Warmup that earns
reputation.
Mailboxes ramp gradually inside the premium pool. Verification tokens distinguish real warmup from forged traffic. Bands quarantine before mailbox providers act.
10 emails on day 1.
40 emails on day 30.
One additional warmup message each business day, until the mailbox reaches the 40 / day ceiling and holds. Aggressive ramps trip volume-anomaly heuristics on the receiver, so we keep it boring.
First warmup send. Normal individual activity to any provider.
Volume grows by one each business day. Weekends skipped.
Ceiling reached. Mailbox holds at 40 / day indefinitely.
Every warmup message carries proof it is real.
The single biggest threat to a shared warmup pool is a sender pretending to receive its own warmup. A signed HMAC token embedded in the body, validated on classification, makes that impossible.
# Token format · plain text, base64url
wbly:01HQX9F7P3A8KY2NJM4R6BWT0S:1746820392:3f9c2a8b5e1d740a
└ pool id └ ulid msg id
└ expires └ hmac-sha256
# Embedded as a normal-looking footer line:
Hey, just wanted to follow up on the project we discussed.
Let me know when you have a chance.
— Ben
ref: wbly:01HQX9F7P3A8KY2NJM4R6BWT0S:1746820392:3f9c2a8b
# Receiver classification → verify (HMAC + expiry + msg-id)
if token.valid() && !seen(token.id) then credit_signal
else increment_invalid_count(sender)Tokens are signed with a per-pool key. Forged tokens fail verification.
Tokens expire 48 hours after issue. Late replies do not count.
Each token ULID is recorded on first valid use. Replays count as invalid.
Token pool ID must match the receiver's pool. Cross-pool tokens are rejected.
Token sender and recipient mailbox IDs must match the message routing.
One loop. One mailbox. One day.
Warmup is not a black box. Every step has a defined input and output, and every quarantine has a reason you can read.
Read about warmup pools- 01 Pool member selectionpartner = pool.draw(exclude_recent: 7d)
A partner mailbox is drawn from the same pool the sender belongs to. Recent partners are excluded for 7 days to prevent degenerate pairs.
- 02 Token issue + embedtoken = hmac(pool_key, sender:recipient:ulid:exp)
A signed token is generated for this pair and inlined as a `ref:` footer in the body. Receivers extract and validate it on classification.
- 03 Send through workerworker.send(msg, schedule: business_hours(recipient_tz))
The mailbox's assigned worker dispatches the message during the recipient's business hours, with spacing that matches human typing cadence.
- 04 Partner classificationreceiver.classify(msg) → {inbox|promotions|spam}
The receiving mailbox classifies the message and reports the result back along with the token. Inbox arrivals are credited as positive placement signals.
- 05 Score update + bandscore = rolling_sum(placement, complaints, tokens)
The per-mailbox rolling score is updated. If thresholds are crossed, the mailbox transitions to Watch, Quarantined, or Blocked.
A fresh mailbox is suspicious by default.
Gmail and Microsoft treat new senders cautiously. Without a behaviour history, a brand-new domain that immediately starts cold outreach looks like the worst-case sender. Warmup is the only way to build that history without a complaint event.
- No sending history. Providers default to suspicion on first volume spike.
- Inbox vs spam classification has no positive signal to lean on.
- Any complaint or hard bounce moves reputation faster because the baseline is empty.
- Engagement signals (replies, moves from spam) take longer to accrue.
- First catastrophic event can hit within days of starting cold sends.
- Gradual volume ramp matches what a real mailbox usage looks like.
- Inbox arrivals at vetted partners build a positive placement signal.
- Replies in the pool produce real engagement history at the receiver.
- Verification tokens prove the activity is genuine, not self-replied noise.
- Per-mailbox bands quarantine drift weeks before providers would act.
Reputation is per-mailbox, per-IP, and per-domain. Warmup builds all three simultaneously. We do not publish placement-improvement percentages because the answer depends on your domain age, content quality, list hygiene, and DMARC posture more than anything we control.
Bands that act before providers do.
Spam placement on the X axis. Each band starts where the previous one ends. Warmbly's thresholds (in sky) sit well to the left of Google's and SES's published enforcement points (in rose) so we pull a mailbox out of the shared pool weeks before it would earn a public complaint.
Default state. Continue ramp.
Lower volume, increase spacing.
Removed from shared paid pool for 7 days.
30-day block. Review required for re-entry.
Spam-placement band requires at least 20 warmup deliveries in the past 7 days. Complaint band requires at least 100 delivered messages in the past 30 days.
Four pools. Zero crossover.
Mailboxes never silently move between pools. A free-trial mailbox stays in the free pool. A quarantined paid mailbox drops into recovery, not back to premium. Dedicated infrastructure runs alongside without sharing IPs.
- Recipients drawn exclusively from other free-plan mailboxes.
- Same auto-quarantine thresholds as premium.
- Cannot send to premium-pool mailboxes.
- Stricter quarantine bands than free pool.
- Quarantined senders move to recovery, not back to premium.
- Recipients only drawn from other healthy premium mailboxes.
- 7-day cooldown after quarantine trigger.
- Must pass 20-delivery probation to re-enter premium.
- Completely isolated from healthy premium senders.
- One worker process and IP allocated to one organisation.
- Still participates in the premium pool for warmup recipients.
- Infrastructure isolation, not a reputation shortcut.
The pool needs scale. That is what the cloud provides.
Warmbly is open source, so you can self-host all of it. The one part that does not travel is the shared warmup pool, because a pool only works once enough vetted mailboxes are in it.
The numbers we ship with.
Tuned for the median sender. Override per mailbox if you have a real reason. The right column is the reasoning we will defend in an incident review.
Low enough to read as normal individual activity to any provider.
Aggressive ramps trip volume-anomaly heuristics on the receiver.
Maintains reputation without crowding the cold-campaign budget.
Stops two mailboxes from forming a degenerate warmup pair.
Removes proactively, before mailbox providers act.
A flurry of malformed tokens is the token-forgery signature.
Enough fresh data to confirm health, not just dormancy.
Plan on 3 to 6 weeks for a brand new mailbox to reach a stable warmed state. We ramp +1 / day from a 10 / day start with a 40 / day ceiling.
No. Free pool mailboxes never silently appear in the premium pool. Dedicated workers still participate in the premium pool by default.
3 or more invalid warmup tokens in 24h, spam score above 50, complaint rate over 0.10%, or spam-folder placement over 20% on at least 20 deliveries in 7 days.
Yes, and you should. Warmup runs in parallel with cold sending so any reputation dip is caught and offset before campaigns hit it.
Connect a mailbox. Start warming today.
OAuth in 30 seconds. First warmup send in under a minute.