# How our email infrastructure works

> How mail reaches and leaves a Warmerly hosted mailbox: the MX, SPF, DKIM and DMARC records you publish, separate mail lanes, and how a new IP earns volume.

Source: https://warmerly.com/docs/infrastructure

This page explains how Warmerly sends mail for the mailboxes we host, and how it keeps one sender's problems away from everyone else. It describes the model, not the machinery: server names and addresses are left out on purpose, because publishing them would help spammers and attackers more than it would help you.

Three words used below:

- **Sending address**: the internet address (IP address) a mail server sends from. Receiving providers keep a reputation for each one.
- **Sending domain**: the part of your email address after the @. Providers keep a reputation for that too.
- **Receiving provider**: whoever runs the inbox a message is going to, for example Gmail, Microsoft (Outlook and Microsoft 365), Yahoo or Apple (iCloud).

**Which mailboxes this is about.** Mailboxes Warmerly hosts for you (OneMail), ready-warmed mailboxes you buy from us, and the free mailbox new accounts get. A mailbox you connected from your own provider, such as Gmail or Microsoft 365, sends through that provider, so it uses that provider's sending addresses, not ours. The bounce brake and the automatic pauses for high bounces and spam refusals in [Why did my sending slow down or pause?](https://warmerly.com/docs/help/sending-slowed-or-paused) still apply to it.

## How mail reaches a hosted mailbox, and how it leaves

Mailboxes Warmerly hosts (OneMail) sit on mail servers we run. A domain lives on one of them, and the servers work as a pool, so we can add capacity or move a domain without you doing anything.

**Mail coming in.** When someone emails `you@yourdomain.com`, their provider looks up your domain's **MX record**. It names our mail server for your domain; the message is delivered there, stored in the mailbox, and shown in your Warmerly inbox. Hosted mailboxes are managed by Warmerly and used through the Warmerly inbox and API. No external login (IMAP or SMTP details) is provided for them today.

**Mail going out.** A message sent from your mailbox goes through our sending network, which sends it from the paid lane's sending addresses (see below). The receiving provider then checks three things against your domain's DNS before it decides where the message goes:

- **SPF**: is this sending address allowed to send for your domain?
- **DKIM**: is the signature on the message valid? We sign every message with your domain's own key.
- **DMARC**: do SPF and DKIM line up with the address in the From line? Hosted mailboxes are set up so they do.

Bounces (replies that say "this address does not exist") are routed to a `bounce` address on your own domain, so they come back to us rather than to your inbox.

## What DNS records do I add for a Warmerly-hosted mailbox?

Warmerly shows you the exact records on the domain page, and that page is the one to copy from. The records below describe what each one is for. Every record points at Warmerly’s stable names: `mail.warmerlymail.com` for incoming mail and `_spf.warmerlymail.com` for sending. `mail.warmerlymail.com` is one front door for every customer: it looks up which of our mail servers holds your mailbox and hands your mail to it, so a server move is a change in our system and not in your DNS. A domain set up earlier may show a different server name instead, and keeps working. Publish them at the company that runs your domain's DNS (a registrar such as GoDaddy or Namecheap). If we manage your DNS for you (an automatic setup), we publish them and there is nothing to do.

| Record | Name | Value | What it does |
| --- | --- | --- | --- |
| MX | your domain (`@`) | `mail.warmerlymail.com` (also shown on your domain page), with the priority shown there | Sends incoming mail to our mail server |
| TXT (SPF) | your domain (`@`) | `v=spf1 include:` followed by the value shown on your domain page, then `-all` | Allows our sending addresses to send as your domain |
| TXT (DKIM) | the selector shown on the page, then `._domainkey` | the key shown on the page | Lets receivers verify your messages' signature |
| TXT (DMARC) | `_dmarc` | `v=DMARC1; p=none` at first | Tells receivers what to do when a check fails |
| MX | `bounce` | the same mail server name, with the same priority | Receives bounces for your domain |
| TXT (SPF) | `bounce` | the same SPF value as above | Allows bounce handling to work |

A few rules that avoid the common problems:

- **Only one MX target on the main domain.** A leftover MX record from a previous provider at an equal or better priority splits your incoming mail between two servers. The domain page flags it.
- **Only one SPF record.** If your domain already has an SPF record (for example one from Google Workspace), add our `include:` into it rather than adding a second record. Two SPF records are an error and every message fails SPF.
- **Leave the DKIM record exactly as shown.** Some DNS providers wrap or trim long values; if the key does not match, the domain page shows the record as missing.
- **Records can take time to appear.** Up to an hour is normal, occasionally longer. We re-check automatically and the mailbox switches on by itself once everything is live.

The step-by-step version for each DNS provider is in the [DNS and mailbox setup guides](https://warmerly.com/docs/guides/dns-records), and the app's domain page shows which records are live and which are still missing.

## Do I need to change my DNS if Warmerly moves servers?

Mostly not. The mail server names (`mail.warmerlymail.com`) and `_spf.warmerlymail.com` belong to Warmerly, and we point them at whichever server your mailbox is on. When we move a mailbox to another server, or change the sending addresses behind it, the MX and SPF records you published stay exactly as they are.

**The one record that can change is DKIM.** Each server signs with its own private key, and keys never leave the server that made them, so a moved mailbox gets a new DKIM key.

- **If we manage your DNS** (an automatic setup), we publish the new key ourselves. You do nothing.
- **If you manage your own DNS**, we email you the new DKIM record first. We build and test your mailbox on the new server, and we only switch over once the new record is live, so nothing breaks while you add it. Until then your mailbox stays where it is, on the old record.

If you set a mailbox up earlier, your MX and SPF records may name one of our servers directly instead of the names above (for example a name beginning `mx` followed by a number). Those keep working and keep verifying as correct, so you do not have to change them.

## How we keep our own domains from hurting your mail

Spam blocklists score the domains a message shows: the From address, the signing domain, the bounce address, the server's name and the links inside it. Warmerly keeps its own infrastructure domain out of every one of those places.

- **The domain in your DNS records is never in your messages.** `warmerlymail.com` is used only for the names above. It is not in the From line, the DKIM signature, the bounce address, the server's name or any link.
- **Links never carry our domains.** Customers cannot use Warmerly's own domains as a link domain, and when there is no safe link domain, campaign mail carries no link of ours at all.
- **Our own domains are checked regularly** against the major blocklists, and our team is emailed the moment one is listed. While one of our sending addresses is listed, campaign mail from the hosted mailboxes behind it is held automatically, and resumes by itself once it clears.
- **Servers identify themselves with the hosting provider's name, never a Warmerly domain.** A blocklisted company domain is the one thing that can stop us getting a sending address delisted.

## Paid, ready-warmed and free mailboxes are kept apart

Warmerly hosts three kinds of mailbox, and each kind sends in its own lane:

| Lane | What it is | How it is kept apart |
| --- | --- | --- |
| **Paid** | Hosted mailboxes (OneMail) that customers order, on their own domains or on domains bought through us | Customers' own domains |
| **Ready-warmed** | Mailboxes that have already finished warmup, so a customer can buy one and send the same day | Domains we own and use only for this, not the free mailboxes' domains. Once bought, the mailbox moves to the buyer's workspace with its history |
| **Free** | The free mailbox new accounts get, on shared domains kept for free mailboxes | Separate domains, and separate servers with sending addresses of their own |

Providers keep reputation per sending address and per sending domain. Keeping the lanes on separate domains means a problem on one lane's domains stays on those domains, and keeping free mailboxes on separate servers and addresses means a misused free mailbox does not touch the addresses paying customers send from. The free lane also has stricter sending limits of its own: see [Get a free sending mailbox](https://warmerly.com/docs/help/free-sending-mailbox).

Warmerly's own account emails does not use these lanes at all. It goes out through a separate sending platform.

## How a new sending address earns volume

When we add a sending address to a lane, it does not start with a full share of the mail.

1. **It is checked first.** Its name records must point both ways (the address names its server, and the server's name leads back to the address), and it must not be on a blocklist. Until it passes, it carries no customer mail.
2. **It starts small.** It begins with a small share of its lane's mail.
3. **It grows one step at a time, about once a day.** It only grows when there was enough mail to judge, the results at every receiving provider were healthy, it really used the share it already had, and it is not on a blocklist.
4. **It does not grow on age.** It never grows just because time has passed. An address that sits idle, or whose results slip, stays where it is.
5. **It has a ceiling.** Growth stops at a limit set for that address, and only a person on our team can raise it.

Each address keeps its own track record and its own pace with each receiving provider. Gmail, Microsoft, Yahoo and Apple are each tracked separately, and all other providers together, so trouble at one provider first slows mail to that provider only.

This is the same idea as warmup for a mailbox, applied to the servers' own addresses. For your mailbox itself, see [How warmup works](https://warmerly.com/docs/how-warmup-works).

## What we watch

For every sending address, separately for each receiving provider:

- **Bounces**: messages rejected because the address does not exist or cannot receive mail.
- **Deferrals**: messages the receiving provider asks us to try again later.
- **Refusals as spam**: messages the provider turns away because of the sender's reputation or the content, rather than because of the address.
- **Spam complaints**: recipients pressing "report spam", when the provider reports it back to us. Most providers, Gmail included, never tell the sender who pressed "report spam", so a low count here does not prove nobody did.
- **Blocklists**: whether any of our sending addresses appears on the public lists that providers consult.

For each hosted mailbox you pay for or bought ready-warmed, and each workspace, we also watch the campaign mail it sends to the outside world: how much bounces, how much is refused as spam, and how many recipients report it. Warmup mail between Warmerly mailboxes does not count. The free mailbox has fixed, stricter limits instead (see [Get a free sending mailbox](https://warmerly.com/docs/help/free-sending-mailbox)).

For your mailbox and workspace, each check needs enough mail to judge before it counts, and one spam report is not enough on its own, so one person pressing "report spam" does not slow your mailbox down.

## What we do when results slip

The automatic steps slow sending down, and bring it back a step at a time once results are healthy again. Beyond that, the only volume they add is the slow growth of a healthy new address described above, up to its ceiling.

**At one address, for one receiving provider.** If results at, say, Microsoft get worse at one address, that address slows its delivery to Microsoft. Mail to other providers carries on at the normal pace. Once results have been clean for a while, the normal pace comes back.

**At one address, for everyone.** If an address appears on a blocklist, or its results at a provider are bad enough, it is slowed for every provider and taken out of use as soon as another healthy address can carry its mail. If the listing is on one of our own sending addresses, mail from the hosted mailboxes behind it is also held automatically, and it resumes by itself once the listing has cleared and the next checks stay clean. Otherwise a person on our team decides when an address comes back, and records why.

**For one hosted mailbox you pay for.** Usually you first get an email saying results are slipping, while sending carries on as normal. If they keep slipping, the mailbox's campaign sending is slowed to about half of its usual daily volume. If the results are bad rather than slipping, it is slowed to about a quarter straight away, and if they are still that bad a day later, the mailbox comes off your campaigns until it recovers.

**For a whole workspace.** When the problems are spread across a workspace's mailboxes, the same happens one level up: the workspace can be slowed, and if things do not improve, campaign sending is paused on every mailbox in it. Our team is told when that happens and may review the workspace.

**Warmup keeps running.** Slowing or pausing campaign sending does not stop warmup, because warmup is what rebuilds a mailbox's reputation.

**You are told.** We email you (unless you have turned off alert emails) when sending is slowed or paused. The mailbox page (and, for a workspace, the **Accounts** page) shows a banner saying what was measured and what helps.

**It comes back by itself.** As the results stay healthy, sending is raised a step at a time, about a day apart, until it is back to normal. If our team is reviewing your workspace, it returns once that review is done. The details are in [Why did my sending slow down or pause?](https://warmerly.com/docs/help/sending-slowed-or-paused)

## What we do not do

- We do not switch addresses to get around a block; we slow down, find the cause and recover.
- The automatic system never adds, buys or swaps sending addresses. Adding an address to the network is a decision a person on our team makes; the system only starts it on a small share once it passes its checks.
- Suspending a Warmerly account is a decision made by a person on our team.
- Every change the sending network makes on its own is recorded with the evidence behind it, and our team can review it and undo it.

## How we protect your reputation from other customers

- **Separate lanes.** Each lane uses its own domains, and free mailboxes are placed on separate servers, away from the paid lane's sending addresses.
- **Every paid mailbox and workspace is judged on its own mail.** A customer whose campaign mail starts to bounce or draw complaints is slowed down mailbox by mailbox, and then across their workspace, as soon as there is enough mail to judge.
- **Pace per provider.** Each sending address has its own pace with each receiving provider, so a provider that pushes back gets less mail from that address rather than more.
- **A person before any suspension.** Accounts that keep causing problems are looked at by our team, and our [Acceptable Use Policy](https://warmerly.com/acceptable-use) sets out what is not allowed.

## What we promise

Warmerly makes exactly four promises beyond "we try our best". The binding wording is in the Guarantees section of our [Terms of Service](https://warmerly.com/terms#guarantees); this is a summary of it.

- **30-day inbox guarantee.** Warmup (paid outreach plans). Refund of that month's plan fee (1/12 of an annual fee) if a mailbox warming continuously for 30 days shows no placement improvement between its first test and one on/after day 30. Conditions: stayed connected with warmup on; both tests run in Warmerly; not if blocklisted for reasons unrelated to warmup or the account breaks the AUP; one refund per workspace; request within 14 days of the later test.

Claims go to support@warmerly.com.

## See your own health in the app

- [What do my mailbox's health score and status mean?](https://warmerly.com/docs/help/mailbox-health): the health score, the status badges and the banner on a mailbox page.
- [How do I read the domain health card?](https://warmerly.com/docs/help/domain-health-card): your domain's DNS records and blocklist checks.
- [How do inbox placement tests work?](https://warmerly.com/docs/help/placement-tests): where a real message from your mailbox lands.
- [What if my domain or IP is on a blocklist?](https://warmerly.com/docs/help/blocklisted)
- [Why did my sending slow down or pause?](https://warmerly.com/docs/help/sending-slowed-or-paused)

## Live status

[status.warmerly.com](https://status.warmerly.com) shows, live, whether our mail servers, their reputation and the sending network are working, along with every other part of Warmerly. See [Is Warmerly down?](https://warmerly.com/docs/help/status-page) for how to read it and follow incidents.

## What we cannot control

- **The receiving provider decides.** Whether a message lands in the inbox or in spam is decided by Gmail, Microsoft and the rest, not by us. Good infrastructure gives your mail a fair hearing; it cannot make a provider accept it.
- **Trust takes time.** A new sending address, a new mailbox or a brand-new domain has to build a track record before providers trust it with full volume, and that cannot be hurried.
- **Content and lists still matter.** A well-warmed address sending to an old or bought list, or sending spammy content, can still land in spam. The tips in [Why did my sending slow down or pause?](https://warmerly.com/docs/help/sending-slowed-or-paused) help with both.

## Questions

### Do you rotate IPs?

Not to get around a block. Within a lane, mail is shared across that lane's sending addresses in proportion to how much trust each one has earned, so a newer address carries less. When an address runs into trouble, we slow it down and, if the trouble is serious, take it out of use as soon as another healthy address can carry its mail, and we find the cause. We do not bring in a fresh address to escape the problem.

### Do I share an IP with other customers?

If your mailbox is hosted by Warmerly (OneMail), yes: it sends from the paid lane's sending addresses, which also carry mail for other customers' hosted mailboxes and, today, for the ready-warmed mailboxes we keep for sale. Each paid mailbox and workspace is still judged on its own results, and one that starts causing problems is slowed down on its own. Free mailboxes are placed on separate servers with addresses of their own, and have fixed, stricter limits instead (see [Get a free sending mailbox](https://warmerly.com/docs/help/free-sending-mailbox)). If you connected a mailbox from your own provider (Gmail, Microsoft 365 or your own mail server), it sends from that provider's addresses, not ours.

### Why was my sending slowed?

One of the automatic protections above acted on your mailbox or workspace. The banner on the mailbox page says which one and what was measured, and [Why did my sending slow down or pause?](https://warmerly.com/docs/help/sending-slowed-or-paused) explains each one and how sending comes back.

### How long does a new mailbox take to warm up?

A mailbox's first two weeks are its warming period, and warmup volume keeps rising for several weeks after that. A brand-new domain can take longer. You don't have to wait to launch: a campaign on a young mailbox starts with a small daily volume and climbs. See [How warmup works](https://warmerly.com/docs/how-warmup-works).

### Does Warmerly read my mail?

To judge reputation, the sending network records the outcome of each delivery attempt and the recipient's domain, not what your messages say. It also keeps the address of the mailbox that sent each message and, when a provider reports that someone marked a message as spam, that person's address, so it can be taken off future sends. Warmup identifies warmup mail by the message identifiers of the messages it sent, and acts only on those messages. It does not open, move or reply to your other mail. Other features you switch on, such as the unified inbox, access your mailbox under our [Terms of Service](https://warmerly.com/terms) and are not part of warmup. See the [Warmup network terms](https://warmerly.com/warmup-terms).

## Related

- [How warmup works](https://warmerly.com/docs/how-warmup-works)
- [Why did my sending slow down or pause?](https://warmerly.com/docs/help/sending-slowed-or-paused)
- [OneMail hosted mailboxes and domains](https://warmerly.com/docs/help/onemail-mailboxes)
- [Deliverability checklist](https://warmerly.com/docs/guides/deliverability-checklist)

## More in Using Warmerly

- [How warmup works](https://warmerly.com/docs/how-warmup-works): What Warmerly's email warmup actually does: the private warmup network, the daily ramp, why warmup never…
- [Plans & limits](https://warmerly.com/docs/plans-and-limits): What each Warmerly plan includes, how mailbox and campaign limits are enforced, and which allowances reset…
- [Troubleshooting](https://warmerly.com/docs/troubleshooting): Fixes for the problems Warmerly users actually hit: DKIM shown as missing when it exists, Microsoft 365 SMTP…