Peer-to-peer warmup works by trade. The service connects your mailbox to a pool of other customers’ mailboxes, which send each other filler messages and then open, star and reply to them. Every mailbox in the pool is there to do exactly that. The engagement is the membership fee. It arrives because the pool owes it to you, not because the message earned it.
In September 2026, a domain catalog built to find that pattern launched and made some waves. It changes less than the headlines suggested. It also leaves an older question untouched. Peer-to-peer warmup was a bad bet long before any catalog existed, for reasons that have nothing to do with being listed.
Key Takeaways
- Peer-to-peer warmup trades engagement instead of measuring it. Reciprocation is the arrangement, so the opens and replies arrive whatever you send and tell you nothing about the message or where it landed.
- Heatwave, a domain catalog launched in September 2026, has one listing stage that is preemptive by the vendor’s own description. A domain can be published as a registered sibling of a family assessed as operated together for warming, before any sending has been observed from it.
- Where warming is observed, the listing is durable. It does not expire based solely on inactivity or changed practices, and the published route off is a review that finds the original call wrong. The preemptive stage is the stated exception, called advisory and reversible, though no schedule is published for when one clears.
- No named party has said it filters mail on this list. Neither blocklist operator has published a route from a listing to a bounce, and nobody has put a number on what one costs.
How peer-to-peer warmup works
You connect a mailbox to the service, which adds it to a pool of mailboxes belonging to its other customers. Mail flows between them on a schedule, and each mailbox performs the actions an interested recipient would perform.
The reciprocity is what causes the trouble. A pool makes your domain’s sending pattern a joint product with senders you did not choose, and the engagement arrives on schedule whether the message deserved it or not. Warmup that sends to mailboxes with no obligation to reciprocate brings no other sender into it.
This applies to warmup of any kind, ours included. Warmup builds domain reputation, not campaign interest. A warmed domain helps you get through the door; it does not make anyone open what you sent.
What the new catalog lists
Validity’s Heatwave launched on September 3, 2026. It lists sending domains, not IP addresses, so the IP reputation work you may already do does not cover it. Listing is automatic, and it opened with more than a million domains at launch. Heuristic scoring evaluates domain age, sending infrastructure, and message characteristics, and a domain over the threshold goes on without anyone filing a report.
Neither Spamhaus nor SURBL has described a route from a Heatwave listing to a bounce. In Validity’s announcement, Spamhaus says the signal helps it “correlate domains… identify patterns earlier and respond more precisely,” and SURBL calls it “a complementary signal built from a different data set.” Both are describing corroboration in their own investigations of warming operators. Neither has published anything about Heatwave in its own voice, and we have found no published measurement of what a listing does to delivery.
Listed before you send
By its own published description, the catalog includes a stage for domains it has not observed sending at all. When it assesses a set of domains as a family operated together for warming, other registered domains in that family may be published preemptively. It does not publish how it decides a set of domains is one family, so a sender cannot rule that out from the inside.
That stage is also the one the vendor treats most leniently. Validity calls preemptive listings advisory and reversible, and says a domain un-lists automatically once it drops out of the family assessment, though it publishes no cadence for when that happens, so this is not a thing to wait out. The listing earned by observed warming is the durable one. It does not expire based solely on inactivity or on changed sending practices, and by its published removal policy, removal comes only from a review finding the original call wrong, typically two to five business days.
A related domain’s listing is not yours
Next to a domain that is clean itself, the lookup also displays listed domains whose names resemble it. Because that match is on the name alone, those can belong to businesses with no connection to you. The display is alarming, but it is not a listing. One consultancy published a scan of 1,055 domains eight days after launch: 1.0% listed, 86.9% clean, the rest flagged as candidates. Separately, 7.3% had listed lookalikes attached. That was its own selection, not a random sample, so the rates describe that list and not the internet. On it the panel fired about seven times more often than a listing did.
The risks that predate the catalog
The practice still carries the problems it always did.
The engagement is traded, not measured
The pool pays the same whatever you send, which makes the engagement uninformative. A message that landed well and one that fell flat come back with identical opens and replies, so there is nothing in them to read. And the mailboxes supplying that engagement are other customers’ domains in the middle of their own warmup, so you cannot check the standing of the accounts vouching for you.
Membership puts your domain in the pattern
A pool is a two-way arrangement, so joining one changes what your domain does. Your mailbox sends filler out to domains you did not choose and engages with their mail, so your domain becomes part of a cluster that can be assessed as a unit. That is the behavior a catalog like Heatwave is built to find, and you cannot opt out of it while staying in the pool. It also does not have to be you who signed up. An agency, a vendor, or a colleague on a trial can be warming under a domain you own without anyone inside the company knowing, which makes auditing who sends as you worth doing on its own terms.
Someone else holds the keys
Pool-based warmup needs ongoing access to the mailbox to send, read, and act on messages on your behalf. That access lasts as long as the integration does, and keeping it safe is the vendor’s job, not something you control. It also tends to be broader than the task. An app password or a mail-scope token is not limited to sending, so the same credential that posts filler mail can read everything else in the mailbox. Revoking it happens in your own provider’s security settings rather than in the vendor’s dashboard, which is worth knowing before you need it.
The tool’s access is not guaranteed
The access also depends on a platform’s permission. Google does not publish a rule about email warmup, and its Gmail API policy does not name warmup tools. What it publishes is a restriction on which applications may hold Gmail API scopes: under Appropriate access to and use of Gmail Scopes, the disallowed list includes “applications that use multiple accounts to abuse Google policies, bypass Gmail account limitations, circumvent filters and spam, or otherwise subvert abuse or safety restrictions.” What is on record is a single case: GMass says Google instructed it in late 2022 to switch its warmup system off or lose Gmail API access, and the feature was gone by early 2023.
Warmup spends the budget your campaigns need
One ceiling is published. A Google Workspace mailbox can send 2,000 messages a day, 500 on a trial account, and every warmup message your mailbox sends spends part of the same budget your real campaigns need. No vendor publishes how much throughput a pool can direct at any one customer. Pool sizes are advertised; per-customer allocation is not. Treat the number of reciprocal messages your domain receives as unknown instead of estimating it.
How to build engagement that counts
The alternative takes longer. That is the only thing wrong with it.
Get authentication right before the first send, not after. That means SPF that resolves inside the ten-lookup limit, DKIM signing on every stream you send from — your ESP, your CRM, your transactional provider, each one separately — and a DMARC record whose alignment passes, not just a DMARC record that exists. A ramp built on failing authentication teaches providers the wrong thing about you, and you do not get those days back.
Then start narrow. Your first sends should go to the contacts most likely to open, so recent buyers, active subscribers, anyone who has replied to you. Those sends are what the providers have to judge you on. Hold there long enough to see a pattern, not a single day. Then widen in steps, and take the next step only when the last one held.
Let your numbers set the pace. Slow the ramp if your bounce rate passes 1% or spam complaints pass 0.1%. Google publishes 0.1% as the rate to stay under and 0.3% as the rate never to reach. The gap between those two numbers is what catches people out. By the time you are at 0.3%, filtering has usually already started. Track bounces in your ESP dashboard and complaints in Google Postmaster Tools; both are lagging indicators, so react to the trend rather than a single day. Most senders reach target volume in two to four weeks, and a new domain ramping to 1,000 a day to an opt-in list comes out around 23 days on our planner’s recommended pace. A colder list or a more conservative setting gives a different number, so run it against your own inputs.
Know where your mail lands before your list does
InboxAlly is a deliverability platform, and warmup is one capability inside it rather than the category it belongs to. Nothing about it is reciprocal. You send your real message to InboxAlly’s own mailboxes, real inboxes at Gmail, Google Workspace, Outlook, Microsoft 365 and Yahoo. Opens, replies and spam-to-inbox moves happen inside each provider’s own browser interface. Your domain is never pooled with another sender’s.
Run it either way. Hands-on, the engagement attaches to the real content you are mailing. InboxAlly’s mailboxes go into a segment you were already sending to, and in that mode InboxAlly needs no access to your sending account at all. Hands-free, Adaptive Autowarmup generates and paces a sequence into those same mailboxes, adapting as your domain’s signals change. Because that mode does the sending, it needs a send path: either a domain you verify by DNS, or credentials for the account you want it to send from. Neither mode asks to read your mailbox. You can run both at once.
Autowarmup’s content is generated rather than drawn from your campaigns. What it does not do is put your domain into a reciprocal exchange. In both modes you get placement reported per provider across those mailboxes: primary inbox, promotions, or spam. The free placement tester is a separate tool with its own sixteen addresses, and it reports each one individually: inbox, spam, or never arrived at all.
That is placement detected across InboxAlly’s own mailboxes, not a readout of where your real recipients received your mail; nobody outside the mailbox providers has that view.
What you can actually check
There is one thing you can look up, within limits. By Validity’s account the public DNS resolver has been retired and DNS access is now a partner channel, so bulk checking is gone and what is left is a rate-limited web lookup. What a yes from it gets you is less clear. No mailbox provider or security vendor has said it acts on the list, and no one has measured what a listing does to delivery.
You can also see where you stand on the lists that are consulted at delivery time, which is the thing nobody has established about this one. Our spam database lookup checks a domain or IP against more than 50 blocklists: Spamhaus SBL, XBL, PBL and DBL, Barracuda, SpamCop and Invaluement among them, with the delisting route for each one that has you. A clean result there is worth having, and it tells you nothing about this catalog.
None of this buys immunity from being cataloged. The scoring runs on domain age, sending infrastructure, and message characteristics, so no vendor, us included, can promise your domain will never be scored into a list like that.
That leaves one question you can answer either way. Where is your mail landing right now? A listing matters only if it is costing you placement, and placement is measurable.
What a slow ramp controls
A slow, honest ramp controls your sending record, not your listing status. Staying out of pools is the part you decide. Where your mail is landing is the part you can always see, so measure it and ramp against what it tells you.