Validity's Heatwave Blocklist: What It Means If You Use Email Warm-Up
Truitt Dill ·
The Heatwave blocklist is a domain blocklist Validity launched on September 3, 2026 to catch one specific thing: sending domains whose reputation was built by automated warm-up networks instead of real recipients. If you have ever connected a domain to a warm-up tool before running cold outreach, this list is about you.
Two things make Heatwave different from the blocklists most senders know. It lists domains, not IP addresses, so moving to a new sending platform does not help. And stopping the warm-up does not clear a listing. Validity treats a warming listing as a record of something that already happened, and that record stays.
Here is how Heatwave works, how to check your domains, and what to do with the result.
What is the Validity Heatwave blocklist?
Heatwave is a domain blocklist (DBL) run by Validity, the company behind Everest and Sender Score. It flags sending domains tied to synthetic reputation warming and the cold outreach that usually follows. The data comes from the Validity Intelligence Network, which includes spam traps. A listing means the domain was seen as the sender on mail that reached Validity's data sources and scored as cold email infrastructure.
Anyone can check a domain for free at lookup.validity.tools, up to 100 checks a day. According to Validity's launch announcement, the data is also mirrored into Validity's existing DNS reputation zones, so companies that already buy Validity's reputation data get Heatwave without a separate subscription.
The list is large and growing fast. On October 16, 2026, the lookup page showed about 1.3 million listed domains and roughly 6,300 new listings in the previous 24 hours.
How warm-up networks work, and why Validity calls them deceptive
Most warm-up tools work the same way. You connect a mailbox on your new domain to the service. The service enrolls it in a pool of thousands of other mailboxes, connected by its other customers or run by the service itself. Those mailboxes trade messages with yours on a schedule. The receiving side opens the mail, marks it important, pulls it out of spam and replies with generated text. To a mailbox provider, it is supposed to look like a new domain having real conversations.
Validity calls this synthetic reputation warming, and its position is that the engagement is fabricated. Opens, replies and "not spam" clicks are meant to show how real people feel about your mail. A warm-up pool manufactures them. Validity also points to two side effects. Your domain ends up trading mail with hundreds of unrelated domains, some of them already burned. And the moment real recipients get your mail, engagement drops sharply, which is a signal in itself.
Validity says Heatwave looks for groups of signals that include:
- Synthetic content patterns
- Shared templates and personas across many domains
- Freshly registered domains
- Known cold email sending infrastructure
Its listing policy adds that scoring weighs domain age, sending infrastructure and message characteristics, and that a domain needs multiple corroborating signals to cross the listing threshold.
Ramping up a new domain is not the problem. The difference is who is on the other end.
| Legitimate ramp | Warm-up pool | |
|---|---|---|
| Who receives the mail | Real people who know you or asked to hear from you | Automated mailboxes run through the warm-up service |
| Where engagement comes from | Recipients choosing to open and reply | Scripts that open, rescue and reply |
| Content | Your actual emails | Generated filler written to pass filters |
| What the reputation reflects | How real people respond | How bots were programmed to respond |
The three Heatwave listing stages
When you look up a listed domain, the result shows which stage it is in.
| Stage | Label | What it means | What happens if you stop |
|---|---|---|---|
| 2 | Warming | Seen in synthetic warming, no real cold outreach seen yet | The listing stays. Validity calls it a permanent historical observation. |
| 3 | Active outreach | Warmed, then seen sending live cold campaigns | Can drop back to stage 2 if the outreach stops. The warming record stays. |
| 4 | Pre-warming | Part of a family of related domains run together for warming, listed before any sending is seen | Advisory. It comes off automatically if the domain is removed from the family assessment. |
Stage 4 is the one that catches people off guard. If you bought a batch of similar domains for cold outreach and warmed some of them, the rest can be listed before they send a single email. Validity notes that a pre-warming listing does not claim the domain sent anything. On the day this post was published, the lookup homepage showed eight domains with the same name pattern, all pre-listed on the same date.
Each listing also carries a score from 1 to 100. Do not read too much into it. It shows where a domain sits against other recent listings, it is recalculated every hour, and it does not decide whether a domain gets listed. A score of 0 means a Validity analyst added the domain by hand.
Who uses Heatwave data
Validity's launch announcement names Comcast, Proofpoint, Spamhaus and SURBL as using or evaluating Heatwave, along with email service providers. The newsletter platform beehiiv is quoted in support. Validity's guidance is that mailbox and security providers should consider filtering mail from listed domains at their discretion, and that email service providers should consider the signal when onboarding customers and reviewing outbound quality.
Two cautions. "Using or evaluating" is not the same as blocking every listed domain. Each partner decides how much weight to give the signal. And Validity has not named Gmail or Microsoft. I would not assume a listing means Gmail rejects your mail, but I would not treat it as harmless either. Proofpoint filters inbound mail for many of the companies B2B outreach targets, and an email service provider can use the signal to turn down your account.
How to check if your domain is on the Heatwave blocklist
- Go to lookup.validity.tools and enter the domain only. Do not enter a URL, an email address or an IP address.
- Check every domain you send from. Lookups are exact-match, so a subdomain like mail.yourcompany.com is checked separately from yourcompany.com. Include secondary domains bought for cold outreach and any domains an agency set up for you.
- Look for related listed domains. If the lookup shows any, find out who registered them and why.
- Read the result. A listing shows the classification, the observation age (how long since warming was first seen, in buckets from under 7 days to over 180 days), the score, the first and last dates the domain was observed, and the date it was listed. A "not currently listed" result is not a clean bill of health. Validity says plainly that it is not a certification.
- Check the other major lists too. Heatwave is one signal. Look at Spamhaus DBL and SURBL as well. Our blacklist removal guide covers how.
If you work with DNS, the lookup also shows the raw answer from the bl.validity.tools zone in the format 127.age.score.stage. For example, 127.0.42.2 means warming was first observed less than 7 days ago, the score is 42 and the domain is in stage 2. An NXDOMAIN answer means the domain is not listed. Bulk checks and DNS access need partner access.
What to do if your domain is listed
Validity's own advice is to investigate internally before assuming a mistake. Warm-up is often switched on by a sales rep, an agency or an outside vendor without anyone else in the company knowing. Ask your sales, marketing and revenue operations teams, and any agencies you work with, before you do anything else.
You used a warm-up service
Turn it off on every domain, not just the listed one. Stopping will not remove the listing, but it is the step Validity recommends, and it keeps your other domains from adding to the record.
Then decide whether the listed domain is worth keeping. If it is your main company domain, keep it, send only to real contacts who expect to hear from you, keep volume low, and watch your domain reputation in Google Postmaster Tools. If it is a secondary domain bought for cold outreach, retiring it is usually simpler than carrying the record. Warm any replacement domains manually, with real recipients.
A related domain you don't own is listed
This is usually a lookalike registered by an agency, a vendor or someone imitating your brand. Find out who registered it and through which platform. If it is an agency working for you, ask them to stop the warm-up. If it is impersonation, enforce DMARC on your main domain with a policy of quarantine or reject, so nobody else can send mail as you.
Your domain is pre-listed (stage 4)
Validity has linked the domain to a family of domains used for warming. Stop warm-up across every domain in that family. For domains you do not plan to use, park them: publish a DMARC record with p=reject and an SPF record that authorizes no senders, then send nothing from them. If none of your domains were ever warmed, request a review.
You believe the listing is wrong
Use Validity's listing review form. Validity removes a listing only when the original determination was wrong. Its examples include incorrect classification or attribution, impersonation, a compromised account or unauthorized use, and confusion between unrelated domains. "We stopped using the warm-up tool" is not a reason it accepts. Reviews are manual and typically take 2 to 5 business days. Be specific about what you send, who you send it to, which platform you use, and how you confirmed that no warm-up service touched the domain.
Is email warm-up still safe for cold outreach?
Pool-based warm-up is not. Even before Heatwave, I treated warm-up tools as a convenience with limited benefit, because the engagement they generate is not real and mailbox providers keep getting better at spotting it. Now there is a concrete cost on top of that: a listing that stays on your domain's record after you stop.
Heatwave is not a ban on cold email. Cold email is legal in the United States when it is done properly. What Heatwave targets is the shortcut of manufacturing a reputation before the first real email goes out.
Warming a new domain is still necessary. It just has to be done with real people:
- Authenticate first. Set up SPF, DKIM and DMARC before you send anything.
- Start with people who know you. Customers, partners and contacts who will open and reply.
- Grow slowly. Increase volume over four to six weeks as real replies come in.
- Watch the right numbers. Use Google Postmaster Tools for domain reputation, not a warm-up dashboard's placement score.
- Test before you scale. Run an inbox placement test with real seed accounts across Gmail, Outlook and Yahoo.
It is slower. That is the point. The reputation you end up with reflects how real people respond to your mail, and no blocklist can take that away. Our email warming guide walks through the process, and our review of warm-up tools covers why pool-based tools are now a liability.
What the early numbers show
Validity publishes live counts on the Heatwave lookup page. As of October 16, 2026, it showed:
- 1.3 million domains listed
- 23.7 million spam trap signals analyzed (Validity's estimate)
- About 6,300 new listings in the previous 24 hours
The page does not break the total down by stage, so there is no public figure yet for how many listings are pre-warming, warming only or active outreach.
The data we are collecting
A lookup tells you whether a domain is listed. It does not tell you why one domain was caught and a similar one was not. To answer that, we are going back through the domains we have set up for clients and checking each one against Heatwave.
For each domain, we are recording where and how it was warmed, which DNS provider it uses, and the other details of how it was set up. Next to that, we are recording what Heatwave shows for it: whether it is listed, its stage, its score and how long ago warming was first observed. Putting the two side by side should show which setup choices line up with a listing and which do not.
We will update this post with the results once the data is ready. That update will include how many domains we checked and how they were chosen, so you can judge how closely the findings match your own setup.
Frequently asked questions
Does Heatwave list IP addresses?
No. Heatwave lists sending domains only. Changing your IP address or your email service provider does not change a domain's Heatwave status.
Will stopping warm-up get my domain removed?
No. Validity's listing policy says warming listings do not expire because of inactivity or changed sending practices. A listing is removed only if a review finds the original determination was wrong. The active outreach stage can drop back to warming-only if the outreach stops.
Does Gmail use the Heatwave blocklist?
Validity has not said. The organizations named in its launch announcement are Comcast, Proofpoint, Spamhaus and SURBL, along with email service providers.
Can my domain be listed if it never sent cold email?
Yes. A domain can be pre-listed as part of a warming family before it sends anything, someone else in your company or an agency may have connected it to a warm-up tool, or someone may be impersonating it. If none of those apply, request a review.
How is Heatwave different from Spamhaus DBL?
Spamhaus DBL lists domains with poor reputation found in spam, including domains that appear in links inside messages, and can remove a listing once the cause is fixed. Heatwave looks only at sending domains and one behavior, synthetic warming, and does not remove a warming listing because the behavior stopped.
Need help with a listed domain?
If a domain you rely on is listed, or you are not sure how your domains were warmed, start with a free inbox placement test to see where your mail lands today. If you need to rebuild sending infrastructure without a warm-up pool, that is part of our email infrastructure work, or you can talk to a deliverability expert about your situation.
