IP warming for new sending IPs

2 April 2026 · 12 min read

When you move email onto a brand new sending IP address, the receivers that matter (Gmail, Yahoo, Microsoft, and the big consumer and enterprise filters behind them) have never seen that IP send a single message. It has no reputation. To a spam filter, "no reputation" is not neutral and it is not a clean slate: a fresh IP that suddenly emits thousands of messages an hour looks exactly like a compromised host or a snowshoe spammer who just bought a block of addresses. The defensive response is throttling, deferrals (4xx temporary failures), bulking to the spam folder, and in the worst case outright 5xx rejection.

IP warming is the deliberate, gradual process of building that reputation: you start with small daily volumes to your most engaged recipients, increase the volume on a controlled schedule over several weeks, and let receivers learn that this IP sends wanted mail that people open and do not mark as spam. This article is specifically about warming, and about the part most warm-up guides skip: how SPF, DKIM and DMARC alignment underpin the whole exercise. Reputation is attached to an authenticated identity. If your authentication is broken or unaligned while you warm, you are teaching receivers about an identity you cannot keep, and a chunk of the trust you build leaks away to forwarders, bots and spoofers instead of to you.

If you want to confirm your authentication is solid before you send a single warm-up message, run the domain through the DMARC checker, SPF checker and DKIM checker first. Warming on top of a misconfigured domain wastes the warm-up.

When you actually need to warm an IP (and when you do not)

Warming applies to dedicated IP addresses that are new to sending, or that have been dormant long enough for their reputation to decay. You need to think about it when:

• You buy or are assigned a dedicated IP from an ESP (SendGrid, Amazon SES, Mailgun, Postmark, SparkPost, Klaviyo and similar) and it has no sending history.
• You migrate from a shared pool onto your own dedicated IP because your volume justifies it.
• You move providers and your old IP is being retired.
• You bring email in-house onto your own MTA (Postfix, Halon, PowerMTA) with your own IP block.
• An IP has sat idle for weeks or months and its reputation has gone stale.

You generally do not need a manual warm-up when:

• You are on a shared IP pool at a reputable provider. The pool already carries an established reputation built by all the senders on it, and the provider manages it. This is the right default for low and moderate volume.
• Your total volume is small, say a few thousand messages a month. A dedicated IP needs consistent volume to hold reputation; a low-volume sender on a dedicated IP is often worse off than on a shared pool because the IP never sends enough to look established. As a rough industry rule of thumb, a dedicated IP wants on the order of tens of thousands of messages a week, sent regularly, to stay healthy.

So the first warming decision is not "what schedule" but "do I even want a dedicated IP". If your volume cannot keep a dedicated IP consistently busy, stay on the shared pool and skip the rest of this exercise. If it can, read on.

Why a new IP needs gradual volume: what the receiver sees

Large receivers build a reputation model per sending IP (and increasingly per signing domain, which is the part that connects to DMARC). For a new IP, the model is empty, so receivers apply caution and watch a handful of signals very closely during the first sending events:

• Volume ramp. A flat, near-zero history that jumps to a large spike is the single strongest spam signal. Legitimate senders grow; spammers blast. Gradual increase is itself a trust signal.
• Recipient engagement. Opens, replies, and especially the absence of "mark as spam" complaints. Mailbox providers weigh engagement heavily. This is why you warm with your most engaged recipients first.
• Bounce rate. Sending to dead or invalid addresses on a fresh IP is read as list-buying behaviour. A clean, recently-validated list matters far more on a cold IP than on an established one.
• Spam-trap hits. Old or scraped lists contain pristine and recycled spam traps. One trap hit early in a warm-up can stall the whole thing.
• Consistency. Sending at roughly the same times, in roughly predictable volumes, day after day. Erratic sending resets the receiver's confidence.
• Authentication. Whether the IP's mail is authenticated and, crucially, whether that authentication aligns with the From domain. More on this below, because it is where warming and DMARC meet.

When any of these look wrong, the receiver does not silently discard your mail. It pushes back so you can slow down. You will see deferrals like 421 4.7.0 [GL01] Message ... temporarily deferred due to unexpected volume from Gmail, or Microsoft's 451 4.7.500 Server busy and S3150 style throttles. These are not bugs. They are the receiver asking you to ramp more slowly. The correct response is to back off the volume, not to retry harder.

A sensible warm-up schedule

There is no single official schedule. What follows is a conservative, widely-used pattern that works for a sender ramping toward roughly 100,000 messages a day over about a month. Scale the numbers to your real target volume; the shape (start tiny, increase by roughly 30 to 50 percent a day or double every few days, never spike) matters more than the exact figures.

A workable daily ramp:

Day 1:     50
Day 2:     100
Day 3:     500
Day 4:     1,000
Day 5:     2,500
Day 6:     5,000
Day 7:     10,000
Day 8:     15,000
Day 9:     20,000
Day 10:    25,000
Day 11:    30,000
Day 12:    40,000
Day 13:    50,000
Day 14:    60,000
...
Day 20:    100,000  (target)

Principles that matter more than the table:

1. Send your best segment first. Day 1 to 5 should go to your most engaged recipients: people who opened or clicked in the last 30 days. High engagement early produces the positive signal you want receivers to learn. Save dormant and re-engagement segments for after the IP is warm.
2. Split by receiver. Gmail, Yahoo, Microsoft (Outlook/Hotmail/Office 365) and Apple each maintain their own reputation. A schedule that looks fine in aggregate can be overheating one provider. Watch per-domain results and, if one mailbox provider starts deferring, slow down for that provider specifically while continuing elsewhere.
3. Respect the deferrals. If you hit 4xx throttling, you have moved too fast for that receiver that day. Hold the volume flat for a day or two rather than climbing. Warming is not a fixed timetable; it is a feedback loop.
4. Keep it consistent. Do not warm for three days, stop for a week, then resume. Gaps decay the reputation you just built. Aim to send something every day during the ramp.
5. Keep bounces and complaints brutally low. Suppress anything that has ever hard-bounced. Honour unsubscribes instantly. A complaint rate above roughly 0.3 percent (the threshold Google publishes in Postmaster Tools) will undo days of warming; keep it well under 0.1 percent.
6. Separate streams if you can. Transactional mail (password resets, receipts) earns engagement quickly and bounces rarely; marketing mail is riskier. Many senders warm on transactional traffic first, or keep separate IPs for the two streams so a marketing misstep cannot poison transactional deliverability.

Two to four weeks is a typical warm-up window. High target volumes, cold lists, or a heavily marketing-weighted mix take longer. There is no benefit to rushing: an IP that gets throttled into the spam folder on week one can take far longer to recover than it would have taken to warm patiently.

How authentication supports warming

This is the part generic warm-up guides gloss over, and it is the reason warming belongs on a DMARC platform's blog at all. Reputation does not attach to an IP in isolation. Modern receivers tie reputation to an authenticated identity, and the identity that travels with you across IP changes, ESP changes and forwarding is your domain, established through DKIM and confirmed through DMARC alignment. Get this right and the trust you build during warm-up accrues to your domain, not just to a leased IP you might give up next year.

There are three layers, and each plays a distinct role during a warm-up.

SPF: authorise the new IP before it sends

SPF (Sender Policy Framework) lists the hosts allowed to send for your domain in the envelope sender. The instant you start sending from a new IP or a new provider, that source must be covered by your SPF record, or SPF fails from message one.

If your ESP gives you an include:, add it. If you are warming your own MTA on a specific IP, you may need to add the IP directly:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:198.51.100.20 ~all

Two warming-specific SPF traps:

• The 10-lookup limit. Every include: and similar mechanism costs DNS lookups, and SPF allows only ten before it fails with PermError. Adding a new provider's include: during a migration is a classic way to tip an already-busy record over the limit, which breaks SPF for all your mail, not just the new IP. Check the count with the SPF checker and read SPF PermError: too many DNS lookups if you are near it. Flattening, explained in how SPF flattening works, is the usual fix.
• SPF alignment, not just SPF pass. Many ESPs send with their own bounce (Return-Path) domain, so SPF passes for the provider's domain but does not align with your From domain. That means SPF passing does nothing for DMARC. Which is why the next layer is the one that carries the warm-up.

DKIM: the identity reputation actually sticks to

DKIM signs the message with a private key and publishes the public key under your domain at a selector. When the receiver verifies the signature, the d= domain in the signature is a cryptographically proven identity. This is the identity that big receivers increasingly key their reputation on, and it is the one that survives an IP change.

For warming, DKIM matters in three ways:

• It must be aligned. The d= domain has to match your visible From domain (under relaxed alignment, by organisational domain) for DMARC to pass on DKIM. An aligned DKIM signature means the reputation you build flows to your domain. Confirm it with the DKIM checker and, for the deeper mechanics, SPF vs DKIM: which one aligns.
• It survives forwarding. SPF breaks the moment a message is forwarded, because the forwarder's IP is not in your SPF record. DKIM survives forwarding as long as the body and signed headers are not modified. During a warm-up your engaged recipients include people who auto-forward to other accounts; aligned DKIM is what keeps those messages passing DMARC. See DKIM alignment and forwarding.
• Do not rotate keys mid-warm-up. Changing your DKIM selector or key in the middle of a ramp muddies the identity you are building. Get the key right first, warm second. When you do need to rotate later, do it cleanly: DKIM key rotation.

DMARC: keep enforcement, and watch the warm-up through reports

It is tempting to loosen DMARC to p=none while you warm "to be safe". Resist that. p=none does not improve deliverability of legitimate aligned mail by even a fraction; aligned, authenticated mail passes DMARC regardless of policy. All p=none does is leave the door open for spoofing during the exact period your domain is sending more than usual and attracting attention. The false sense of safety this creates is covered in the p=none false-security trap.

What DMARC genuinely gives you during a warm-up is visibility. The aggregate (RUA) reports show you, per source IP and per receiver, how much of your mail is passing alignment and how much is failing. During a ramp that is exactly the dashboard you want:

• Confirm the new IP appears in reports and is passing DKIM and/or SPF alignment from the first sending day.
• Catch a source you forgot to authenticate before it drags your numbers down. New IPs often coincide with new tools that quietly send on your behalf.
• Spot spoofing or shadow IT that is riding on the attention your domain is getting.

Parse those reports with the DMARC report analyzer; if you are new to the format, reading your first DMARC report walks through it. The goal during warm-up is a clean, near-100 percent alignment rate for the new IP, with no surprise sources.

Gradual rollout for the policy too, if you are also enforcing

If the new IP arrives at the same time you are tightening DMARC, you can ramp the policy as well as the volume, using the pct tag to apply enforcement to a fraction of mail. That is its own discipline, explained in DMARC pct sampling and the broader enforcement journey. For most senders, though, the cleaner approach is: get to a stable enforced policy first, then warm the IP underneath an already-trusted, aligned identity. Reputation built under enforcement is reputation you keep.

A practical warm-up checklist

Before the first warm-up message:

1. Decide you genuinely need a dedicated IP; if volume is low, stay on the shared pool.
2. Add the new IP or provider to SPF and confirm the record still resolves under ten lookups with the SPF checker.
3. Publish and verify aligned DKIM for the new source with the DKIM checker. This is the load-bearing step.
4. Confirm DMARC is published and, ideally, already at an enforced policy with the DMARC checker.
5. Clean the list: remove hard bounces, suppress role accounts and anything not engaged in 90 days, and validate the rest.

During the ramp:

1. Start tiny (tens to low hundreds), send your most engaged recipients first, increase gradually.
2. Watch per-provider results; slow down for any receiver that starts deferring.
3. Treat 4xx deferrals as a signal to hold or back off, never to retry harder.
4. Keep complaint rate under 0.1 percent and bounce rate low; honour unsubscribes instantly.
5. Read DMARC RUA reports daily so the new IP's alignment is verified and no unexpected sources appear. The DMARC report analyzer makes this quick.
6. Sign up for Google Postmaster Tools and Microsoft SNDS so you can watch reputation from the receiver's side too.

After the ramp:

1. Keep volume consistent. A dedicated IP needs steady traffic to hold its reputation.
2. Do not let the IP go dormant; if your sending pauses, expect to re-warm.
3. Monitor for drift. A reputation that took weeks to build can erode in days after a bad campaign.

The practical takeaway

A new sending IP starts with zero reputation, and the only way to build it is to send gradually, to engaged recipients, on a consistent schedule, while keeping bounces and complaints near zero. The volume ramp is the visible half of the job. The invisible half, and the one that decides whether the trust you build sticks to you or leaks away, is authentication: aligned DKIM so the reputation attaches to your domain rather than a leased IP, SPF that covers the new source without blowing the ten-lookup limit, and DMARC kept at enforcement with its aggregate reports open so you can watch the warm-up land in real time.

If you would rather not run the authentication side by hand while you focus on the sending schedule, that is exactly what the done-for-you managed DMARC service handles: aligned SPF, DKIM and DMARC taken safely to p=reject with no email outage, plus emailed monitoring and change alerts that flag the moment a new sending source (like the IP you are warming) shows up in your reports. Start by checking where your domain stands today with the DMARC checker, then keep the DMARC report analyzer open through the ramp.