fastest reliable path is a clean technical baseline, a small engaged audience, and daily monitoring for drift. Start with a free InboxRadar scorecard, then use the related guides when a specific record needs repair.