Cold email deliverability: the 14-day warmup protocol that actually works

A cold email domain that hasn't been warmed properly is a dead domain. Every send goes to spam, which lowers your reputation further, which makes the next send more likely to go to spam. The death spiral takes about ten days.

The fix is a 14-day warmup protocol that builds reputation gradually, in the specific pattern mailbox providers expect. Skip a step and your domain is permanently flagged. Run the protocol correctly and you'll be sending 200+ cold emails per day from that domain by day 21.

Here's the exact schedule.

What mailbox providers measure

Before the schedule, the mental model. Gmail, Outlook, Yahoo, and the rest evaluate every inbound email on roughly these signals:

1. Authentication: Does the message pass SPF, DKIM, and DMARC?
2. Sender history: How long has this domain been sending? What's its reputation score?
3. Engagement: When recipients receive your mail, do they open it? Reply? Delete unread? Mark as spam?
4. Volume curve: Is your send volume growing organically or did it spike from zero to thousands?
5. Content signals: Are there links? Images? Spam-trigger words? Mismatched display names?

A new domain has zero history on signals 2-4. The provider's only signal is the volume curve. If you launch a campaign of 500 emails on day three, the curve looks identical to a spammer's burner — instant flag.

The warmup protocol exists to build legitimate signal across all five categories before you ever send a real cold campaign.

Pre-warmup setup (day zero)

Before the first warmup send, you need:

• Authentication records configured on the domain (SPF, DKIM, DMARC). DMARC starts at p=none — don't escalate to p=quarantine until after warmup.
• A custom tracking subdomain (don't use the default tracking domain — those domains have shared reputation across thousands of senders).
• A real mailbox the domain can receive replies into. Not a forwarding alias. A real, addressable inbox.
• A signature with a real physical address, real phone number, and a working unsubscribe link.

Skip any of those and the rest of the protocol is wasted effort.

The 14-day schedule

The numbers below are per mailbox per day. If you have multiple mailboxes on the domain (recommended — 3 to 5 is typical), you scale these by the mailbox count.

Days 1-3: Engagement-only sends

• Volume: 5-10 sends per mailbox per day
• Content: Plain text. No links. No images. No marketing language.
• Recipients: A warmup pool of other warmed inboxes that auto-reply, mark as important, and move out of spam if they land there.
• Goal: Build the basic "this domain sends mail and people interact with it" signal.

Days 4-7: Volume ramp

• Volume: 15-25 sends per mailbox per day, doubling roughly every two days
• Content: Plain text with a single trusted link in some sends (your homepage or LinkedIn, not a tracked CTA link)
• Recipients: Continue with the warmup pool. Add a few real conversations if you have them — replies from real humans are the strongest signal.
• Goal: Accustom the providers to seeing increasing volume without it looking like a spike.

Days 8-11: Mixed content

• Volume: 30-45 sends per mailbox per day
• Content: Add HTML formatting. One image is fine. Up to two links per email. Begin including the actual signature block you'll use in production.
• Recipients: 70% warmup pool, 30% real correspondents (team, advisors, partners, anyone who'll actually read and reply).
• Goal: Train the providers on the visual fingerprint of your real production emails.

Days 12-14: Reputation lock-in

• Volume: 50-70 sends per mailbox per day
• Content: Production-grade. Use the actual templates you intend to send in your campaigns.
• Recipients: 50/50 warmup pool and real inboxes. Make sure replies are happening on the real-inbox side.
• Goal: Cement the reputation at a level that supports day-15 cold launches.

Day 15 onward: The cold campaign window

You can begin actual cold sends on day 15, but with rules:

• Maximum 30 cold sends per mailbox per day for the first week
• Continue the warmup pool sends in parallel — don't drop them. Warmup is ongoing, not one-time.
• Watch your inbox placement metrics daily. If placement drops below 80%, pause cold sends and resume warmup-only for 48 hours.
• Increase cold volume by 20% per week, maxing out at around 200 cold sends per mailbox per day.

The 200/day ceiling is conservative. You can push higher with a perfectly warmed domain and a clean list, but the marginal volume above 200 carries disproportionate flag risk.

What kills warmup mid-protocol

The most common warmup deaths I see:

Spam-trap addresses in your warmup pool. If your warmup tool dumps your sends to old, abandoned addresses that have been converted into spam traps, your domain gets flagged faster than if you'd done nothing. Use a reputable warmup pool with active human inboxes.

Real-name mismatch in the From header. If your mailbox is john@youragency.com but the From display name is "Sarah from Marketing," the provider treats that as deception. Match the display name to the mailbox owner.

Authentication that passes 99% of the time. SPF/DKIM/DMARC must be 100%. A single failed authentication during warmup pulls your reputation score down faster than ten successful sends pull it up.

Premature cold launches. Day 10 is too early. Day 12 is too early. The protocol is 14 days for a reason — the algorithms have learned to detect compressed warmup patterns and flag them harder than no warmup at all.

Sending to bad lists. Even a perfectly warmed domain dies in 48 hours if your first cold campaign hits a list with 5%+ bounces. Validate every list before the first send. We hard-block any campaign with a bounce rate over 2.5% in the AcquireOS pre-flight checklist — for exactly this reason.

How AcquireOS handles warmup

The AcquireOS Operator tier wires this protocol in as a default. New operators can't launch a cold campaign until their domain hits an 80+ warmup score, which takes the standard 14 days minimum. The platform monitors warmup pool engagement, tracks reputation across providers, and gates cold launches behind the score threshold.

We made it a hard gate because every operator who tries to skip it ends up needing a fresh domain inside two months — which costs more time than just running the protocol correctly the first time.

The summary

• New domains die without warmup. There is no shortcut.
• The protocol is 14 days minimum, structured as engagement → volume ramp → mixed content → reputation lock-in.
• Cold campaigns start day 15, capped at 30/day for the first week.
• Warmup pool sends continue forever — they're not a one-time setup.
• Authentication, list quality, and From-name matching matter as much as the schedule itself.

If you'd rather have all of this enforced as defaults rather than discipline, book a call — we'll show you what the gated workflow looks like inside AcquireOS.