Cold Email's Warmup Trick Just Got a Blocklist

On 3 September 2026, Validity switched on a new email blocklist called Heatwave. It was not a warning shot or a "we are monitoring this space" blog post. It launched with more than one million domains already on it.

That is the whole story in one number. A grey-area practice the cold outreach industry has run openly for years now has a public address, a queryable list, and a lookup page where anyone can type in a domain and see where it stands.

What Heatwave is looking for

Validity describes Heatwave as purpose-built to identify "unethical cold email practices including artificial domain warming." It is assembled from what the company calls millions of targeted data signals, and its job is to spot manufactured send reputation through fake engagement.

The mechanism description in the announcement is worth reading slowly, because it is unusually specific. It targets services that connect to a customer's email tenant, register domains resembling the customer's own, and generate synthetic messages, opens, clicks and replies.

If you have ever bought a cold email tool, you have just read a product description.

The credit score you built by lending yourself money

Sender reputation works a lot like a credit score. Mailbox providers cannot know in advance whether you are worth listening to, so they watch how people treat your mail. Do recipients open it? Reply? Fish it out of spam? Good history buys you the benefit of the doubt on the next send.

Warmup pools are the email equivalent of building a credit file by lending yourself money and then diligently paying yourself back. Thousands of accounts in a shared network open each other's mail, click each other's links, and write each other short friendly replies. None of it is real. All of it counted, at least until now.

Everyone knew this was a fiction. The defence was always that providers tolerated it and that everyone did it. Heatwave converts tolerance into a list, and a list is a very different object from a shrug.

Validity named no vendors. It did not need to.

Nowhere in the announcement is a single warmup tool named. What is named is the behaviour, in neutral technical language, in enough detail that anyone who has configured one of these tools will recognise their own setup in the description. That is a deliberate and rather elegant piece of positioning: no legal fight, no vendor feud, just a description of an architecture and a list of the domains exhibiting it.

Why buying fresh domains makes it worse

The instinct in outbound has always been that domains are cheap and disposable. Get burned, buy new, start again. That instinct is exactly wrong here.

Heatwave lists on behavioural pattern, not on an individual domain's history. Registering a clean new lookalike and running it through the same warmup pool reproduces the pattern that flagged the last one. The list is not looking at a face that can be fooled by a new haircut. It is looking at a gait.

Rotation does not escape a behavioural classifier. It feeds it.

The part with real blast radius

Here is the uncomfortable second-order effect. The entire point of a lookalike domain is that it resembles the real one. That is why deliverability people recommend them, to keep the primary domain clean by sending from a cousin of it.

Resemblance runs both ways. A domain that looks like your brand, listed publicly for synthetic engagement, is a small piece of brand exposure sitting on somebody else's server, findable by anyone who thinks to look. The burner asset turns out to be less disposable than the pitch implied.

How hard this bites depends on one thing

Validity is aiming Heatwave at two audiences. Email service providers can use it to find customers who built their sending reputation on artificial warming rather than legitimate list development. Mailbox providers can use it as an additional signal for filtering decisions.

That second one is the whole ballgame, and it has not visibly happened yet. A vendor list is a vendor list until a mailbox provider ingests it. The moment one does, warmup stops being a reputation asset and becomes a reputation liability. You would be paying a monthly subscription for the thing that gets you flagged.

The volume math makes it sting more. Outreach platforms already concede that deliverability is the soft spot in the stack. Apollo's own guidance points users toward starting around 50 sends per day per mailbox and pairing with a dedicated sending tool once you push past roughly 200 a day. The industry's answer to that ceiling has always been identical: more mailboxes, more domains, more warmup. Heatwave taxes precisely that answer.

The boring option just got interesting

There is a version of sender reputation no blocklist can touch, and it is the unglamorous one. A domain with genuine transactional history. A support inbox where real humans reply. A newsletter real subscribers actually open. Campaigns aimed at small warm segments that generate real replies instead of blasts at cold thousands.

It is slow, it does not scale on a credit card, and it takes months rather than a fortnight. Those are usually filed as drawbacks. They are the reason it holds. Anything you can buy in two weeks, your competitor can buy in two weeks, and a classifier can learn in one.

The sentence to look out for is a short one, appearing somewhere official: a mailbox provider's postmaster guidance, or a major provider's acceptable use policy, referencing Heatwave by name. That is the line between a vendor's list and an enforcement mechanism. Until then, this is a warning that showed up with a million examples already attached, which is a considerably louder warning than most.