GuidesChoosing a tool

Is email warmup allowed? What Google and Microsoft have put in writing

Neither company has a rule that mentions warmup. Here are the sentences that do apply, quoted word for word with links, and what they mean for a mailbox in a warmup pool.

Updated 5 October 202610 min read

In short

No public Google or Microsoft policy or terms of service names email warmup. The rules that apply are general ones against deceptive automation, evading filters and spam.
In early 2023 Google told warmup tools that used the Gmail API to switch the feature off or lose their API access. Most tools now sign in over IMAP with an app password, which that developer rule does not cover.
Google has published nothing about warmup over IMAP. That is neither a ban nor permission.
Raising volume slowly and setting up SPF, DKIM and DMARC is what Google recommends. Automated replies and moving mail out of spam are the disputed part.
The mailbox owner carries the risk. Use access you can withdraw, and read what the tool's terms say about who is responsible.

No public policy or terms of service from Google or Microsoft mentions email warmup by name. What exists is narrower: one Google developer rule, which Google used in early 2023 to make warmup tools stop using the Gmail API, and general account rules against deceptive automation and evading filters. Raising your sending volume slowly is something Google itself recommends. The disputed part is the automated engagement, and that risk sits with your mailbox, not with the tool.

The short answer

This is what published sources show as of October 2026. The wording and links follow below.

Question	What the public record says
Does a Google or Microsoft policy name warmup tools?	No.
Has Google acted against warmup tools?	Yes. In early 2023 it told tools that used the Gmail API to switch warmup off or lose their API access.
Does that rule cover tools that sign in over IMAP with an app password?	The rule is written for apps that use Gmail API permissions. Google has published nothing about warmup over IMAP.
Can an account be suspended for breaking Google's policies?	Yes, the policies say so in general terms. We found no documented case tied to warmup.
Has Microsoft said anything about warmup?	Nothing that names it. General rules against spam and "automating inauthentic activity" apply.
Is a slow, steady increase in volume allowed?	Yes. Google's sender guidelines recommend it.

What Google has put in writing

Several Google documents matter here. They bind different people, which makes them easy to mix up.

For developers: apps that use the Gmail API

The Google Workspace API user data and developer policy (last updated 3 September 2026) says that Gmail permissions "are not allowed for certain use cases". One item on its list:

Applications that use multiple accounts to abuse Google policies, bypass Gmail account limitations, circumvent filters and spam, or otherwise subvert abuse or safety restrictions.

This rule binds companies whose software asks for access to Gmail through Google's sign-in screen, not you directly. It is the rule Google invoked in 2023.

For every Gmail account

The Gmail Program Policies (last updated 13 November 2025) apply to whoever holds the account. Two passages are relevant. Under "Spam & bulk mail":

You are not allowed to automate the Gmail interface, whether to send, delete, or filter emails, in a manner that misleads or deceives users.

And under "Circumvention":

Do not engage in actions intended to bypass our policies, subvert restrictions placed on your account, or distribute content removed in other Google products.

The same page says what can follow a violation: Google "may review the content and take action, including limiting or terminating a user’s access to Google products". Google's general Terms of Service (effective 30 July 2026) add that you must not abuse the services, for example by "spamming, hacking, or bypassing our systems or protective measures".

For Google Workspace

Organisations on Google Workspace also agree to the Acceptable Use Policy (last modified 13 October 2025). Among the things a customer agrees not to use the services for:

to test or reverse-engineer the Services in order to find limitations or vulnerabilities, or to evade filtering capabilities, except as expressly permitted in the Agreement

Google's admin help page Spam and abuse policy in Gmail (last updated 1 October 2026) spells out the consequence:

If Google identifies a Gmail user who is violating these agreements, we reserve the right to immediately suspend the user. If the problem is domain-wide, we reserve the right to suspend the entire account and deny administrator access to all the Google Workspace services.

What Google recommends

Google's Email sender guidelines contain a section titled "Increase sending volume slowly to avoid delivery problems". It says:

Start with a low sending volume to engaged users, and slowly increase the volume over time.

"Engaged users" are people who want your mail. A slow ramp is not in question. What the guidelines do not cover is engagement produced by a pool of mailboxes that agreed to answer each other.

What happened in 2023

Until 2022, many warmup tools connected to Gmail through the Gmail API. Then Google wrote to several of them. GMass published a screenshot of the notice in its post announcing the shutdown. We cannot verify the email independently. As published, it reads:

To maintain access to the Gmail API, you must disable the email warming feature by February 13, 2023. If you are unable to remedy these violations, your access to the Gmail API will be revoked.

The notice cites the developer rule quoted above, in the wording of the time. It also adds a recommendation: "To ensure user messages are not flagged as SPAM, we recommend your users instead set up SPF, DKIM, and DMARC email standards for Gmail". SPF, DKIM and DMARC are DNS records that let a receiving server check that a message really comes from your domain.

Several companies described what they did next. These statements date from that time, and what each company offers today may be different.

When	Company	What it wrote
August 2022	lemwarm	"we changed how our warm-up and deliverability service works by switching from API to an IMAP-based system" (post of 24 January 2023)
31 January 2023	GMass	Shut down its warmup system. "Google flat out told us to shut down our warmup system or we’d lose our Gmail API access." (post updated 6 February 2023)
February 2023	Saleshandy	"we recently received a notice from Google indicating that our service violates their terms of service" (post updated 14 February 2023)
1 June 2023	Growbots	Disabled warmup for mailboxes connected through its Gmail integration. "Google sees warm-up tools connected via API as a violation of their terms and requires to disable such service, if companies want to keep their API access." (help article)

Every account describes the same condition: drop the feature or lose API access. And every statement about Google's wider intention comes from a vendor. GMass wrote that Google had "made it clear they don’t want warmup taking place at all and that they now consider it a violation of their terms of service". That is GMass's summary of its own exchange with Google. We found no Google publication that says it.

Does the rule reach tools that use IMAP and an app password?

Most warmup tools now sign in to Gmail the way a mail program does: over IMAP and SMTP, with an app password that you create in your Google account. Growbots described the shift in the help article linked above: "Some of them changed their Google authentication method from API to SMTP/IMAP."

The developer rule is written for apps that request Gmail permissions through Google's sign-in screen. IMAP with Google sign-in needs such a permission too. Google's IMAP documentation says: "The scope for IMAP, POP, and SMTP access is https://mail.google.com/." An app password needs none. There is no registered app for Google to review and no API access to revoke.

That does not make it a route Google approves. The account policies quoted above apply to your mailbox whichever way a tool signs in. And Google's own help page on app passwords opens with this:

Important: App passwords aren't recommended and are unnecessary in most cases.

As of October 2026 we found no Google statement about warmup over IMAP and no documented case of Google acting against it. That is not permission.

What Microsoft says

Microsoft's public documents do not mention warmup either. Which rules apply depends on the kind of mailbox.

For Outlook.com and Hotmail accounts, the Microsoft Services Agreement (published 30 July 2026, effective 30 September 2026) has a code of conduct. One of its rules:

Don’t engage in activity that is fraudulent, false or misleading (e.g., asking for money under false pretenses, impersonating someone else, creating fake accounts, automating inauthentic activity, generating or sharing content that is intentionally deceptive, manipulating the Services to increase play count, or affect rankings, ratings, or comments).

For Microsoft 365, the acceptable use policy in the Microsoft Product Terms says that customers may not use an online service "to spam or distribute malware", and that violations "may result in suspension of the Online Service".

Microsoft has also switched off password sign-in for IMAP in Exchange Online. Its documentation says: "Basic authentication is now disabled in all tenants." A warmup tool can therefore reach a Microsoft 365 mailbox only through Microsoft's own sign-in, and not every tool supports that.

Yahoo's sender best practices do not mention warmup tools. The industry group M3AAWG treats warming new sending IP addresses as normal practice in its Sender Best Common Practices, but does not address pool tools.

Allowed by your provider and legal are separate questions

A provider's policy is part of your contract with that provider. Breaking it can cost you the mailbox. The law is a separate matter. The US CAN-SPAM Act, for example, regulates commercial messages, which the FTC's compliance guide defines as "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service". Warmup messages advertise nothing and go to mailboxes whose owners signed up to receive them.

We have not found a law or court ruling that deals with warmup pools as such. This is not legal advice, and the mail you send once the mailbox is warm has its own rules, which vary by country.

Can Google or Microsoft tell that a mailbox is in a pool?

Neither company has published whether it looks for warmup traffic, or how. Figures you may read elsewhere, such as accounts being suspended after a certain number of days, come without a source.

What is certain follows from how email works: your provider handles every pool message, every sign-in by the tool and every message the tool moves out of spam. Assume the activity is visible. What a provider does with it is not public.

If you use a warmup tool, keep the risk small

Set up SPF, DKIM and DMARC first. It is what Google's 2023 notice recommended in place of warmup.
Use access you can withdraw. You can delete an app password at any time. Google also writes: "we revoke your app passwords when you change your Google Account password".
On Google Workspace, ask your administrator. The Acceptable Use Policy binds the organisation, and a suspension can reach the whole domain.
Do not expect warmup to offset mail people do not want. Gmail's policies say: "When Gmail users mark emails as spam, it increases the likelihood that future messages you send will also be classified as spam by our anti-abuse systems."
Read who carries the risk. Some tools say it plainly. Warmerly's network terms (24 September 2026) state: "You are responsible for checking that enrolling a mailbox is compatible with those terms and policies, and you enrol it at your own risk." Assume the same of any tool.
If you cannot afford to lose the mailbox, ramp by hand. Send real mail to people who will answer, and raise the volume slowly, as the sender guidelines describe.

Where WarmupBay stands

WarmupBay is a pool tool, so the question on this page applies to us. Mailboxes in the pool send each other short messages automatically, reply to some of them, take warmup mail out of the spam folder and file it in a folder called "WarmupBay". That is the kind of automated engagement no provider has approved, and we do not claim otherwise.

Gmail and Google Workspace mailboxes connect with an app password, other providers over IMAP and SMTP. WarmupBay does not connect through the Gmail API.
The volume is small: 3 warmup emails a day at first, one more each day, up to 10. With a badge on your website, up to 30.
When you connect, WarmupBay checks SPF, DKIM and DMARC for your domain and shows a ready-made DMARC record. If the records are still missing after 72 hours, warmup stops.
The limits: the service is new (started October 2026), it takes one mailbox per account, and Microsoft 365 and Outlook.com mailboxes cannot be connected yet. There are no deliverability tests and no blacklist monitoring.
It cannot guarantee inbox placement, or that a provider will never object.

If your mailbox is at Microsoft, you need a tool that supports Microsoft's sign-in. If any risk to the account is too much, ramp by hand. If a pool is right for you, read how a warmup pool works first, then connect a mailbox for free. The home page answers a few more questions.

Questions people ask

Did Google ban email warmup in 2024?

We found no such announcement. What took effect in February 2024 were Google's requirements for everyone who sends to Gmail, such as SPF or DKIM authentication and a spam rate below 0.3%. They do not mention warmup tools. The notices to warmup vendors that used the Gmail API date from late 2022 and early 2023.

Will my Google Workspace account be suspended if I use a warmup tool?

Nobody outside Google can tell you. Google's policies allow it to suspend a user or a whole domain for violations, but they do not say whether warmup counts as one, and we found no documented case. Numbers quoted on blogs come without a source.

Is warming up a mailbox by hand against the rules?

No. Writing to people who expect your mail and raising the volume gradually is what Google's sender guidelines describe. It takes more of your time and gives you no dashboard, but nothing in the policies quoted on this page speaks against it.

Does it matter whether I use a free Gmail address or Google Workspace?

Different documents apply. A free Gmail account falls under Google's Terms of Service and the Gmail Program Policies. A Workspace mailbox also falls under your organisation's agreement with Google, including the Acceptable Use Policy, and the option to create app passwords may be missing in a work account. A suspension in Workspace can affect the whole domain.

Can I use a warmup tool with a Microsoft 365 mailbox?

Only with a tool that supports Microsoft's own sign-in, because password sign-in for IMAP is switched off in Exchange Online. Microsoft's terms do not mention warmup. WarmupBay cannot connect Microsoft 365 or Outlook.com mailboxes yet.

Does warming up a mailbox make cold email compliant?

No. Warmup is about how providers judge a sender. It changes nothing about the laws on commercial email, and nothing about sender requirements such as authentication and a low spam rate.