How to warm up new mailboxes after Heatwave (without a warmup pool)

The short version

Validity's Heatwave blocklist went live on September 3, 2026, and it permanently lists sending domains warmed in automated mailbox pools (Validity). That turns the classic cold email setup, a stack of fresh domains warmed by a pool for two weeks, into a liability.

The fix is not a better pool. It is a ramp built on engagement you actually earn.

• Heatwave lists domains warmed by automated exchanges between mailboxes someone controls, and that listing does not expire.
• A clean placement test will not tell you whether you are listed.
• The replacement is an earned ramp: warmest audiences first, colder ones only when the numbers hold.
• Mailbox count becomes an output of your warm supply, not something you buy.

A question from a GTM community thread sums up the confusion: if my placement tests come back clean, can I ignore Heatwave? No. Here is why, and what to do instead.

What Heatwave is and what gets a domain listed

Heatwave is Validity's domain blocklist for synthetic reputation warming: automated exchanges between controlled mailboxes, meant to make a young domain look trustworthy before outreach starts. It lists the sending domain, not the IP (Heatwave listing policy).

Validity scores domain age, sending infrastructure and message characteristics, and lists a domain once several corroborating signals clear a threshold it does not publish (Heatwave listing policy). The signal groups it names include synthetic content patterns, shared templates and personas, freshly registered domains and known cold-email infrastructure (Validity guidance).

More than 1 million domains were listed at launch, and Validity says Comcast, Proofpoint, Spamhaus, SURBL and ESPs use or are evaluating the signal (Validity). Each partner decides how to use it, so a listing is not an automatic block everywhere (Warmy).

One detail matters for anyone who works with agencies. Warming often runs without the brand knowing, through a tool a colleague, agency or vendor switched on (Heatwave listing policy). A lookup of your primary domain can surface related domains you never knew existed (Validity).

Why your placement tests will not warn you

A placement test tells you where one message landed at a panel of seed inboxes, and Heatwave may not touch that panel at all. The test reports inbox, spam or missing per provider. It is evidence for that message, that setup and that moment, not a forecast for every recipient (Palisade).

One vendor's seed network, for example, covers Gmail, Google Workspace, Outlook, Microsoft 365, Yahoo and AOL (Borks). Nothing so far shows Google or Microsoft using Heatwave (Spam Resource). So the seeds can come back green while the list does its work somewhere else.

Somewhere else is where a lot of B2B lives. Proofpoint is a named Heatwave partner (Validity), and gateways like it sit in front of many enterprise inboxes (WillItInbox). Unless your seed panel includes those gateways, a clean test says nothing about whether you reach them.

Use placement tests for what they do well: catching content and authentication problems before a send. To find out whether you are listed, check the Heatwave lookup directly.

Why the fix is not a better pool

Validity draws the line at who is on the other end of the email, not at how human the engagement looks. Its guidance describes warming services as closed networks of automated mailboxes that trade generated mail, then open it, reply, mark it important and pull it out of spam. A legitimate ramp sends genuine mail to real, permissioned recipients who earn the engagement (Validity guidance).

Some warmup vendors have responded with more varied timing and dedicated sending environments (Warmy). Validity's test does not change: if mailboxes someone controls generate the engagement, it is synthetic.

Even a pool that is never caught fails at the moment that matters:

• A confirmed warming listing is permanent, and stopping later does not remove it (Heatwave listing policy).
• Engagement collapses at the switch to real recipients, and that gap is itself a signal (Validity guidance).
• A pool ties your domain to every other domain in it, including ones already blocked (Validity guidance).

Deliverability consultant Al Iverson says he hears every week from senders whose domain reputation ended up worse after using warming or outreach services (Spam Resource).

The new constraint: inbox count follows warm supply

Pools made engagement free, so inbox count was a purchasing decision. Real engagement is scarce, so inbox count now has to follow it. Work backwards from the warm audience you can genuinely email each week, and bring mailboxes online in waves sized to it.

Mailboxes per wave = warm contacts available per week ÷ warm sends each new mailbox needs per week

With illustrative numbers, 120 warm contacts a week and about 40 warm sends per new mailbox per week gives a wave of 3 mailboxes. Warm supply comes from:

• Inbound leads and demo requests
• Event and webinar registrants and attendees
• Past repliers and closed-lost deals with a real conversation
• Champions who moved to a new company
• LinkedIn connections who accepted and engaged

When the supply runs out, stop adding mailboxes. To scale, grow the supply: more inbound, more events, more LinkedIn engagement. That is GTM work, not inbox work.

The earned ramp: four rings and the gates between them

Every new mailbox starts with people who asked to hear from you, and moves outward one ring at a time only when its own numbers hold.

1. Hand-raisers. Inbound leads, demo requests, event and webinar attendees, plus the rep's real day-to-day mail, such as scheduling and call recaps.
2. Known relationships. Past repliers, closed-lost deals with a real conversation, champions at new companies and LinkedIn connections who engaged.
3. High-signal cold. Small batches of accounts with a live trigger, such as hiring for the role, new funding or a champion move. Write each email from the signal.
4. Broad cold. Your wider ICP, opened only once rings 1 to 3 hold.

A mailbox moves out a ring only when all of these hold over its last 14 days:

• Hard bounces under 1% of sends
• No policy blocks, and no rejections citing domain reputation
• Spam complaints near zero, with Google's Postmaster spam rate under 0.1% where it shows data (Google)
• Reply rate steady or rising, read per recipient provider
• Every sending domain still clean at the Heatwave lookup

Volume rises with the ring, not the calendar. These numbers are practitioner starting points, not provider rules, and replies do not count against them.

If a check fails once, hold the mailbox for another week and fix the cause. If it fails again, step back a ring. A block, a listing or a spam rate spike pauses the mailbox until you know why.

Infrastructure rules for new domains

Set up each new domain so a real person can send genuine mail from it on day one.

• Real senders. One real person behind every mailbox, who reads and answers it. Invented personas cannot hold a conversation, and Validity lists persona clustering as a warming signal (Validity guidance).
• Aged, real domains. Register early, publish a real site and let the domain age. Freshly registered domains are one of the signals Validity scores (Validity guidance).
• Small families. If any domain in a related group gets warmed, its unsent siblings can be listed before they send (Heatwave listing policy).
• Warmup off everywhere. Check every sequencer and inbox provider for default warmup settings, and get vendors to confirm in writing. Never buy pre-warmed inboxes.
• Full authentication. SPF and DKIM aligned with your From domain, plus a DMARC record with p=none as the floor. Google requires this of senders above 5,000 messages a day to personal Gmail, so build to it from day one (Google).
• No tracking. Turn off open tracking and link wrapping, keep first touches in plain text, and measure replies.
• Easy opt-out. Give every message a clear way out and honor it within 48 hours, the window Google sets for unsubscribes (Google).

How to measure progress now

Read your own reply and error data by recipient provider, because the dashboards most teams leaned on are gone or blind to this. Google stopped showing domain and IP reputation in Postmaster Tools in August 2026, and in its API in September. Spam rate, compliance status, delivery errors and a deliverability verdict remain, though new domains often show no data at first (Warmy).

Google's sender guidelines also cover only mail to personal Gmail accounts, not Google Workspace (Google). For B2B, the signal that matters lives in your own sending data.

• Reply rate by recipient provider. Split replies by the prospect's MX record: Google, Microsoft 365, Proofpoint (pphosted.com), Mimecast. One provider dropping while the others hold shows you where you are filtered.
• Bounces and blocks. Bounces over 1%, or any policy block, pause the ramp.
• Postmaster spam rate. Keep it under 0.1% once Google shows data (Google).
• Heatwave lookup. Check every exact sending domain and subdomain weekly. Lookups are exact-match (Heatwave listing policy), and the public tool allows 100 free checks a day per IP (Warmy).
• Placement tests. Run them before new sequences to catch content and authentication problems.

The trade-off

This is slower than a pool and it caps volume by design, which is the point. The inbox-farm model only worked because fake engagement was free. Without it, the edge goes to teams with sharper signals and more warm supply, not more domains.

Two limits stay true either way. Security gateways like Proofpoint and Mimecast block or quarantine traffic they identify as cold outreach on their own, so enterprise accounts still need LinkedIn, phone and events (WillItInbox).

Validity has also published neither its thresholds nor a false-positive rate, so no method can promise a domain stays clean (Warmy). The earned ramp just gives Heatwave nothing synthetic to find.

Artemis GTM is a GTM engineering consulting firm that builds GTM systems. If you want a second set of eyes on your sending setup before the next wave, get in touch.

FAQ

Sources

• Validity: Heatwave launch press release (September 3, 2026)
• Validity: Heatwave listing policy
• Validity: Deceptive reputation warming through synthetic messaging
• Warmy: Validity's Heatwave blocklist, what we know so far (October 5, 2026)
• Warmy: Google Postmaster retired domain reputation (September 28, 2026)
• Spam Resource: New from Validity, the Heatwave domain blocklist (September 9, 2026)
• Google: Email sender guidelines FAQ
• Palisade: Inbox placement test, what it shows and what it cannot prove (August 12, 2026)
• Borks: Inbox placement testing
• WillItInbox: Why corporate domains eat your emails, Proofpoint, Mimecast and the SEG (August 2, 2026)